Trust Wallet: software wallets rating breakdown
It has done the thing almost nobody in this industry does: it reimbursed its users. Twice. After the 2023 low-entropy key-generation bug and after the December 2025 malicious-extension incident that cost users about $8.5m, Trust Wallet paid people back. That is rare and it counts.
It has done the thing almost nobody in this industry does: it reimbursed its users. Twice. After the 2023 low-entropy key-generation bug and after the December 2025 malicious-extension incident that cost users about $8.5m, Trust Wallet paid people back. That is rare and it counts.
How the score is built
Each criterion is scored 0–10 and weighted. The median column is the middle score across every entry in this ranking, so a row reads as a position rather than a number.
| Criterion | What we measured | Weight | Score | Category median | Rank | Weighted gap |
|---|---|---|---|---|---|---|
| Security model and open code | — | 30% | 4 | 8 | 13 of 17 | -1.20 |
| Privacy | — | 20% | 5 | 5 | 9 of 17 | 0.00 |
| Transaction transparency | — | 15% | 5 | 5 | 8 of 17 | 0.00 |
| Swap cost | — | 15% | 2 | 5 | 12 of 17 | -0.45 |
| Recovery and portability | — | 10% | 9 | 9 | 1 of 17 | 0.00 |
| Networks | — | 10% | 9 | 7 | 1 of 17 | +0.20 |
Measured 14 July 2026 · weights and method · decided by security model and open code, worth -1.20 points against the median
Security model and open code: 4/10
Non-custodial, MPC or custodial — and where the key actually sits on your device. Then the licence, as it stands today rather than as folklore remembers it: several well-known wallets have quietly moved to source-available terms that are not open source. Audits count only when the firm is named and the report is public.
Scored 4 of 10 against a category median of 8, which places it 13th of 17 among software wallets on this criterion. At a 30% weight that is 1.20 points below the median contribution of the weighted total. The best score in the category is 10, the worst 2.
Privacy: 5/10
The most underrated question in this category: which RPC endpoint does the wallet talk to out of the box, and who owns it? If the default RPC is operated by the wallet’s own vendor, that vendor sees the IP address behind every balance check and every transaction, and can link it to your addresses. We read the default configuration and the privacy policy, and we quote the clause. Can you point it at your own node, and how hard is it?
Scored 5 of 10 against a category median of 5, which places it 9th of 17 among software wallets on this criterion. At a 20% weight that is exactly level with the median of the weighted total. The best score in the category is 10, the worst 2.
Transaction transparency: 5/10
Does the wallet simulate the transaction and show you the actual outcome before you sign it, and does it warn you about known drainer contracts? The same question as clear signing on a hardware device, asked of software.
Scored 5 of 10 against a category median of 5, which places it 8th of 17 among software wallets on this criterion. At a 15% weight that is exactly level with the median of the weighted total. The best score in the category is 10, the worst 3.
Swap cost: 2/10
The built-in swap is how most free wallets are paid. We record the published service fee — and when a wallet does not publish one at all while still taking a cut of the spread, that silence is the finding and it is scored as one.
Scored 2 of 10 against a category median of 5, which places it 12th of 17 among software wallets on this criterion. At a 15% weight that is 0.45 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.
Recovery and portability: 9/10
Standard BIP39, and whether the seed restores in another wallet. A wallet you cannot leave is a custodian with extra steps.
Scored 9 of 10 against a category median of 9, which places it 1st of 17 among software wallets on this criterion. At a 10% weight that is exactly level with the median of the weighted total. The best score in the category is 9, the worst 3.
Networks: 9/10
Which chains genuinely work, from the wallet’s own documentation.
Scored 9 of 10 against a category median of 7, which places it 1st of 17 among software wallets on this criterion. At a 10% weight that is 0.20 points above the median contribution of the weighted total. The best score in the category is 9, the worst 2.
Other measurements
Its nearest neighbours in this ranking
| # | Entry | Security model and open code | How it differs |
|---|---|---|---|
| 11 | Keplr | 5 | Ahead by 1 on security model and open code. |
| 12 | MetaMask | 4 | Level on security model and open code; the gap is elsewhere. |
| 14 | Phantom | 2 | Behind by 2 on security model and open code. |
| 15 | Coinbase Wallet (Base App) | 2 | Behind by 2 on security model and open code. |
Incidents priced into this score
- 2023-04-22 — Browser-extension low-entropy key generation: every wallet created between Nov 2022 and the fix used a 32-bit seed, brute-forceable from any address. ~$170k lost; users reimbursed. [users made whole: confirmed] [source]
- 2025-12-24 — A malicious extension build was published to the Chrome Web Store using developer credentials stolen in an npm supply-chain attack. ~$8.5m across 2,520 addresses. Trust Wallet announced voluntary reimbursement. [users made whole: confirmed] [source]
Questions about this score
Was Trust Wallet hacked?
+
It has had two serious incidents: a 2023 bug that generated keys with insufficient entropy for wallets created in a specific window, and a malicious update in December 2025. Users were reimbursed both times, which is the part that distinguishes it — in this industry compensation is usually promised and rarely confirmed.