Trust Wallet Review 2026: Great Phone App, Troubled Extension
How we reviewed this: from the project’s own documentation, published audits and independent security research.
Over 100 blockchains in one free mobile app, and one of the easiest ways for a Canadian to hold crypto they actually control. The mobile app has a clean record. The browser extension has had three bad years.
By the CryptoNorth Team
Who This Is For
Trust Wallet is a free, non-custodial mobile wallet. Non-custodial means the 12-word recovery phrase is generated on your phone and the keys are encrypted there — nobody at Trust Wallet or Binance can move your funds, freeze your account, or restore your access if you lose the phrase[1]. That last part is the trade. There is no support line that can undo a mistake.
It suits you if you want one app holding assets across many chains, you are comfortable on a phone, and the amounts involved are ones you could stand to lose to a mistake or a bad link. It does not suit you as the final home for serious savings — that is what a hardware wallet is for, and Trust Wallet is a hot wallet on an internet-connected device no matter how careful you are.
The Basics
Trezor pairing is not supported, and Ledger pairing works only through the browser extension, not the phone app[3].
What “10 Million Assets” Means
Trust Wallet advertises support for over 10 million assets. The honest translation: it natively supports more than 100 blockchains — Bitcoin, Ethereum, BNB Chain, Solana, TRON, Cosmos, XRP Ledger, Avalanche, TON, Sui and the major layer 2s — and understands the common token standards on them[1][3].
The ten million figure counts every token that fits those standards. It is not a list of assets anybody has checked. Any wallet supporting ERC-20 “supports” millions of tokens including the worthless and the outright malicious. The chain count is the number that tells you something; the asset count tells you almost nothing.
What It Actually Costs
The app is free and there is no subscription. Money is made elsewhere, and it is worth knowing where.
- The app itself
- Receiving and holding
- Staking (the feature)
- Creating unlimited wallets
- Card purchases: 3.5–5%
- Plus 1% unless you hold 100+ TWT
- Swaps: embedded spread
- Every transaction: network gas
Card on-ramps through partners like MoonPay run 3.5% to 5%, plus a further 1% unless you hold at least 100 TWT tokens, plus any currency conversion[3]. Buying on a Canadian exchange like NDAX at 0.20% and sending the coins to your Trust Wallet address costs a fraction of that, even after the withdrawal fee.
In-app swaps carry no itemised fee, which sounds better than it is: the cost sits in the quoted rate as spread and slippage from third-party liquidity sources rather than appearing as a line item[1][3]. Also remember that under CRA rules, swapping one token for another is a taxable disposition, even though no Canadian dollars moved. See our tax guide.
The Browser Extension Record
This is the part of the review that should change your behaviour. The mobile app has no equivalent history — the extension has had three incidents in three years[1]:
Extension versions 0.0.172 to 0.0.182 generated seeds using only 32 bits of entropy, leaving wallets brute-forceable by a consumer graphics card in hours. Thefts ran from December 2022 to March 2023. Trust Wallet patched the underlying library and compensated verified victims[1][2].
Attackers used stolen developer credentials to publish a malicious extension version 2.68 to the Chrome Web Store. Anyone who opened and logged into it between 24 and 26 December 2025 was exposed. Trust Wallet reported 2,520 affected addresses and roughly $8.5 million lost, and opened a reimbursement claims process[2].
A token migration malfunction, smaller in impact than the other two[1].
Notice that the 2023 flaw is the same failure as the one that cost Coldcard owners $116 million in 2026: a wallet generating seeds with far too little randomness, letting an attacker regenerate them without ever touching your device. Two unrelated companies, three years apart, same mistake. If you take one thing from our wallet reviews, make it this — how a wallet generates your seed is the thing most worth caring about, and it is almost never what reviews discuss.
To Trust Wallet's credit, it disclosed both incidents and paid people back, which is more than many do. The practical conclusion stands regardless: use the mobile app, and treat the extension as a small spending wallet for dApps — the sites and apps you connect a wallet to — never as storage.
Open Source, and Who Owns It
Trust Wallet is often described as open source, including on this site until now. That is only partly right. The Wallet Core cryptographic library is open source under Apache 2.0, but the mobile app, the browser extension and the backend services are not[1][2]. You can inspect the engine, not the vehicle.
That is a meaningful step above software with no published source, and the open component is the security-critical one. It is still not Trezor-grade transparency, and we have corrected our comparison page accordingly.
On ownership: Binance acquired Trust Wallet in 2018; it is an independent legal entity after that acquisition. Because the wallet is non-custodial, Binance cannot touch your funds — the architecture, not the promise, is what protects you there. Whether a wallet owned by a company that took a $4.3 billion US Department of Justice settlement in November 2023 belongs in your pocket is a judgement only you can make[1], but you should make it knowingly.
Pros and Cons
Frequently Asked Questions
The mobile app is reasonable for everyday amounts and has not suffered a comparable incident. The browser extension is a different story: a 2023 flaw generated seeds with only 32 bits of entropy, and in December 2025 attackers pushed a malicious version to the Chrome Web Store that drained about $8.5 million from 2,520 addresses. Use the phone app, keep only small dApp balances in the extension, and hold long-term savings on a hardware wallet.
No. Trust Wallet is non-custodial - your keys are generated and encrypted on your device, and Binance holds no copy. That is a property of how the software is built rather than a promise you have to trust. The flip side is that nobody can help you recover funds if you lose your 12-word phrase or send to a wrong address.
Partly, and this is commonly overstated. The Wallet Core cryptographic library is open source under Apache 2.0, but the mobile app, browser extension and backend are not. You can audit the cryptography but not the interface built on top of it. If fully open-source software is your requirement, a Trezor device or a wallet like Sparrow will suit you better.
Generally no. Card purchases through its partners run 3.5-5%, plus another 1% unless you hold 100 or more TWT tokens, plus currency conversion. Buying on a regulated Canadian exchange and transferring the coins to your Trust Wallet address is far cheaper - NDAX charges 0.20% per trade and $1.50 to withdraw by Interac. The convenience premium inside the app is very large.
Yes. Under CRA rules, trading one crypto asset for another is a disposition of the first asset and a taxable event, even though no Canadian dollars were involved and no exchange was used. You need the fair market value in CAD at the time of each swap to work out your gain or loss. Wallet swaps are a common source of unpleasant surprises at tax time - see our tax guide.
This review is for informational purposes only and is not financial or security advice. Fees, chain support and app versions change — confirm current details with Trust Wallet before relying on anything here. A hot wallet on an internet-connected device always carries more risk than dedicated hardware.
Download only from trustwallet.com or your official app store. Fake wallet apps are common.