Trust Wallet Drain Claim Puts Spotlight on Permit Signatures and Token Permissions

TLDR

• A Trust Wallet user says 3,830 USDT disappeared from his wallet with no approval request or warning.
• He shared a transaction hash and says he has used the same wallet for about five years.
• A second user says a fake support agent on NEAR Protocol’s Discord drained his wallet.
• Past attacks used permit signatures that let attackers move tokens without a new approval.
• Trust Wallet Support replied on November 4 to a separate user with swap problems.

A Trust Wallet user says 3,830 USDT left his wallet without his approval. His post on X on November 3 has drawn more than 166,000 views. The cause of the transfer has not been identified.

Iaroslav Dubovoi, who posts as @noirvox_studio, said he opened the app and found his funds gone. He said he got no warning and no request to approve a transaction. He asked Trust Wallet for an explanation and urged others to share his post.

What the User Says Happened

Dubovoi said blockchain records showed the funds had been moved, but he could not explain how. He later posted a transaction hash that he linked to the missing USDT.

He said he had used the same wallet for about five years. He also said he had always taken steps to protect his crypto holdings.

The blockchain network, the receiving address and the details of the transfer were not established in his posts. The transaction hash gives a starting point for tracing where the funds went.

Trust Wallet is a self-custody wallet. Users hold the private keys needed to approve transactions, unlike on centralized exchanges where the platform manages customer assets.

How Funds Can Move Without a New Approval

Unauthorized transfers can happen in several ways. These include stolen private keys, harmful smart contract permissions and misleading transaction signatures.

Some of these methods do not need a fresh approval at the moment funds leave. In an October investigation, blockchain security firm Salus found malicious USDG permit signatures that gave attackers spending rights over victims’ tokens.

In those cases, attackers used permissions they had already obtained. They then moved tokens without the victim approving each transfer.

Trust Wallet recently warned users about a fake website copying its crypto card service. The site was built to trick users into connecting wallets and possibly signing harmful transactions, which can let others move certain tokens without the recovery phrase.

In December 2025, Trust Wallet confirmed that version 2.68 of its Chrome extension let attackers drain funds without transaction approvals. Blockchain investigator ZachXBT first flagged the suspicious transfers after users reported withdrawals.

Attackers had gained access to the extension’s source code and pushed a malicious version through the Chrome Web Store. Losses reached about $7 million, and former Binance CEO Changpeng Zhao confirmed that affected users would be compensated.

Also on November 3, an X user called Mister Tee, who posts as @meeyatariq, said his wallet was drained after contact with someone posing as support on NEAR Protocol’s Discord server. His screenshots showed outgoing transfers of ETH, BTC, BNB and NEAR, including 3 NEAR worth about $11.49.

Unlike Mister Tee, Dubovoi did not link his loss to any outside contact. He has said he approved nothing before the funds disappeared.

Trust Wallet has advised users not to share recovery phrases or private keys. It has also told users to rely on official support channels when looking into suspicious activity.

A separate user, Abdul, who posts as @HasbullahAbdulH, complained on X about problems swapping tokens. The verified Trust Wallet Support account replied on November 4 and pointed him to a guide on failed swaps, stuck transactions and receiving unexpected amounts.

The post Trust Wallet Drain Claim Puts Spotlight on Permit Signatures and Token Permissions appeared first on Blockonomi.