Trust Wallet Safe? How to Revoke Token Approvals on TRON

Is Trust Wallet safe right now?

As of 15 November 2026, no flaw in the Trust Wallet app has been confirmed: Bitquery, which traced the recent wave of TRON USDT thefts, says it found no evidence of one, though it cannot rule one out ^[1]. Its report, with figures verified on 12 November, counts at least $5.42M in USDT taken from 454 TRON wallets between 5 October and 11 November ^[1].

Trust Wallet's name is attached to the story because victims say they used it and because the iPhone hacking kit linked to some thefts looks for it, Bitquery explains ^[1]. The blockchain shows money moving between addresses, not the phone or app behind them, so Bitquery could match only one theft to a published account from an iPhone owner ^[1].

Trust Wallet's own advice points at the phone, not the app. In a post dated 6 November it said two exploit kits, Coruna and DarkSword, target iPhones on older iOS versions, Coruna on iOS 13.0 to 17.2.1 and DarkSword on iOS 18.4 to 18.7, and that "devices on the latest iOS version aren't affected by them" ^[2]. On 11 November it added that its iOS users are not affected by a separate exploit called worse_query and that it never stores recovery phrases or private keys in plain text ^[8].

So the honest answer is: the app itself is not shown to be broken, but a wallet is only as safe as the device and the recovery phrase behind it. For the full timeline of the drains, see the Pouyam guide Trust Wallet Hacked? How to Protect Your USDT on TRON. This guide covers the next question many readers ask: whether revoking token approvals protects them, and how to do it.

What is a token approval on TRON?

A token approval is a permission you sign that lets a smart contract move a TRC-20 token, such as USDT, out of your wallet up to a set limit, without asking you again ^[4][6]. Technically, your wallet calls approve(spender, amount) on the token contract; the approved contract can then call transferFrom to take tokens within that allowance ^[4].

Approvals are normal. Exchanges, swap apps and lending apps on TRON ask for them so they can move your tokens when you trade ^[5]. The risk is that approvals stay active after you leave the app. Trust Wallet notes that most users do not realize approvals stay active indefinitely, and that if a contract "later turns malicious", it can drain tokens "without another confirmation" ^[3].

Many apps request an unlimited amount to save you from approving again later. TronLink's support centre warns that such approvals let other addresses and contracts transfer assets "without prior notification", and advises checking whether a product is open source and audited before you grant one ^[5]. TRON Guide describes an unlimited approval as one where the allowance is set to the largest possible value, and calls such approvals the biggest attack surface on TRON ^[6].

An approval is also tied to one token. Revoking your USDT approval for an app does not cancel an approval you gave the same app for another token, so each one is checked and cancelled separately ^[10].

Did token approvals cause the TRON USDT drains?

No evidence points that way: Bitquery says the thieves in the recent TRON wave already held the wallets' keys, which is different from a drainer site that tricks you into signing away tokens ^[1]. That distinction decides what protects you.

Bitquery describes the pattern it used to find victims. A fee wallet, or a collector it funded, sent the victim's address a few TRX to pay the network fee; seconds later the whole USDT balance left in one payment, and then the leftover TRX went too ^[1]. In one case on 25 October, 18 TRX arrived and 519,093 USDT left 18 seconds later ^[1]. Bitquery reads this sequence as the work of someone who already had the private key or recovery phrase ^[1]. Coindaro, reporting on Bitquery's first findings, notes that Bitquery counted a wallet only when a single payment emptied all of its USDT, "the pattern of a drain by someone holding the private key" ^[7].

An approval theft looks different: the attacker's contract pulls tokens with transferFrom and pays its own fee, so the victim's wallet does not need TRX ^[4]. Bitquery's report puts it plainly: "Here, the thief already holds the keys" ^[1].

Bitquery also shows why this matters. One wallet was emptied twice: it lost 19,069 USDT on 26 October and, after new money arrived, 4,140 USDT more on 10 November ^[1]. "A drained wallet stays open to the thieves for as long as its seed phrase" is in use, the report says ^[1]. Revoking approvals would not have closed that door. Revoking is still good hygiene, and Trust Wallet's own security checklist includes revoking unfamiliar approvals ^[9], but it is a second step, not the cure for a stolen key.

How do I revoke token approvals in Trust Wallet?

Open the latest Trust Wallet, select the Approvals tab in the assets section, review the list and tap Revoke next to any app you no longer trust ^[3]. Trust Wallet says the feature records approvals when you grant them, shows which tokens each app can access and how much, flags contracts linked to known scams, and removes an approval on the blockchain when you revoke it ^[3].

1. Update Trust Wallet from the App Store or Google Play first; Trust Wallet's steps specify the latest version ^[3].
2. On the home screen, open the Approvals tab in the assets section ^[3].
3. Check each entry: the token, the app or contract, and the allowance. Pay most attention to USDT and to unlimited approvals.
4. Tap Revoke for anything you do not recognise, no longer use, or that the wallet marks as risky, and confirm the transaction ^[3].
5. Keep a little TRX in the wallet: on TRON a revoke is a transaction that consumes bandwidth and Energy ^[4].

One limit: Trust Wallet's announcement does not say which blockchains the Approvals tab covers ^[3][10]. If your TRON approvals do not appear there, or you want a second view, use TronScan, which lists every approval an address has granted, described in the next section ^[4][6].

Revoking only works on approvals. It cannot reverse a transfer that already happened, and it cannot protect a wallet whose recovery phrase someone else knows ^[10].

How do I revoke TRC-20 approvals on TronScan?

Search your TRON address on TronScan, open the approvals list on the account page, then cancel each unwanted approval and sign the transaction in your wallet; this sets the allowance to zero ^[4][6]. TronScan added this cancel feature on 14 May 2021 and also shows an approval change history ^[4].

1. Type tronscan.org into your browser yourself; do not follow a link from a chat or an ad ^[10].
2. Paste your address, which starts with T, into the search bar ^[6].
3. On the account page, open the approvals tab, labelled Approval or List of Approval depending on the layout ^[4][6].
4. For each entry, look at the token, the contract that received the approval and the amount. Prioritise unknown or unverified contracts and unlimited approvals; TRON Guide advises revoking a contract you cannot identify with confidence ^[6].
5. Click Cancel or Revoke on the row and connect a compatible wallet, such as TronLink, for that address ^[6].
6. Read the signing screen: it should call approve on the token contract with an amount of 0. If it asks for anything else, stop ^[10].
7. Refresh the list after confirmation; on TRON this usually takes a few seconds ^[6].

TronLink users can do the same inside the wallet: TronLink's support centre points to Wallet Management, then Approval Management, to view or cancel approvals ^[5]. Each cancellation, and any later re-approval, consumes bandwidth and Energy; with no Energy of your own, the network burns TRX to pay for it ^[4].

Which token approvals should I revoke?

Revoke any approval you cannot explain, any unlimited approval to an app you stopped using, and anything granted to an airdrop, "verification" or energy-rental site ^[6][10]. Keep only approvals for services you use and trust, and re-approve later if you return to one.

The table below sums up the common cases. A useful test is simple: if you cannot say what a spender address is, it should not be able to spend your USDT ^[10].

Watch out for look-alike tokens. Approvals on a fake "USDT" that is not the real Tether contract cannot touch your real USDT ^[10]. The real USDT contract on TRON is TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t; check that address on the token's TronScan page before you act.

Bitquery found a related trick in the theft data: more than half of the addresses that paid one collector were bots sending dust and fake tokens from look-alike addresses, a method called address poisoning, in the hope that someone later copies the wrong address ^[1]. Always copy a destination address from a trusted source, never from your transaction history.

What should I do if my recovery phrase may be exposed?

Treat the wallet as compromised: create a new wallet with a new recovery phrase on an updated, clean device, move what is left, and stop using the old one ^[1][10]. Bitquery says whoever holds the seed phrase has the money and needs no password and no access to the phone ^[1].

1. Update the phone first. Trust Wallet tells iPhone users to install the latest iOS available for their device, and to turn on Lockdown Mode if updating is not possible right away ^[2].
2. Create the new wallet and write the new recovery phrase on paper. Do not keep it in photos, screenshots or notes, which the Coruna and DarkSword kits search, Trust Wallet says ^[2].
3. Send a small test amount to the new address, then move the rest. Keep enough TRX for the fees.
4. Leave the old wallet empty. If new money reaches it, the thieves can take it again, as happened to one wallet Bitquery tracked ^[1].
5. If something looks wrong, contact Trust Wallet support with the wallet address and transaction hash; Trust Wallet says it will never ask for your recovery phrase and never messages first ^[2].

Consider a hardware wallet for larger balances, bought directly from the maker. If funds were already stolen, report it quickly to Tether and to any exchange the money reached, because Bitquery notes that USDT can be frozen only before it moves on ^[1]. Ignore anyone offering paid recovery services. This is general security guidance, not financial advice.

How do I spot a fake approval checker?

Use only TronScan, TronLink or your wallet's own Approvals tab, reached by typing the address yourself, because fake "approval checker" sites are a known phishing trick in which the Revoke button signs a new approval ^[10]. A real revoke always sets the amount to zero.

• No real revoke tool ever asks for your recovery phrase or private key. Never paste them into any "revoke all" website.
• Before signing, read the function and amount: approve with 0 is a revoke; approve with a large number, a transfer, or a permission change is not ^[10].
• Be suspicious of "cheap energy" rental and airdrop sites: TronTransfer says some ask you to authorise a rental whose signature is really an unlimited USDT approval ^[10].
• Check the account permissions on TronScan too: some TRON scams change who controls an address, which revoking approvals does not undo ^[10].
• Ignore direct messages from anyone claiming to be Trust Wallet support; Trust Wallet says it never messages first ^[2].

If you lost money to a fake support agent or recovery service, report it to the police or your national cybercrime unit and keep a copy. For the wider context of iPhone security, see What Are Passkeys? How Passwordless Sign-In Works and Why It Is Safer, which explains why phone security now protects more than one account.