Phishing, Scam Tokens & Malicious dApps

Try Tangem secure wallet →

Table of contents


Quick answer: can funds be stolen from Trust Wallet?

Short answer: yes. Any software wallet (hot wallet) that holds private keys on a device can be drained if those keys or approvals are exposed. Phishing pages, fake dApps, and malicious approvals are the most common routes bad actors use to move funds out of a wallet. What I believe matters most is how you interact with dApps and which approvals you grant—those decisions are what put funds at risk.

When I first set this up, I almost clicked "approve unlimited" on a suspicious airdrop page. Thankfully I double-checked the transaction details and canceled. Small habits like that make a big difference.

How phishing and fake dApps work

Phishing for a software wallet usually looks the same: a copycat website (or app) asks you to connect, sign, or approve something. A fake dApp might mimic a popular swap or staking UI but submit a malicious contract call instead. Sometimes the attacker sends a message that urges immediate action — "claim now" — and that social pressure is the trick.

Fake dApp trust wallet attacks can happen through links in social channels, QR codes, or even spoofed support pages. The connection step is where the wallet hands over the power to a smart contract (via a token allowance). Once that allowance exists, a malicious contract can move approved tokens.

Common red flags and attack vectors

But remember: not every odd-looking page is malicious. The trick is to check the basics before you act.

Step-by-step: what to do before connecting a dApp

  1. Pause. Read the URL and confirm the domain. Does it match the project’s official links?
  2. Use a fresh address for unknown sites. Create a throwaway wallet with a small test balance.
  3. Check the dApp on-chain details in a block explorer (contract address, liquidity pools, ownership).
  4. Limit allowances: approve only the amount you intend to move, not an unlimited allowance.
  5. Review the transaction inside your wallet carefully: the receiver address, method names, and gas. If it looks opaque, cancel.
  6. Prefer WalletConnect or an official in-app browser listing over clicking random links (but still validate the site).

And always keep a backed-up seed phrase offline. That step alone removes a lot of attack surface.

For more on safe browsing inside the app, see the dApp browser and WalletConnect guides.

How to check and revoke malicious approvals

Malicious approvals are a frequent vector. Once you approve a token allowance, a contract can spend or move those tokens within the set limit. Here's a safe, general approach to check and revoke approvals:

Step-by-step to review allowances:

  1. Find your public address and paste it into a reputable block explorer (for the chain you used).
  2. Look for a "Token Approvals" or "Spender" view — many explorers list active allowances.
  3. Identify any spender contracts you don't recognise. If you see an unlimited allowance to a router or random contract, flag it.
  4. To revoke, either use your wallet to send an approval-reset transaction (set allowance to 0) or use a trusted revocation service while taking the usual connection precautions.

Revoke transactions cost gas. So yes, there’s a trade-off: the protection is worth the fee when an approval looks risky. If you’re unsure, move the remaining funds to a new wallet with a fresh seed phrase and no previous approvals.

For a step-by-step revoke walkthrough, visit revoke-token-approvals.

Spotting scam tokens (and how to avoid them)

Scam tokens often share telltale signs. Look for these checks before buying or interacting:

Avoid scam tokens trust wallet buyers often regret impulsive buys. Slow down. Verify addresses, check liquidity, and review token metadata through the explorer or trusted listings.

If you think you’ve been targeted or funds were stolen

  1. Move any remaining tokens to a new wallet you control (create a new seed phrase on a clean device).
  2. Revoke approvals for the compromised address if possible, or move funds off before the attacker can act.
  3. Report the theft to any exchanges where the attacker might try to cash out.
  4. Document transactions (screenshots, TX IDs) — useful if you file a report or contact recovery services.

But be honest about expectations: recovery is rare. I’ve found that fast containment (moving safe assets, revoking approvals) is the most practical step.

If you need recovery steps and next actions, see someone-stole-my-crypto and lost-phone-recovery.

Quick comparison: hot mobile app vs hardware vs browser extension

Feature Hot mobile app (e.g., Trust Wallet) Hardware wallet (cold) Browser extension (hot)
Private keys stored On-device (encrypted) Offline on device On-device (encrypted)
Ease of daily swaps High (mobile-first UX) Lower (more steps) Medium (desktop convenience)
dApp connectivity Built-in dApp browser / WalletConnect Limited (depends on integrations) Direct injected provider / WalletConnect
Phishing risk Moderate — user connects on phone Low — device must sign each tx Moderate — browser spoofing possible
Recommended use-case Daily DeFi activity, mobile-first Large holdings, long-term storage Desktop DeFi, testing and trading

Learn more about cold storage options at ledger-hardware and backup practices at backup-recovery.

FAQ

Q: Is it safe to keep crypto in a hot wallet? A: Hot wallets trade off convenience for risk. They're fine for smaller balances and active DeFi use. For large holdings, consider splitting funds and keeping the bulk in a hardware wallet or cold storage. See security-features for more.

Q: How do I revoke token approvals? A: Use a block explorer to inspect active "Token Approvals" for your address, then submit a transaction to set questionable allowances to 0. If you need a guided walkthrough, see revoke-token-approvals.

Q: What happens if I lose my phone? A: If you have your seed phrase, you can restore your wallet on another device. If you don't, the funds are effectively lost. Store your seed phrase offline (paper or hardware) and read seed-phrase-backup for options. For steps after losing a device, read lost-phone-recovery.

Conclusion & next steps

Phishing, scam tokens, and malicious dApps are real risks, but they are manageable with consistent habits: check addresses, limit approvals, test with small amounts, and keep strong backups. I use throwaway addresses for risky interactions and keep larger balances offline. What I've found is that a few deliberate checks before every connect prevent most headaches.

If you want guided how-tos, check the dApp browser, revoke-token-approvals, and backup-recovery pages next. And if you ever suspect theft, act fast and document everything.

Try Tangem secure wallet →