trustwallet / developer

Trust Developer documentation: developer.trustwallet.com
https://developer.trustwallet.com
MIT License
347 stars 198 forks source link

Urgent: Critical Security Concerns and Immediate Action Required #313

Closed Dolcavita closed 7 months ago

Dolcavita commented 7 months ago

Dear Trust Wallet Team,

After a couple of tickets, emails to support and your chat, I am writing to you with a sense of urgency and grave concern regarding a critical security issue that I recently encountered while using Trust Wallet's platform. It is imperative that you understand the severity of the situation and take immediate action to prevent further harm to your users.

On 27.2.2024, I fell victim to a scam while using Trust Wallet's integrated browser function. Despite your company's policy advising users to avoid phishing websites, I was targeted and exploited within moments of accessing a seemingly harmless website through your platform.

The consequences were devastating. Within a mere 3 seconds of making a transaction, my entire portfolio, consisting of $30,000 worth of assets, vanished without a trace. This egregious breach of security not only resulted in significant financial loss for me but also exposed the glaring vulnerabilities within Trust Wallet's infrastructure.

What is most alarming is that the individual responsible for this heinous act continues to perpetrate scams with impunity, exploiting the same security loopholes that allowed them to victimize me. Each passing day without intervention only serves to exacerbate the damage inflicted upon unsuspecting users.

I have taken every possible measure to address this issue, including filing complaints with Interpol and the FBI, reaching out to Apple Store support, and contacting both the Trust Wallet developer and your company directly. However, the lack of tangible action on your part is disheartening and exacerbates the urgency of the situation.

I implore you to recognize the gravity of this matter and take swift and decisive action to rectify the security vulnerabilities within your platform. Your users deserve to feel safe and secure when entrusting their assets to Trust Wallet, and it is incumbent upon your company to uphold its responsibility to protect them.

Furthermore, I urge you to reconsider the adequacy of your current policies regarding phishing websites. The ease with which malicious actors can exploit the integrated browser function to defraud users is deeply troubling and necessitates a more robust approach to ensuring user safety.

I cannot overstate the urgency of this matter. Lives and livelihoods are at stake, and the longer this issue remains unaddressed, the greater the harm inflicted upon innocent users. I implore you to act swiftly and decisively to rectify this situation and restore trust in your platform.

The individual then directed me to a website called "publishpremium.vip" and instructed me to add it to the Trust Wallet browser. Upon doing so, an application resembling Uniswap appeared. Despite my initial reservations, I proceeded with a swap of $100 worth of USDT for INJ (Injective).

In a matter of seconds, my entire portfolio vanished into thin air.

Sincerely, Deb

rkokhatskyi commented 7 months ago

Hi Debora,

Our Customer Support team has already received your inquiry, documented under ticket number 718795. Our team will gladly answer any additional questions you may have. For the sake of maintaining the privacy of your information, we do not respond to customer requests on our Github. Therefore, I will proceed with closing this request. Thank you!