Bohdan Tsiupka

webflow developer

[Bohdan Tsiupka @BogdanFraj]

Update on my drained @TrustWallet wallets. I think I found how it happened.

My iPhone was on iOS 18.6. That version is vulnerable to DarkSword, an iOS exploit kit that infects the phone when you just open a compromised website. Its Coruna module targets crypto wallets, and Trust Wallet is on its list of targets.

That explains everything:
• seed only on paper, never shared
• no cloud backup, no extension
• both wallets drained at once, signed with my own key
• the same thief addresses collected funds from many other victims

Since my first post I've found many other people with the same story: official mobile app, seed never leaked, everything gone.

Apple fixed these bugs, but millions of iPhones still run older iOS. A wallet app knows exactly which iOS version it is running on. If a known exploit kit is actively stealing from your users on that version, a warning to update iOS is the least you can do.

@TrustWallet: will you warn users on vulnerable iOS versions and check whether the recent mobile drains are linked to DarkSword/Coruna?

If you use any mobile wallet: update iOS NOW (Settings > General > Software Update). Move savings to a hardware wallet.

Thief's TRON address: TEmwoJArh13FAMTape7YiV7UMiigijighi

@zachxbt @Apple

[Bohdan Tsiupka @BogdanFraj]

@TidelHigh @TrustWallet The same situation

[Bohdan Tsiupka @BogdanFraj]

@Hodlstrong1 The same situation, the same wallet

[Bohdan Tsiupka @BogdanFraj]

@_barasel_ @TrustWallet Write me DM
Let’s investigate it

[Bohdan Tsiupka @BogdanFraj]

Yesterday BOTH of my @TrustWallet wallets were drained at the same time. Every network: TRON, ETH, BTC, SOL. ~$2,500 gone in minutes.

• Both wallets created by me in the official iOS app
• Seed phrases written only on paper
• Never typed, copied or photographed them
• No cloud backup (never created)
• Never used the browser extension
• iPhone only

On-chain, the drain was signed with my own key. Not an approval, not a permission change. So the attacker simply had my keys.

How? I honestly don't know.

The thief's TRON address collected funds from many other wallets in the same 24 hours:
TEmwoJArh13FAMTape7YiV7UMiigijighi

Other drain addresses:

ETH 0x03BEF7E16a75feD1931C61Cf43C9AD29881E07ae

BTC bc1qwstg967ndr9cej84ahpz9csjsasa935dtey6e8

SOL AVLBhdgvTsvVhoPSwfdaExQ5ZrxTCGqD4dJD5NenAgDf

Part of the stolen USDT was laundered through @ChangeHero_io and swapped to USDD to avoid freezes.

If your Trust Wallet was drained to any of these addresses, reply here. If many of us are mobile-only users with no leaked seed, this isn't user error.

@TrustWallet @cz_binance @zachxbt please look into this.

[Bohdan Tsiupka @BogdanFraj]

@_barasel_ @TrustWallet Really?

[Bohdan Tsiupka @BogdanFraj]

@Db3555484070866 @TrustWallet Really? The same person??

[Bohdan Tsiupka @BogdanFraj]

@goodybear_x @TrustWallet It doesn’t make sense

[Bohdan Tsiupka @BogdanFraj]

@SlutskiyAleksey @TrustWallet 1) On the same phone.
2) Grammarly. I am not sure that it is.

[Bohdan Tsiupka @BogdanFraj]

@Bcckpsck @rosaliaseptiani Thanks

[Bohdan Tsiupka @BogdanFraj]

@KulagodChetan @cipherhavensafe Thanks!

[Bohdan Tsiupka @BogdanFraj]

@TrustWallet Is anyone else's mobile wallet drained to TEmwoJArh13FAMTape7YiV7UMiigijighi?

Mine went on Oct 10: two wallets, four networks, same minute. Created in the iOS app, seed never left paper, no backup, no extension.

This address is collecting from a lot of wallets right now.

[Bohdan Tsiupka @BogdanFraj]

Yesterday BOTH my wallets drained at once across TRON, ETH, BTC and SOL.

Official iOS app, wallets created in-app, seed only on paper, no cloud backup, never used the extension. Drain was signed with my own key.

Thief's TRON address (many other victims):
TEmwoJArh13FAMTape7YiV7UMiigijighi

[Bohdan Tsiupka @BogdanFraj]

@cipherhavensafe Great thanks

[BitcoinHabebe @Bitcoinhabebe]

2 days ago, I created a brand new @TrustWallet wallet and deposited $10,000.

Not even an hour later, I received a notification that the entire balance had been withdrawn to another address.

Basically, my wallet was drained.

• Completely new wallet
• Never clicked any links
• Never shared my seed phrase
• Never connected it to any dApp
• Used only on my iPhone

How could this possibly happen?

@cz_binance, you’ve always praised Trust Wallet. I had never really used it for large transactions, but the one time I decided to, this happened.

And I still can’t understand how.

Until now, the only places I’ve felt comfortable keeping significant amounts of crypto were exchanges like Binance, KuCoin and WEEX, because withdrawing requires multiple layers of security.

But this raises a much bigger question:

If a brand new wallet can somehow be drained without the user knowingly clicking a link, signing a transaction, or sharing their seed phrase, how is the industry supposed to solve this?

Maybe I can handle losing 10k$

But imagine someone completely new to crypto who decides to trust a wallet with their life savings.

They download a wallet, deposit their money, go to sleep and an hour later, everything is gone.

How would that person ever trust crypto again?

Was it an exploit?
A compromised device?
A leaked seed phrase?
A malicious transaction?
An inside job?

I don’t know.

And that’s exactly the problem.

If users can’t understand how their money disappeared, how can we expect mainstream adoption?

The space needs to improve its security standard.

[Bohdan Tsiupka @BogdanFraj]

@Bitcoinhabebe @TrustWallet I had the same situation now