James Bro

Head of Security @Trustwallet | Wallet Security, phishing & drainer research | Web3 Security

[James Bro @james_web3sec]

@PhyrexNi @MEXC 同意。给 AI 用的 API Key 至少做三件事：关闭提现权限、绑定 IP 白名单、用单独的子账户限额。链上更别把私钥交给 Agent，用有额度上限的会话密钥或单独的小钱包，出问题损失可控。

[James Bro @james_web3sec]

@SlowMist_Team Key takeaway for users: the right URL doesn't guarantee the right deposit address. A compromised third-party script can rewrite it on the page. Before sending, verify the address through a second channel (app vs. web) and check far more than the first and last 4 characters.

[James Bro @james_web3sec]

⚠️ Phishing alert: trustwalletsyn[.]web[.]app is NOT Trust Wallet.

It's a fake "Connect Wallet" page that asks for your 12/24-word seed phrase or private key. Enter it and your wallet is gone.

Trust Wallet will never ask for your seed phrase on a website. Official site only: https://t.co/SObBPk9eNn

[James Bro @james_web3sec]

@shcallaway @cvedotnow followed.

[Trust Wallet @TrustWallet]

claude, vibe trade Anthropic’s pre-IPO, make no mistakes

[James Bro @james_web3sec]

Thanks for flagging.
Confirming: Trust Wallet will never ask for your seed phrase, by email or anywhere else. Report it and delete it.

[Shanks | SecretShop @iamshanksph]

Phishing alert: fake Trust Wallet email asking you to “migrate” your seed phrase.

Red flags:

- Sender isn’t https://t.co/ScQjAv0nwM
- Fake deadline
- “Seed migration” isn’t a thing
- Brute-force scare tactic

Never enter your seed phrase from an email link.

[James Bro @james_web3sec]

@TheWarKettle 100%. A new password doesn't fix a leaked seed, only a new wallet does. And yes, if you didn't open the wallet yourself, don't trust the pop-up.

[James Bro @james_web3sec]

A new drainer kit claims it can fake the pop-ups of 20+ wallet extensions, plus fake airdrops. The claims are unverified, but the rule never changes:

No real wallet will ever ask for your seed phrase. Not in a popup, not on a website, not in DMs.

Already entered it somewhere? Move your funds to a brand-new wallet now. A leaked seed can be drained again every time you top it up.

[Dark Web Informer @DarkWebInformer]

🚨 RugWhales introduces new cryptocurrency wallet drainer targeting seed phrases

A new Drainer-as-a-Service (DaaS) operation called "RugWhales" is advertising a seed phrase drainer designed to empty cryptocurrency wallets across multiple blockchain networks.

The tool claims to search wallet derivation paths, transfer assets automatically, and imitate wallet extension prompts from MetaMask, Trust Wallet, Ledger, Phantom, and others.

It also offers fake airdrop prompts, customizable phishing interfaces, and support for Ethereum, Solana, Bitcoin, TRON, and other networks.

RugWhales is currently recruiting closed beta testers, with a standard 20% commission planned after launch. Its advertised capabilities remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. https://t.co/281Qjc6p2J

[James Bro @james_web3sec]

@vanisaxxm 👍👍👍👍👍👍👍

[James Bro @james_web3sec]

That's cool.
Grok Bot now integrates with your phone apps.

[Grok Bot @bot]

Grok Bot can now use Calendar, Reminders, Contacts, and more apps on your phone.

Rolling out now on iOS and Android.

[James Bro @james_web3sec]

@Real_Dennis_S_F @TrustWallet • The site scanner flagged the official PancakeSwap as high risk
Could you share a screenshot for this? I have not seen the risk when I test the official PancakeSwap..

[James Bro @james_web3sec]

@Real_Dennis_S_F @PancakeSwap Hi, Dennis, Could you send me the link?

[James Bro @james_web3sec]

@BigKenz_01 @felix_fan Thanks for your feedback!

[Felix @felix_fan]

Trust Wallet has no PHP in its tech stack.

Stay safe & no worry.

[James Bro @james_web3sec]

Summary Key Security Events (Oct 20–22, 2026)

1. PHP2Shell (Highest Priority)
CVE-2026-109618 / CVE-2026-109619 (CVSS 9.2)
Unauthenticated RCE. Fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (Oct 21).

2. Railway Security Incident (Oct 21)
Unauthorized access to systems storing customer environment variables; some decrypted contents may have been obtained (API keys, DB credentials, private registry credentials).
Railway recommends all users immediately rotate affected secrets and review logs. All deployments are currently paused.

3. Node.js Security Release (Oct 21)
22.23.4 / 24.22.1 / 26.12.1
Key: CVE-2026-111497 (Brotli decoder RCE) + multiple high-severity TLS/DNS issues.

4. Plex2Shell (Added to KEV)
Chain: CVE-2026-96652/96654/96655/96656 → unauthenticated RCE. Actively exploited. Update to ≥ 1.43.3.10861.

5. Go
1.27.3 / 1.26.10 (CVE-2026-111943 – x509 certificate blacklist).

[James Bro @james_web3sec]

That sounds promising. Using Grok bots might significantly improve the efficiency of processing customer complaint feedback. @xiaohangzhang7

[Grok Bot @bot]

We use Grok Bot to spot incidents in our support queue and quickly respond to every associated ticket.

In one incident, it cleared 204 tickets in about 10 minutes, with one engineer approving the batch.

[Dane Knecht 🦭 @dok2001]

The Cloudflare's writeup on our php2shell response is up.

Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.

New rules keep landing in the WAF changelog.

Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.

PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
https://t.co/qzAiN2wGVl

[James Bro @james_web3sec]

My first job was as a PHP developer.

If you're still running PHP, please update immediately — there are two critical RCE vulnerabilities (CVE-2026-109618 & CVE-2026-109619) that just got patched.

Don't wait.

[php-net @php_net]

PHP 8.5.12 released - 90 fixes in 29 components, including security fixes (CVE-2026-109618, CVE-2026-109619).

Changelog + downloads: https://t.co/q5agMkUfNe

[James Bro @james_web3sec]

@CoderKartikey dm me, let's talk. We are continuously building our security capabilities.

[James Bro @james_web3sec]

GM. if any security related issues, @ me .

[Felix @felix_fan]

Today we set a new policy: all leads at @TrustWallet must build X profiles. There are 21 affiliates so far, ranging from marketing, business development, product, engineering, HR, and more.

For our beloved users, you get to learn firsthand how we shape the product, deliver code, develop marketing strategies, and form meaningful partnerships. All of that is dynamic, diverse, and personal.

For some of our leads who aren’t used to facing the public, this is very uncomfortable to be frank, but I think we have to do it. We might make mistakes along the way, but we’ll learn from user feedback over time and ultimately deliver products that better reflect the latest trends and user needs. Go-to-market isn’t just a task; it’s an hourly dose every time we open the X app and talk to people who care about our product.

If you're considering Trust, you'll have your own voice and grow your personal influence here. After all, we want to make Trust Wallet a platform for you to shine and ultimately serve our users better during your time here.

This isn’t an experiment; it’s just getting started.

[James Bro @james_web3sec]

@Kanshiguardian sure.