A troubling warning has appeared on the r/CryptoScams forum from user username1241654. According to them, their mobile Trust Wallet on iOS was completely drained twice, without any involvement on their part. The first time, on September 13, 2026, scammers withdrew about 2,941 USDC on the Polygon network and 2,384 USDT on the Tron network in just 67 seconds. Two days later, on September 15, they came back for the leftovers, sweeping up small amounts on Ethereum, Polygon and Tron.

The author of the post emphasizes that they did not sign any transactions, did not grant any permissions to smart contracts, and was actually asleep at the time of the first hack. According to username1241654, an examination of the blockchain showed that all transfers were executed via regular transfer() calls, signed with their private keys. The main red flag lies in the technical parameters: for the Tron network thefts, the expiration time was about 60 seconds (instead of the usual 10 hours for Trust Wallet) and the fee limit was exactly 100 TRX. On Polygon, standardized gas limits were used. This clearly points to an automated script that uses the stolen keys directly, bypassing the app itself.

The author urges all Trust Wallet users to check their outgoing transactions against the sweeper addresses, where the money from other victims is currently flowing. On Tron, this is THN8p9hfhwXZyX4qEHAZixrbTvqvkbxKJS, and on EVM networks — 0x348f11ba8632c38b8dea20d1793b12b81f9ccf4d. According to username1241654, these same addresses have already collected funds from other wallets created in July 2026. The author provided specific transaction hashes for verification:

Polygon
0x029ca732c214d066c064e53ec12467f4c16a96905959cefa3d9c332d5d8a8d54

Tron
6e401615b191f5e71361aa30e7f9061febe2c05eca3372b7d14c34243d5dc4c5
d4e11946d7d425bb1592b0e2b2fa266d892a65400733faea9f93f0bf83affb6d

Ethereum
0x78676d719a145b7d973f89a9f1e5d0e57d7b2fba4805bfffb5ec2b0fcaf1ae24

The exact path of the key leak remains a mystery for now, but the user strongly advises against storing seed phrases in photos, notes, or cloud storage. If you find your funds at the sweeper addresses listed, the author asks you to report it in the comments — the more victims are found, the greater the chances of pressuring Trust Wallet, Tether, and Circle to block these addresses.