Trust Wallet vs SafePal: Open Key Library or a Passphrase
Published October 23, 2026· By Juan Martinez
Two free multichain phone wallets. Trust Wallet has an open key library, audits and past key flaws; SafePal adds a passphrase but publishes no current code.
Trust Wallet vs SafePal is a choice between two free phone wallets that hold coins on Bitcoin, Ethereum, Solana, Tron and many other networks in one app, with a browser extension and with buying and swapping built in through outside companies. Both describe themselves as self-custody wallets: the keys stay on your device, and the company cannot move your coins. Binance figures in both: it bought Trust Wallet in 2018, and SafePal names it among its backers.
Where they differ is how much you can check and what you can do with the keys. Trust Wallet publishes the library that creates its keys, has audits of its browser extension and is covered by a bug bounty, and it has the longer incident record: two flaws in key generation and a fake extension update that drained wallets. SafePal publishes no current code or audit and runs no bug bounty, but it offers a passphrase and a basic form of coin control for Bitcoin, and it states its swap fee. Its privacy policy also lists more data it may collect.
Trust Wallet is rated 5.6 and SafePal 5.5, close enough that the overall number decides nothing. Trust Wallet is ahead in Security & Transparency (4.0 against 2.5) and in Network & Metadata Privacy (4.0 against 3.5). SafePal is ahead in Key Custody & Recovery (7.0 against 6.0) and in Price & Value (8.5 against 8.0). Both score 8.0 in Usability & Chain Support.
| Trust Wallet | SafePal | |
|---|---|---|
| Rating | 5.6 | 5.5 |
| Published Code | Key library open (Apache 2.0); app, extension and servers closed | 2023 core snapshot only; released app and extension closed |
| Security Audit | Company-paid audit (Cure53, 2023) | None found |
| Bug Bounty | ✅ | ❌ |
| Known Security Incidents | Guessable keys in wallets made by the 2018 iPhone app and the 2022 browser extension; a fake extension update in December 2025 drained 2,520 addresses | 2026: order details of about 39,798 store customers read by outsiders; no keys or seed phrases involved |
| What the Company Says It Collects | Your addresses, transaction amounts and times, and device details; the IP address is used briefly and not kept, Trust Wallet says | May collect your addresses, the addresses you pay, transaction history, IP address and device details |
| Passphrase | ❌ | ✅ |
| Coin Control | None | Limited |
| Identity Checks Inside the App | Card and bank purchases through outside companies, which usually check your identity | Purchases through outside companies such as MoonPay; swaps on the Binance channel (the MEXC channel needs none); the Fiat24 IBAN account |
| Wallet's Own Swap Fee | Unclear: one page says none, another mentions a standard fee; no rate published | 0.2% of every swap and bridge order |
Want to compare every field side by side? Open the full comparison table.
Code and audits
Trust Wallet’s key library, Wallet Core, is open source under the Apache 2.0 licence, and it is the part that creates keys and signs transactions. The phone app, the browser extension and the servers are closed; Trust Wallet’s public phone-app repositories have been archived since 2019. You can read how the library makes keys, but you cannot check that the app from the store uses it the same way.
SafePal’s released app and extension are closed. Its only public app code is a GPL repository called “SafePal App (Core Version)”, last changed in September 2023, while the app in the stores is at version 4.11; the extension has no public code. Neither wallet offers reproducible builds.
Trust Wallet has published several security audits, and the reports on the browser extension say Trust Wallet’s company ordered them. Cure53 audited the extension’s code in April 2023, after the 2022 key-generation flaw described below, and found one high-severity and four low-severity issues, all fixed. An earlier test of the extension by CertiK left wallet creation and key derivation out of scope. No audit of the phone app has been published. Security reports on Trust Wallet go through Binance’s bug bounty, which may pay up to $100,000 for the most severe issues.
SafePal has published no independent audit of the app or the extension and runs no bug bounty, which is why it trails in Security & Transparency.
Incidents
Trust Wallet’s incident history has three entries, and two of them hit the keys themselves. Researchers showed in January 2024 that wallets made by the iPhone app in 2018 used a weak random number source, so their keys could be guessed; such wallets were among those drained on 12 July 2023, in thefts the researchers put at more than $1 million in total across several kinds of weak wallets. The browser extension, released in November 2022, created seed phrases with too little randomness; the researchers who found it counted around $30 million sitting in vulnerable wallets at one point. Within days of the report Trust Wallet updated the extension so it stopped creating weak phrases; wallets already created stayed at risk until their owners moved the funds.
The third came in December 2025: an attacker published a malicious version 2.68 of the extension to the Chrome Web Store with a leaked publishing key. Trust Wallet says the key was likely exposed in Sha1-Hulud, a supply-chain attack on npm packages a month earlier, and its investigation is still open. It counted 2,520 drained addresses and linked about $8.5 million to 17 addresses controlled by the attacker, which also drained wallets that had nothing to do with Trust Wallet. The phone app was not affected. Trust Wallet decided to reimburse affected users, and in July 2026 it was still reviewing the claims.
SafePal’s one disclosed incident did not touch wallets. In August 2026 it said a flaw in its online store had let outsiders read the orders of about 39,798 customers who bought between March 2025 and April 2026: names, email addresses, shipping addresses, phone numbers and what they bought. The leak covered store orders, so people who only installed the free app were not in it. SafePal says people claiming to hold the data have offered it for sale, and that it cannot verify the claims.
The shorter record is not evidence that SafePal’s key generation is sounder. Trust Wallet’s two key flaws were found by outside researchers; SafePal’s app has had no published outside review of that kind.
What each company’s servers see
Both apps get balances and history from their company’s own servers, so both companies see which addresses belong to one wallet. Neither offers Tor, and neither lets you point Bitcoin or the built-in networks at your own full node; both let you add an Ethereum-style network with your own server address, Trust Wallet so far only on Android.
The documents differ in how much they claim. Trust Wallet’s privacy notice says it processes your addresses, transaction amounts and times, and device details such as the device model, operating system, app installation and language, and that it uses your IP address only briefly, to route traffic and apply country rules, without keeping it. SafePal’s privacy policy says it may collect your addresses, the addresses you pay, your transaction history and fees, your IP address, device details, internet provider and clicks in the app, and may move that data to Singapore, Hong Kong, mainland China and the United States; its terms say it may keep your IP address. The main difference is the IP address: SafePal says it may keep it, Trust Wallet says it does not. With addresses and IP address in one place, SafePal can tie your holdings to your connection. Both are the companies’ own statements, and neither can be checked from outside.
Both Android apps also carry analytics, a form of telemetry, with no documented way to turn it off. Trust Wallet’s Google Play listing names app interactions and crash logs. SafePal’s Android app contains Google’s analytics and crash-reporting code, while its App Store label says the app collects no data, which its own privacy policy contradicts.
On Bitcoin, SafePal lets you pick which coins a payment spends, a basic form of coin control without labels, so you can avoid mixing coins from different sources in one payment. Trust Wallet’s guides describe no coin control.
The seed phrase and the backup
Both create a standard BIP39 seed phrase that other wallets can restore, both show it on the phone or computer running the app, and both can save an encrypted copy to your own cloud account (SafePal names iCloud and Google Drive). Neither has multisig, and with either app a lost phrase means lost coins.
SafePal scores a point higher in Key Custody & Recovery. It lets you add a passphrase of up to 60 characters that opens a separate hidden wallet; Trust Wallet’s guides describe none. It offers 12 or 24 words when you create a wallet, where Trust Wallet creates 12 and imports 24. Trust Wallet also does not ask you to write the phrase down while you set up a wallet, and when it dropped 24 networks in September 2026 it warned that on four of them it had created your address differently from your Ethereum address, so adding the network back by hand shows a zero balance; Trust Wallet says the funds have not moved. Other wallets may not find those addresses either.
Buying, swapping and identity checks
Neither wallet needs an account or an identity check; you can fund either by receiving coins from elsewhere. Identity checks, known as KYC, come in through the outside companies built into the apps.
In Trust Wallet, card and bank purchases go through companies such as MoonPay, Banxa, Ramp, Transak and Mercuryo, which usually check your identity. Swaps go through outside providers such as ZeroEx, Rango, deBridge and Jupiter, which receive your coins and send the new ones to your address.
In SafePal, buying and selling go through MoonPay, Simplex and Binance Connect, and selling through MoonPay asks for your legal name, home address and an ID document. On the swap screen you pick a provider; SafePal’s help centre says the Binance channel requires an identity check and the MEXC channel does not. The app also offers an IBAN account and a Mastercard from Fiat24, a financial institution regulated in Switzerland in which SafePal has invested, and opening the account requires Fiat24’s identity check. SafePal’s terms say these providers may pay it a commission.
Fees
Both apps are free. SafePal adds 0.2% to every swap and bridge order, on top of the network fee and the provider’s fee, and says so in its help centre. Trust Wallet’s pages disagree with each other: its swap page says it adds no fee, while an August 2026 offer waives “the Trust Wallet swap fee” on some stablecoin pairs and says the standard fee applies to other swaps, without giving the rate. SafePal’s half-point lead in Price & Value reflects that its fee is published. With Trust Wallet, compare the amount you will receive in the quote.
Browser extensions
Trust Wallet’s extension runs in Chrome and Brave on Windows, Mac and Linux and can connect to one brand of hardware wallet over USB for Bitcoin, Ethereum and Solana. Two of Trust Wallet’s three incidents were in the extension, not the phone app.
SafePal’s extension runs in Chrome and Edge. It can work on its own with its own phrase, or connect to the phone app or a SafePal hardware wallet by QR code or Bluetooth. It lacks Cardano and Base, which the phone app has. Neither has a desktop app.
Who runs each wallet
Trust Wallet was founded in 2017 and bought by Binance in July 2018; that purchase is the last documented change of ownership, and Trust Wallet does not publish who owns it today. Its privacy notice names a company in Bahrain, and its terms fall under Hong Kong law and cap its liability to you at $100.
SafePal’s terms and privacy policy name SkyGenesis Holdings Limited without saying where it is registered. Google Play lists the developer at an address in Hong Kong. SafePal names Binance, Animoca Brands and Superscrypt as its backers.
What we didn’t compare, and why
Number of coins. Both cover Bitcoin, Ethereum and the main Ethereum-style networks, Solana, Tron, XRP, Cardano, Litecoin, Dogecoin, Zcash and many smaller networks. Counting tokens says little about how either handles the networks you use; check yours in the Trust Wallet and SafePal reviews.
Hardware wallets. SafePal also sells hardware wallets. They are outside this comparison, which covers the free app and extension only.
Which one to pick
Read the full Trust Wallet review if you want more of the wallet open to outside checks: a published key library, audited extension code and a bug bounty, and a privacy notice that claims less data, mainly because Trust Wallet says it does not keep your IP address, while SafePal says it may. You accept two past flaws in key generation, a hijacked extension release in 2025, closed app code, no passphrase and a swap fee Trust Wallet does not state clearly. Write the seed phrase down at setup, since the app does not ask.
Read the full SafePal review if you want a passphrase, a choice of 12 or 24 words, coin selection on Bitcoin, a swap fee stated up front (0.2%) or the built-in IBAN account. You accept an app and extension whose code is not public and has no published audit, no bug bounty, a company that does not say where it is registered, and a privacy policy that allows it to collect your addresses alongside your IP address.
With either, the company’s servers see your addresses, and anything you buy inside the app goes through companies that usually check your identity.