NewsCryptoTrust Wallet User Says 3,830 USDT Drained Without Approval, Putting Permit Signatures Back in Focus

Trust Wallet User Says 3,830 USDT Drained Without Approval, Putting Permit Signatures Back in Focus

Author: Blockonomi·

Key Takeaways

  • •Iaroslav Dubovoi says 3,830 USDT was transferred out of his Trust Wallet on November 3 without any approval request or warning, and the cause has not been identified.
  • •He published a transaction hash linked to the missing funds, which serves as the main public evidence because self-custody transfers cannot be reversed once confirmed on-chain.
  • •Permit signatures can establish spending rights that carry over to later transfers, and blockchain security firm Salus identified malicious USDG permit signatures in an October investigation.
  • •A second user, Mister Tee, reported his wallet was drained on the same day after contact with someone impersonating support on NEAR Protocol's Discord server.
  • •In December 2025, Trust Wallet confirmed that a compromised Chrome extension version 2.68 enabled roughly $7 million in losses, with affected users to be compensated.
Trust Wallet User Says 3,830 USDT Drained Without Approval, Putting Permit Signatures Back in Focus

A Trust Wallet user says 3,830 USDT left his wallet without his approval, and the cause of the transfer has not been identified. His post on X, published on November 3, has drawn more than 166,000 views.

Iaroslav Dubovoi, who posts as @noirvox_studio, said he opened the app and found his funds gone. According to his account, he received no warning and no request to approve a transaction. He asked Trust Wallet for an explanation and urged other users to share his post.

What the User Says Happened

Dubovoi said blockchain records showed the funds had been moved, but he could not explain how. He later posted a transaction hash that he linked to the missing USDT, giving observers a starting point for tracing where the funds went.

He said he had used the same wallet for about five years and had always taken steps to protect his crypto holdings. The blockchain network, the receiving address, and the details of the transfer were not established in his posts.

Trust Wallet is a self-custody wallet. Users hold the private keys needed to approve transactions, unlike on centralized exchanges, where the platform manages customer assets. Because users control their own keys, transactions cannot be reversed by the company once they are confirmed on-chain. That structure leaves on-chain records, such as the transaction hash Dubovoi posted, as the main public evidence in a case like this.

How Funds Can Move Without a New Approval

The claim has drawn attention to how token permissions work in self-custody wallets. Unauthorized transfers can occur in several ways, including stolen private keys, harmful smart contract permissions, and misleading transaction signatures. Some of these methods do not require a fresh approval at the moment funds leave a wallet.

Permit signatures let token holders authorize spending through an off-chain signature rather than a separate on-chain approval transaction. In an October investigation, blockchain security firm Salus identified malicious USDG permit signatures that gave attackers spending rights over victims' tokens. In those cases, attackers used permissions they had already obtained, then moved tokens without the victim approving each transfer. That persistence is the property that keeps permit signatures in focus: a single off-chain signature can establish spending rights that carry over to later transfers.

Trust Wallet recently warned users about a fake website copying its crypto card service. The site was designed to trick users into connecting their wallets and possibly signing harmful transactions, which can allow others to move certain tokens without the recovery phrase.

In December 2025, Trust Wallet confirmed that version 2.68 of its Chrome extension let attackers drain funds without transaction approvals. Blockchain investigator ZachXBT first flagged the suspicious transfers after users reported withdrawals. Attackers had gained access to the extension's source code and pushed a malicious version through the Chrome Web Store. Losses reached about $7 million, and former Binance CEO Changpeng Zhao confirmed that affected users would be compensated.

Second User Reports a Drain After Fake NEAR Discord Support

Also on November 3, an X user called Mister Tee, who posts as @meeyatariq, said his wallet was drained after contact with someone posing as support on NEAR Protocol's Discord server. His screenshots showed outgoing transfers of ETH, BTC, BNB, and NEAR, including 3 NEAR worth about $11.49.

"Same fucking shit happened to me as well, swapped tokens to USDC but I didn't get any. What a crap????" — ABDUL (@HasbullahAbdulH) November 3, 2026

Unlike Mister Tee, Dubovoi did not link his loss to any outside contact. He has said he approved nothing before the funds disappeared. How the transfer was authorized, and whether Trust Wallet responds to his request for an explanation, has not been established.

Trust Wallet has advised users not to share recovery phrases or private keys, and to rely on official support channels when looking into suspicious activity.

A separate user, Abdul, who posts as @HasbullahAbdulH, complained on X about problems swapping tokens. The verified Trust Wallet Support account replied on November 4, pointing him to a guide covering failed swaps, stuck transactions, and receiving unexpected amounts. That reply concerned swap issues rather than the drain claim.

This article is based on Blockonomi's report.