Alarming incident in Trust Wallet: purchased Bitcoin disappeared to an unknown address
A discussion is heating up on Reddit about an incident that should alert all users of non-custodial wallets. A user under the nickname Smart-Rip5467 reported that after buying Bitcoin through the MoonPay service within the Trust Wallet app, their coins ended up at an address they do not control.
According to them, they did not manually enter the recipient address. However, 0.00387670 BTC, purchased on June 19, arrived at an address unknown to them. By June 21, the entire amount had been moved to another wallet. A blockchain explorer marked this transaction as a "possible self-transfer," but this is only a hypothesis, not a fact.
The Core Issue: Error or Attack?
The main question is who actually owns these addresses. The community is divided: some believe it is an internal transfer of funds between the user's own wallets, while others suspect a hack or a malfunction in MoonPay's operation. The situation is complicated by the fact that the "self-transfer" label in the blockchain explorer is merely an algorithmic assumption, which could coincide with both a legitimate transfer and the activity of a compromised wallet.
What Experts Advise
The most detailed response was given by user Critical-Ad6184. They emphasized that a single blockchain chain cannot prove ownership of the second address. They recommended several practical steps:
1. Check whether this address and transaction appear in the Trust Wallet history itself.
2. Restore the wallet from the seed phrase in a secure environment — if the total balance does not appear, it should be considered "beyond your control."
3. Contact MoonPay and Trust Wallet support strictly using the order number and transaction IDs.
The key security rule the expert reminded: under no circumstances should you enter your seed phrase, private key, or extended public key into blockchain explorers, support chats, or personal messages.
Other participants were skeptical about the situation: one suggested that a response from support would take a long time, while another succinctly advised using a more reliable wallet.
My comment as an analyst: This case is a classic example of how even established services can fail. Users should remember: when purchasing cryptocurrency through third-party services (on-ramp), always double-check the recipient address in the wallet history before completing the transaction. If the funds do not appear after restoring from the seed phrase, they are most likely lost. And never trust blockchain explorers as the sole source of truth — they only show the chain, not the owner.