<div class="flex flex-col text-sm pb-25">
 <div class="text-base my-auto mx-auto pb-10 [--thread-content-margin:--spacing(4)] @w-sm/main:[--thread-content-margin:--spacing(6)] @w-lg/main:[--thread-content-margin:--spacing(16)] px-(--thread-content-margin)">
  <div class="[--thread-content-max-width:40rem] @w-lg/main:[--thread-content-max-width:48rem] mx-auto max-w-(--thread-content-max-width) flex-1 group/turn-messages focus-visible:outline-hidden relative flex w-full min-w-0 flex-col agent-turn">
   <div class="flex max-w-full flex-col grow">
    <div class="min-h-8 text-message relative flex w-full flex-col items-end gap-2 text-start break-words whitespace-normal [.text-message+&amp;]:mt-1">
     <div class="flex w-full flex-col gap-1 empty:hidden first:pt-[1px]">
      <div class="markdown prose dark:prose-invert w-full break-words light markdown-new-styling">
       <p><span style="font-weight: 400;">This article was first published on<a href="https://www.turkishnyradio.com/" rel="noopener noreferrer nofollow"> TurkishNY Radio.</a></span></p>
       <p>A new alert is circulating after Trust Wallet said 36,000 browser wallets remain currently compromised following a malicious extension update that appeared during the December holiday period. The company said impacted users were notified through a security banner and app alerts, while users without a notification are not considered affected.</p>
       <h3 id="what-happened-and-why-the-window-matters">What happened, and why the window matters</h3>
       <p>In an incident update, an <a href="https://www.turkishnyradio.com/trust-wallet-hack-2025-how-a-compromised-chrome-extension-led-to-millions-lost/" rel="noopener noreferrer nofollow">unauthorized version</a> of its browser extension, v2.68, was published to the Chrome Web Store outside the normal release process on December 24, 2025. The company said the malicious code could access sensitive wallet data and enable unauthorized transactions when users opened the extension and logged in during the window of December 24–26.</p>
       <p>That window sounds short, but exposure can outlive the bug. If sensitive information was captured while the malicious build was active, attackers may retain what they need to try again, which is why Trust Wallet has framed the response as migration, not just updating software.</p>
       <h3 id="what-the-company-is-telling-impacted-users-to-do">What the company is telling impacted users to do</h3>
       <p>The support guidance tells users on v2.68 to avoid opening the extension until it is updated to v2.69, verify the version, create a new wallet, and move assets away from the old one. The company also told users to ignore impersonators and to use official support channels for claims.</p>
       <p><img loading="lazy" src="https://www.turkishnyradio.com/wp-content/uploads/2026/01/Trust-Wallet-Warns-36000-Users-After-Malicious-Extension.jpg" alt="Trust Wallet Warns 36,000 Users After Malicious Extension Update" width="1920" height="1080" title="Trust Wallet Warns 36,000 Users After Malicious Extension Update 26"></p>
       <h3 id="how-it-may-have-bypassed-normal-checks">How it may have bypassed normal checks</h3>
       <p>The company said early findings point to an external publishing method that used a leaked API key and bypassed mandatory review steps. It also said it has high confidence the incident is tied to a wider supply-chain campaign known as Sha1-Hulud, and Trust Wallet said teams mobilized immediately to contain losses and continue the investigation.</p>
       <h3 id="loss-estimates-reimbursement-and-a-quick-market-read">Loss estimates, reimbursement, and a quick market read</h3>
       <p>The latest disclosure tied the incident to 2,520 drained wallet addresses and about $8.5 million linked to 17 attacker-controlled addresses. trust wallet said it will reimburse verified victims and is building an ownership verification workflow after receiving thousands of claims, including duplicates and suspected false submissions.</p>
       <p>At the time of writing, Trust Wallet Token (TWT) traded around $0.914, and traders often track whether stolen funds consolidate on-chain and begin moving toward exchange deposit addresses.</p>
       <h3 id="conclusion">Conclusion</h3>
       <p>For<a href="https://www.turkishnyradio.com/iota-trust-framework-launches-for-secure-open-networks/" rel="noopener noreferrer nofollow"> Trust wallet</a>, the message is repetitive for a reason: notified wallets should be treated as compromised, funds should be migrated to fresh credentials, and claims should be verified so scammers do not profit twice. For the wider ecosystem, the episode is a reminder that browser wallets inherit software supply-chain risk, where attackers can exploit update paths, especially when markets are moving fast.</p>
       <h2 id="frequently-asked-questions">Frequently Asked Questions</h2>
       <p><strong>How can someone tell whether a wallet is affected?</strong><br> The company has said impacted users were directly notified through a security banner and app alerts, while users without a notification are not considered affected.</p>
       <p><strong>Does trust wallet affect mobile-only users in this incident?</strong><br> The company has said the incident impacted only browser extension version 2.68, and mobile-only users and users on other extension versions are not affected.</p>
       <p><strong>What should a notified user do first?</strong><br> The guidance is to update to v2.69 or later before using the extension, then move funds to a newly created wallet and stop using the old one.</p>
       <p><strong>Glossary of key terms</strong></p>
       <p><strong>Recovery phrase:</strong> A set of words that restores a wallet and grants control of funds.</p>
       <p><strong>Supply-chain attack:</strong> An intrusion that delivers malicious code through trusted distribution or dependencies.</p>
       <p><strong>Wallet drainer:</strong> Malware that steals funds by triggering unauthorized transfers to attacker-controlled addresses.</p>
       <p><strong>References</strong></p>
       <p><span><span><a href="https://support.trustwallet.com/support/solutions/articles/67000750069-security-notice-trust-wallet-browser-extension-version-2-68-vulnerability" target="_blank" rel="noopener noreferrer nofollow"><span><span><span>Trust Wallet Support</span></span></span></a></span></span></p>
       <p><span><span><a href="https://www.cryptotimes.io/2026/01/04/trust-wallet-warns-36k-users-over-compromised-browser-wallets/" target="_blank" rel="noopener noreferrer nofollow"><span><span><span>The Crypto Times</span></span></span></a></span></span></p>
      </div>
     </div>
    </div>
   </div>
   <div class="z-0 flex min-h-[46px] justify-start"></div>
   <div class="mt-3 w-full empty:hidden">
    <div class="text-center"></div>
   </div>
  </div>
 </div>
</div>

Trust Wallet Warns 36,000 Users After Malicious Extension Update

Table of Contents

TNYR

Other articles published on Jan 5, 2026

Join our free newsletter for daily crypto updates!