Version

Treat

Relevant

Trust Wallet&nbsp;<a style="text-decoration:none" href="https://x.com/TrustWallet/status/2004316503701958786?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E2004316503701958786%7Ctwgr%5Ec4312b1926e3709843fd7d2fe89c34e74083a777%7Ctwcon%5Es1_c10&amp;ref_url=https%3A%2F%2Fwww.cryptopolitan.com%2Ftrust-wallet-incident-drains-6m-from-wallets%2F" rel="noopener noreferrer nofollow">confirmed</a> that a malicious update to its official Chrome browser extension led to the theft of about $7 million in user funds. The breach affected only one version of the extension, version 2.68, and involved attackers stealing wallet seed phrases through embedded malicious code. Per reports, mobile users and other browser versions were not impacted.
<h2 id="span-span-strong-what-happened-in-the-trust-wallet-extension-hack-strong-span-span">What Happened in the Trust Wallet Extension Hack?</h2>
The incident began on December 24, 2025, when Trust Wallet released version 2.68.0 of its Chrome extension. At first, users reported scattered losses. Wallets were drained shortly after being accessed or imported through the extension. What looked like isolated cases quickly pointed to a wider problem.
On Christmas Day, on-chain investigator ZachXBT&nbsp;<a style="text-decoration:none" href="https://t.me/investigations/297" rel="noopener noreferrer nofollow">issued</a> a public warning while stolen funds were still moving on-chain. He linked the wallet drains directly to the v2.68 update. His analysis helped establish that this was not user error or phishing, but a compromised browser extension.
By December 26, Trust Wallet confirmed the breach. The company stated that only version 2.68 was affected and urged users to immediately upgrade to version 2.69. The Chrome extension has about one million users, according to the Chrome Web Store listing.
Trust Wallet later confirmed that approximately $7 million in digital assets were stolen across multiple blockchains.
<h3 id="span-span-strong-which-users-were-affected-strong-span-span">Which users were affected?</h3>
Only users who installed or logged into Trust Wallet’s Chrome extension version 2.68 before December 26 at 11:00 AM UTC were at risk.
According to Trust Wallet and security researchers:
<ul>
 <li>Mobile app users were not affected</li>
 <li>Other browser extension versions were not affected</li>
 <li>Wallets accessed through version 2.68 could be fully compromised</li>
</ul>
In many cases, wallets were emptied within minutes of unlocking the extension or importing a seed phrase. Hundreds of wallets were affected, including Bitcoin, Ethereum, and Solana addresses.
Trust Wallet CEO Eowyn Chen confirmed that users who logged in during the affected window should assume their wallets were exposed and generate new ones.
<h2 id="span-span-strong-how-did-the-malicious-code-work-strong-span-span">How Did the Malicious Code Work?</h2>
According to blockchain security firm&nbsp;<a style="text-decoration:none" href="https://x.com/SlowMist_Team/status/2004505097049628846?s=20" rel="noopener noreferrer nofollow">SlowMist</a>, the attack was not caused by a malicious third-party library. Instead. The attacker directly modified Trust Wallet’s own extension code. The malicious logic was embedded in the analytics component of the extension.
Here is how it worked:
<ul>
 <li>The code iterated through all wallets stored in the extension</li>
 <li>It triggered a mnemonic phrase request for each wallet</li>
 <li>When users unlocked the wallet, the encrypted seed phrase was decrypted</li>
 <li>The decrypted mnemonic was sent to an attacker-controlled server</li>
</ul>
The data was exfiltrated to api.metrics-trustwallet[.]com. The domain was registered on December 8, 2025. Requests to the server began on December 21, days before the malicious update was published.
The attacker used a legitimate open-source analytics library called posthog-js as a cover. Instead of sending data to the correct analytics endpoint, traffic was redirected to the attacker’s server.
SlowMist stated that this was an internal codebase compromise, not a poisoned dependency.
<h3 id="span-span-strong-how-did-the-compromised-extension-get-published-strong-span-span">How Did the Compromised Extension Get Published?</h3>
Trust Wallet’s internal investigation found a critical failure in its release process. According to CEO Eowyn Chen, a leaked Chrome Web Store API key was used to publish the malicious version.
The compromised extension was uploaded on December 24 at 12:32 PM UTC. This bypassed Trust Wallet’s normal internal checks.
It shows that the attacker did not exploit users directly. Instead, they exploited distribution infrastructure. Supply-chain attacks like this are harder to detect because the software appears official and trusted.
<h2 id="span-span-strong-how-much-was-stolen-and-where-did-the-funds-go-strong-span-span">How Much Was Stolen and Where did the Funds Go?</h2>
Trust Wallet and independent researchers estimate total losses at around $7 million.
Breakdown of known stolen assets includes:
<ul>
 <li>About $3 million in <a href="https://bsc.news/post/what-is-bitcoin-how-it-works-mining-digital-gold-guide" rel="noopener noreferrer nofollow">Bitcoin</a></li>
 <li>More than $3 million in <a href="https://bsc.news/post/what-is-ethereum-eth-how-it-works-explained" rel="noopener noreferrer nofollow">Ethereum</a></li>
 <li>Smaller amounts in <a href="https://bsc.news/post/solana-blockchain-ecosystem-deep-dive" rel="noopener noreferrer nofollow">Solana</a> and other assets</li>
</ul>
According to&nbsp;<a style="text-decoration:none" href="https://x.com/PeckShieldAlert/status/2004382831158714735" rel="noopener noreferrer nofollow">PeckShield</a> and ZachXBT, the stolen funds were quickly laundered.
Key movements include:
<ul>
 <li>Around $3.3 million sent to ChangeNOW</li>
 <li>About $340,000 sent to FixedFloat</li>
 <li>Roughly $447,000 sent to KuCoin</li>
</ul>
More than $4 million passed through centralized exchanges. As of the last update, about $2.8 million remained in wallets controlled by the attacker.
This pattern mirrors other wallet compromise cases, where attackers use instant swap services and bridges to reduce traceability.
<h2 id="span-span-strong-trust-wallet-s-response-and-compensation-plan-strong-span-span">Trust Wallet’s Response and Compensation Plan</h2>
Trust Wallet pushed a quick fix. Version 2.69 was released on December 25 to remove the malicious code. Users were urged to disable version 2.68 immediately.
The company also launched a formal compensation program.
Affected users can submit claims through an&nbsp;<a style="text-decoration:none" href="https://trustwallet-support.freshdesk.com/support/tickets/new" rel="noopener noreferrer nofollow">official support form on Trust Wallet’s website</a>. The process requires:
<ul>
 <li>Email address</li>
 <li>Country of residence</li>
 <li>Compromised wallet addresses</li>
 <li>Attacker receiving addresses</li>
 <li>Relevant transaction hashes</li>
</ul>
Trust Wallet stated that every claim will be individually verified.
<blockquote>
 "We are working around the clock to finalize the compensation process details and each case requires careful verification to ensure accuracy and security," the company said.
</blockquote>
Changpeng Zhao, co-founder and former CEO of Binance, which acquired Trust Wallet in 2018, confirmed that losses will be covered.
<h2 id="span-span-strong-why-this-hack-matters-for-wallet-security-strong-span-span">Why This Hack Matters for Wallet Security</h2>
This incident highlights a recurring risk in crypto. Even non-custodial wallets depend on software distribution channels. When those channels fail, users can lose everything.
The Trust Wallet hack follows a broader pattern seen across the industry. Earlier this year, Coinbase disclosed that it would reimburse more than $400 million after a separate breach linked to bribed support staff in India.
Different attack methods, same outcome. Trust assumptions break at the edges.
For users, this reinforces basic security rules:
<ul>
 <li>Treat browser extensions as high-risk software</li>
 <li>Update immediately when fixes are released</li>
 <li>Move funds if a wallet may be compromised</li>
 <li>Never reuse exposed seed phrases</li>
</ul>
For wallet providers, the lesson is about release security. API keys, build pipelines, and store credentials are now prime attack targets.
<h2 id="span-span-strong-conclusion-strong-span-span">Conclusion</h2>
The $7 million Trust Wallet extension hack was the result of a supply-chain compromise, not user error. Malicious code embedded in version 2.68 of the Chrome extension harvested seed phrases and drained wallets across multiple blockchains.&nbsp;
rust Wallet responded by removing the affected version, releasing a fix, and committing to full reimbursement. The incident underscores how browser extensions remain a critical attack surface in crypto and why both users and developers must treat distribution security as seriously as private key management.
<h2 id="span-span-resources-span-span">Resources</h2>
<ol>
 <li><a style="text-decoration:none" href="https://x.com/TrustWallet/status/2004316503701958786" rel="noopener noreferrer nofollow">Trust Wallet on X</a>: Announcement on Dec. 26</li>
 <li><a style="text-decoration:none" href="https://x.com/SlowMist_Team/status/2004505097049628846?s=20" rel="noopener noreferrer nofollow">Slowmist post on X</a>: Report on Trust Wallet exploit</li>
 <li><a style="text-decoration:none" href="https://x.com/PeckShieldAlert/status/2004382831158714735" rel="noopener noreferrer nofollow">PeckShield post on X</a>: On Trust Wallet exploit</li>
</ol>

The $7M Trust Wallet Extension Hack: All You Need to Know

Table of Contents

BSCN

Other articles published on Jan 8, 2026

Join our free newsletter for daily crypto updates!