Breaking News: Trust Wallet Users Targeted
As the crypto community wakes up on this Boxing Day, a chilling alert has emerged from Cointelegraph and on-chain investigator ZachXBT. Multiple Trust Wallet users have reported significant fund drains from their wallet addresses, with losses exceeding $6 million in Bitcoin (BTC), Ethereum (ETH), and Solana (SOL). The culprit? A suspected supply-chain attack embedded in the Trust Wallet Chrome extension, version 2.68, updated on December 24, 2025. This incident has left hundreds of users, including trader yuna who lost $300,000 in just four minutes, reeling from the breach despite diligent security practices.
Urgent Action Required: If you use the Trust Wallet Chrome extension, disable version 2.68 immediately and upgrade to version 2.69 via the official Chrome Web Store. Mobile users are unaffected.
What Happened?
The trouble began with the release of Trust Wallet’s Chrome extension update to version 2.68 on December 24, 2025. Shortly after, users noticed unauthorized transactions draining their wallets. On-chain analysis by ZachXBT revealed a pattern of theft addresses receiving funds, with the total loss climbing to over $6 million by December 25. Trust Wallet quickly acknowledged the issue, confirming a security incident specific to the browser extension and urging users to upgrade to version 2.69 while their team collaborates with Binance to investigate.
Community reports, including a heart-wrenching thread from user @yunaintern, highlight the scale of the breach. Despite using hardware wallets for long-term holdings and auditing permissions, victims found their trading accounts compromised within minutes. The attack’s timing—striking on Christmas Day—amplified the distress, with over 500 victims identified in the past 24 hours.
Understanding the Supply-Chain Attack
A supply-chain attack occurs when malicious actors infiltrate a trusted software supply chain to distribute compromised updates or code. In this case, the Trust Wallet Chrome extension’s update process appears to have been compromised, likely through a tampered file (e.g., 4482.js) injected with malicious code. Here’s how it likely unfolded:
- Injection Point: Attackers may have targeted a package maintainer or the update pipeline, inserting code designed to steal wallet data or seed phrases.
- Execution: The malicious code, disguised as legitimate functionality (e.g., analytics), activated upon seed phrase import or transaction initiation, intercepting sensitive data.
- Data Exfiltration: Stolen information was sent to a newly registered domain (metrics-trustwallet[.]com), which has since gone offline, suggesting a coordinated effort.
- Fund Drainage: The malware rewrote transaction targets, redirecting funds to attacker-controlled addresses without user approval.
This type of attack is particularly insidious because it leverages trust in official updates, bypassing traditional security measures. The September 2025 npm supply-chain attack, which affected billions of downloads, serves as a precedent, where similar techniques targeted cryptocurrency wallets via compromised libraries.
Immediate Steps for Users
Trust Wallet has outlined critical actions to mitigate further damage:
- Disable the Trust Wallet Chrome extension (version 2.68) immediately.
- Upgrade to version 2.69 via the official Chrome Web Store link: https://t.co/wsCyuxdLD9.
- Revoke all permissions associated with the extension.
- Move remaining funds to a secure wallet, preferably a hardware wallet, on a clean device.
- Monitor for suspicious activity and report theft addresses to ZachXBT or Trust Wallet support.
Binance CEO CZ has hinted that Trust Wallet may cover the losses, with $7 million currently affected, though no official reimbursement plan has been confirmed.
Lessons Learned and Future Precautions
This incident underscores the vulnerability of hot wallets, especially browser extensions, to supply-chain attacks. Even self-custodial solutions rely on secure update mechanisms and user environments. Key takeaways include:
- Prioritize Hardware Wallets: Offline storage like Ledger devices offers superior protection for significant holdings.
- Verify Updates: Always download extensions from official sources and scrutinize release notes.
- Monitor Permissions: Regularly audit and revoke unnecessary access to wallet extensions.
- Stay Informed: Follow trusted sources like Cointelegraph and ZachXBT for real-time alerts.
As the crypto space matures, such breaches highlight the need for robust security practices. For now, users must remain vigilant, treating every wallet interaction as a potential risk.
Conclusion
The Trust Wallet Chrome extension attack is a stark reminder of the evolving threats in the cryptocurrency ecosystem. With over $6 million stolen and counting, the community awaits Trust Wallet’s full investigation and potential compensation. As we navigate this crisis, let’s use it as a catalyst to strengthen our security habits. Stay safe, and keep your funds SAFU!
Follow updates on X via @Cointelegraph and @zachxbt. Have you been affected? Share your story in the comments below.
Written by EnatDigital
Comments
Post a Comment