🚂Who Got the Hooch, Baby?🥃
Trust Wallet users experienced a significant security incident on December 24, 2025, when attackers compromised version 2.68 of the Chrome browser extension. Approximately $7 million in digital assets were stolen from hundreds of wallets. This was a genuine theft, not a situation involving unpaid transaction fees.
The breach occurred through a supply chain attack. Attackers obtained a leaked Chrome Web Store API key, which allowed them to publish a malicious version of the extension through official channels. The compromised update passed Google's review process and was distributed to users on December 24 at 12:32 p.m. UTC.
The malicious code was concealed within the extension's JavaScript files, specifically disguised as routine analytics functionality. When users imported their recovery seed phrases into the affected extension, the code captured this sensitive information and transmitted it to attacker-controlled servers at api.metrics-trustwallet[.]com. With access to seed phrases, the attackers had complete control over victim wallets and began draining funds on December 25.
The stolen digital assets included approximately $3 million in Bitcoin, $431,000 in Solana, and over $3 million in Ethereum. Attackers quickly moved the funds through centralized exchanges including ChangeNOW, FixedFloat, and KuCoin for laundering purposes. As of December 26, approximately $2.8 million remained in attacker-controlled wallets, while over $4 million had already been transferred through exchanges.
Trust Wallet identified the issue after blockchain investigator ZachXBT flagged unusual activity on December 25. The company immediately released version 2.69 to address the vulnerability. Trust Wallet confirmed that only users of Chrome extension version 2.68 were affected. Mobile app users and those using other browser extension versions were not impacted.
Binance founder Changpeng Zhao, whose company owns Trust Wallet, confirmed the platform would fully compensate affected users. Trust Wallet has since identified 2,596 compromised wallet addresses and established a formal claims process through their official support portal. Users must provide wallet addresses, transaction details, and proof of ownership to receive compensation.
Security researchers noted that the attack preparation began as early as December 8, when the malicious domain was registered. The timing of the attack on Christmas Eve followed a pattern seen in previous extension compromises, taking advantage of reduced security staffing during the holiday period.
For Trust Wallet users concerned about their security, the company recommends updating to version 2.69 or later immediately. Users who interacted with version 2.68 should transfer remaining funds to new wallets with fresh seed phrases and revoke any existing approvals associated with potentially compromised addresses. The incident has renewed discussion about the security tradeoffs of browser-based wallets compared to hardware wallet solutions that store private keys offline.
This breach represents a reminder that even established wallet providers face sophisticated attacks. The compensation process remains ongoing as Trust Wallet works to verify legitimate claims and filter out fraudulent submissions. Users should only submit claims through official Trust Wallet channels and avoid responding to phishing attempts or fake compensation forms that emerged following the breach.
