The recent Trust Wallet incident is really surprising. It was an unexpected attack in which the entire wallet extension was maliciously updated.
Let’s break down what happened and what we know so far.
In late December 2025, over $7 million was drained from user wallets. There were no alarms, no red flags, and no suspicious pop-ups. This incident exposes a critical vulnerability in the crypto ecosystem that goes beyond code: the intersection of high-privilege browser extensions, automated updates, and blind trust.
Here is the full, detailed breakdown of what happened, how it worked, and why it matters.
1. Executive Summary: What Happened?
Between December 24 and December 27, 2025, a compromised version of the Trust Wallet browser extension (Version 2.68.0) was pushed to users.
- The Mechanism: Hackers didn’t hack individual users; they hacked the update mechanism itself.
- The Damage: Over $7 million confirmed stolen across Ethereum, Bitcoin, Solana, and Binance Coin.
- The Target: Only desktop users using the Chrome Extension v2.68 were affected.
- The Status: Mobile app users were completely safe.
This was not a user error. Users did exactly what they are trained to do: they let their software update.
2. Technical Breakdown: How the Attack Worked
To understand this hack, we have to look under the hood of how browser extensions work.
The Trojan Horse: Version 2.68.0
Researchers discovered that the malicious code was injected directly into the official update. Specifically, it was an obfuscated (scrambled) JavaScript file named 4482.js.
The Disguise
Hackers know that security teams look for odd file names. To hide, the malicious code masqueraded as PostHog, a legitimate analytics tool often used by developers. To a casual observer, the code looked like standard tracking software.
The Trigger
The virus didn’t attack immediately. It waited for a specific user action: The Login or Import.
The moment a user opened the extension and entered their password or imported a seed phrase, the dormant script activated. It silently captured the decrypted secrets (the “keys” to the wallet) from the browser’s memory.
The Exfiltration (The Getaway)
Once the script stole the wallet keys, it needed to send them to the hackers. It transmitted the data to a web domain created specifically for this attack:
api.metrics-trustwallet.com
Why this was clever: This is not a real Trust Wallet domain, but it looks like one. Most firewalls and security filters would see “metrics-trustwallet” and assume it was safe, legitimate telemetry data. In reality, it was a direct line to the attackers.
3. The Root Cause: How Did They Get In?
The most terrifying part of this hack is that the malicious update came from the official Chrome Web Store.
According to investigations by the Trust Wallet team (including updates from Eowyn Chen), the malicious version (v2.68) was not released through their internal manual security process.
The Hypothesis: The API Key Compromise
It appears attackers compromised a Chrome Web Store API Key.
- What is an API Key? Think of it as a “digital pass” that allows developers to upload new software versions automatically, bypassing the need for a human to click “upload.”
- The Bypass: By stealing this key, the hackers were able to upload their infected version directly to Google. They skipped Trust Wallet’s internal security checks and code reviews entirely.
4. The Timeline of Events
- Dec 24, 2025: Malicious version 2.68.0 is silently pushed to Chrome users via auto-update.
- Dec 24 – 26: Users who open their extension and log in have their credentials silently stolen. Funds begin draining within minutes of authorization.
- Dec 26: Reports flood in. Transactions appear without authorization. Losses cross the $7 million mark.
- Dec 27 (Response):
- Trust Wallet confirms the breach.
- The malicious domain (
api.metrics-trustwallet.com) is suspended by the registrar, cutting off the hackers’ ability to steal new data. - Trust Wallet revokes/expires all release API keys to close the backdoor.
- Version 2.69 (the “clean” version) is released to overwrite the infected software.
5. Scope of Impact: Am I Safe?
It is vital to distinguish who was hit and who was not.
| Platform | Status | Risk Level |
| Trust Wallet Mobile App | SAFE | Zero. The mobile app uses a completely different codebase and update system. |
| Extension v2.67 or older | SAFE | If you didn’t update, you weren’t infected. |
| Extension v2.69 (New) | SAFE | This is the patched version. |
| Extension v2.68 (Target) | CRITICAL | High Risk. If you logged in while on this version, your wallet is compromised. |
6. Immediate Action Plan (Non-Negotiable)
If you are a Trust Wallet Browser Extension user, follow these steps immediately. Do not wait.
Step 1: Check Your Version
Open your extension settings and check the version number.
- If you are on 2.69, you are on the safe software.
- If you are on 2.68, assume you are infected.
Step 2: The “Burn and Migrate” Protocol
If you used version 2.68, your seed phrase has likely been sent to the hackers.
- DO NOT simply change your password. That will not help.
- DO NOT keep using the wallet.
- ACTION: Create a brand new wallet (new seed phrase) on a secure device. Transfer all remaining assets to the new wallet immediately.
Step 3: Watch Out for “The Second Wave”
Hackers are currently launching secondary attacks. They are setting up fake “Refund” or “Security Patch” websites (e.g., fix-trustwallet.com).
- NEVER enter your seed phrase into a website to “fix” a hack.
- There is no such thing as “reversing” a blockchain transaction. Anyone claiming they can recover your funds is a scammer.