Overview
- Trust Wallet confirmed the incident was limited to Chrome extension version 2.68 and urged users to disable it and update to version 2.69, noting that mobile and other extension versions were not affected.
- On‑chain analysts estimate roughly $6–7 million was stolen, with traces showing transfers to services including KuCoin, HTX, ChangeNOW, and FixedFloat as portions remain in attacker wallets.
- The issue surfaced after a December 24 extension update, and on‑chain investigator ZachXBT flagged waves of immediate drains reported by users on December 25.
- Security researchers identified suspicious logic in a bundled file (4482.js) that appeared to exfiltrate sensitive data to api.metrics-trustwallet[.]com, and opportunistic phishing sites such as fix-trustwallet[.]com also emerged.
- Changpeng Zhao said Trust Wallet will reimburse affected users, while the team investigates whether the malicious release stemmed from a supply‑chain compromise or insider involvement.