Trust Wallet Chrome Extension Breach Results in $7 Million Crypto Loss

Trust Wallet, a multi-chain, non-custodial cryptocurrency wallet service, reported a significant security breach on December 26, 2025. This incident affected users of its Chrome extension version 2.68, resulting in a loss of around $7 million. The breach was attributed to malicious code that was introduced into the extension, allowing attackers to extract mnemonic phrases from user wallets.

The malicious code was designed to iterate through all wallets stored in the extension and request mnemonic phrases for each wallet. Once decrypted, these phrases were sent to an attacker-controlled server at api.metrics-trustwallet.com, which was registered on December 8, 2025. The first requests to this server began on December 21, 2025.

According to blockchain security firm SlowMist, the attack utilized an open-source analytics library named posthog-js to harvest user information. The stolen funds included approximately $3 million in Bitcoin, $431 in Solana, and over $3 million in Ethereum, with the majority of the funds laundered through centralized exchanges.

Trust Wallet has confirmed that it will refund affected users and has urged them to refrain from interacting with unofficial messages. The company indicated that the attack might have been executed by a nation-state actor, suggesting that the attackers may have gained access to developer devices or permissions prior to the breach.

Changpeng Zhao, co-founder of Binance, hinted that the exploit was likely carried out by an insider, although no definitive evidence was provided. This incident highlights the critical need for robust security measures in software development and the importance of user vigilance in protecting their digital assets.