Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets
Trust Wallet Chrome extension v2.68
A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.
Why this severity: $8.5M reported stolen, 2,520 victims.
- Started
- Dec 24, 2025
- Closed
- Dec 25, 2025
- Reported stolen
- $8.5M
- Victims
- 2,520
Indicators · never visit or send to these
- metrics-trustwallet[.]com
What to do now
- Update to v2.69 or later from the official Chrome Web Store listing.
- Create a new wallet with a new seed phrase on a clean device, and move funds on every chain (BTC, ETH, SOL and others). One seed controls all of them.
- File claims only through Trust Wallet's official support portal. Ignore DMs and ads offering 'compensation'; fake claim forms circulated.
Stay safe
Am I affected?
You are affected if you used the Trust Wallet Chrome extension version 2.68 (released Dec 24, 2025) and opened it or imported a seed phrase before Dec 26, 2025, 11:00 UTC. Trust Wallet mobile app users and other extension versions were not affected. Check the version on your browser's extensions page.
What to do now
- Update to v2.69 or later from the official Chrome Web Store listing.
- Create a new wallet with a new seed phrase on a clean device, and move funds on every chain (BTC, ETH, SOL and others). One seed controls all of them.
- File claims only through Trust Wallet's official support portal. Ignore DMs and ads offering 'compensation'; fake claim forms circulated.
How to avoid this
- Keep large balances in a hardware wallet. Even an official store update can be trojanized.
- Avoid importing old seed phrases into browser extensions; make fresh hot wallets for daily use.
- After a wallet vendor announces an incident, stop using the extension until it confirms which versions are safe.
Timeline 5
SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.
SourceTrust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.
SourceCyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.
SourceZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.
SourceMalicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.
Source
News & write-ups ›4
- Trust Wallet launches compensation process for $7 million browser extension hack victimsThe Block · Dec 27, 2025
- Trust Wallet suffers supply chain compromise, millions in crypto stolenCyberInsider · Dec 26, 2025
- Trust Wallet users lose at least $6 million in security breach, ZachXBT findsThe Block · Dec 25, 2025
- Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet HeistSecurityWeek · Dec 31, 2025
How this method works
A fake wallet extension, or a real extension that was sold or hijacked, reads your seed phrase or swaps transactions as you sign. Read about malicious browser extensions →
Follow new drains and updates in your feed reader or Telegram RSS bot.