{
 "slug": "trust-wallet-extension-v2-68-seed-theft-dec-2025",
 "title": "Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets",
 "url": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025",
 "json": "https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "solana",
  "bitcoin",
  "ethereum"
 ],
 "method": "malicious-extension",
 "product": "Trust Wallet Chrome extension v2.68",
 "tags": [
  "solana",
  "bitcoin",
  "ethereum",
  "malicious-extension",
  "trust-wallet",
  "browser-extension",
  "chrome-web-store",
  "seed-phrase",
  "leaked-api-key",
  "wallet",
  "supply-chain",
  "shai-hulud",
  "npm",
  "seed-phrase-theft"
 ],
 "amountUsd": 8500000,
 "victims": 2520,
 "startedAt": "2025-12-24",
 "closedAt": "2025-12-25",
 "updatedAt": "2025-12-31T12:00:00Z",
 "summary": "A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.",
 "timeline": [
  {
   "date": "2025-12-24",
   "title": "Malicious Trust Wallet extension v2.68 was published to the Chrome Web Store at 12:32 UTC using a leaked store API key, bypassing the normal release process.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims"
  },
  {
   "date": "2025-12-25",
   "title": "ZachXBT warned that over $6M had been stolen from hundreds of users; Trust Wallet confirmed the v2.68 incident and released the fixed v2.69.",
   "sourceUrl": "https://www.theblock.co/post/383735/trust-wallet-extension-incident"
  },
  {
   "date": "2025-12-26",
   "title": "CyberInsider reported that the exfiltration domain metrics-trustwallet[.]com had been registered days before the breach and was taken offline.",
   "sourceUrl": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/"
  },
  {
   "date": "2025-12-27",
   "title": "Trust Wallet launched a compensation claims process for about $7M in losses and warned of fake compensation forms.",
   "sourceUrl": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims"
  },
  {
   "date": "2025-12-31",
   "title": "SecurityWeek reported Trust Wallet's post-mortem: the Shai-Hulud 2.0 worm leaked developer GitHub secrets; $8.5M was drained from 2,520 addresses; users who logged in between 24 and 26 December were affected; all affected users will be reimbursed.",
   "sourceUrl": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Trust Wallet launches compensation process for $7 million browser extension hack victims",
   "url": "https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims",
   "publisher": "The Block",
   "date": "2025-12-27"
  },
  {
   "kind": "news",
   "title": "Trust Wallet suffers supply chain compromise, millions in crypto stolen",
   "url": "https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/",
   "publisher": "CyberInsider",
   "date": "2025-12-26"
  },
  {
   "kind": "news",
   "title": "Trust Wallet users lose at least $6 million in security breach, ZachXBT finds",
   "url": "https://www.theblock.co/post/383735/trust-wallet-extension-incident",
   "publisher": "The Block",
   "date": "2025-12-25"
  },
  {
   "kind": "news",
   "title": "Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist",
   "url": "https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/",
   "publisher": "SecurityWeek",
   "date": "2025-12-31"
  }
 ],
 "indicators": {
  "domains": [
   "metrics-trustwallet[.]com"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou are affected if you used the Trust Wallet Chrome extension version 2.68 (released Dec 24, 2025) and opened it or imported a seed phrase before Dec 26, 2025, 11:00 UTC. Trust Wallet mobile app users and other extension versions were not affected. Check the version on your browser's extensions page.\n\n## What to do now\n- Update to v2.69 or later from the official Chrome Web Store listing.\n- Create a new wallet with a new seed phrase on a clean device, and move funds on every chain (BTC, ETH, SOL and others). One seed controls all of them.\n- File claims only through Trust Wallet's official support portal. Ignore DMs and ads offering 'compensation'; fake claim forms circulated.\n\n## How to avoid this\n- Keep large balances in a hardware wallet. Even an official store update can be trojanized.\n- Avoid importing old seed phrases into browser extensions; make fresh hot wallets for daily use.\n- After a wallet vendor announces an incident, stop using the extension until it confirms which versions are safe.",
 "notes": null,
 "agentBrief": "# Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Solana, Bitcoin, Ethereum · Method: Malicious browser extensions\n- Started: Dec 24, 2025 · Last update: Dec 31, 2025 · Reported stolen: $8.5M · Victims: 2520\n- Who/what: Trust Wallet Chrome extension v2.68\n\nA malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.\n\n## Am I affected?\nYou are affected if you used the Trust Wallet Chrome extension version 2.68 (released Dec 24, 2025) and opened it or imported a seed phrase before Dec 26, 2025, 11:00 UTC. Trust Wallet mobile app users and other extension versions were not affected. Check the version on your browser's extensions page.\n\n## What to do now\n- Update to v2.69 or later from the official Chrome Web Store listing.\n- Create a new wallet with a new seed phrase on a clean device, and move funds on every chain (BTC, ETH, SOL and others). One seed controls all of them.\n- File claims only through Trust Wallet's official support portal. Ignore DMs and ads offering 'compensation'; fake claim forms circulated.\n\n## How to avoid this\n- Keep large balances in a hardware wallet. Even an official store update can be trojanized.\n- Avoid importing old seed phrases into browser extensions; make fresh hot wallets for daily use.\n- After a wallet vendor announces an incident, stop using the extension until it confirms which versions are safe.\n\n## Indicators (block these, never visit them)\n- Domain: metrics-trustwallet[.]com\n\n## Sources\n- Trust Wallet launches compensation process for $7 million browser extension hack victims (The Block, 2025-12-27): https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims\n- Trust Wallet suffers supply chain compromise, millions in crypto stolen (CyberInsider, 2025-12-26): https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/\n- Trust Wallet users lose at least $6 million in security breach, ZachXBT finds (The Block, 2025-12-25): https://www.theblock.co/post/383735/trust-wallet-extension-incident\n- Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist (SecurityWeek, 2025-12-31): https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/\n\nFull record: https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025 · JSON: https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}