# Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets

- Severity: Critical · Status: Contained (past)
- Chains: Solana, Bitcoin, Ethereum · Method: Malicious browser extensions
- Started: Dec 24, 2025 · Last update: Dec 31, 2025 · Reported stolen: $8.5M · Victims: 2520
- Who/what: Trust Wallet Chrome extension v2.68

A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.

## Am I affected?
You are affected if you used the Trust Wallet Chrome extension version 2.68 (released Dec 24, 2025) and opened it or imported a seed phrase before Dec 26, 2025, 11:00 UTC. Trust Wallet mobile app users and other extension versions were not affected. Check the version on your browser's extensions page.

## What to do now
- Update to v2.69 or later from the official Chrome Web Store listing.
- Create a new wallet with a new seed phrase on a clean device, and move funds on every chain (BTC, ETH, SOL and others). One seed controls all of them.
- File claims only through Trust Wallet's official support portal. Ignore DMs and ads offering 'compensation'; fake claim forms circulated.

## How to avoid this
- Keep large balances in a hardware wallet. Even an official store update can be trojanized.
- Avoid importing old seed phrases into browser extensions; make fresh hot wallets for daily use.
- After a wallet vendor announces an incident, stop using the extension until it confirms which versions are safe.

## Indicators (block these, never visit them)
- Domain: metrics-trustwallet[.]com

## Sources
- Trust Wallet launches compensation process for $7 million browser extension hack victims (The Block, 2025-12-27): https://www.theblock.co/amp/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims
- Trust Wallet suffers supply chain compromise, millions in crypto stolen (CyberInsider, 2025-12-26): https://cyberinsider.com/trust-wallet-suffers-supply-chain-compromise-millions-in-crypto-stolen/
- Trust Wallet users lose at least $6 million in security breach, ZachXBT finds (The Block, 2025-12-25): https://www.theblock.co/post/383735/trust-wallet-extension-incident
- Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist (SecurityWeek, 2025-12-31): https://www.securityweek.com/shai-hulud-supply-chain-attack-led-to-8-5-million-trust-wallet-heist/

Full record: https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025 · JSON: https://drains.watch/i/trust-wallet-extension-v2-68-seed-theft-dec-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.