Leaked API Key
1 incident, 0 live. 302 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2025
Past
December 2025 1
-
Critical✓Contained
Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets
A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.
Trust Wallet Chrome extension v2.68·Solana, Bitcoin, Ethereum·$8.5M stolen·Since Dec 24, 2025·
No drains match these filters.