Trust Wallet reveals details of $8.5 million hack - ForkLog: cryptocurrencies, AI, singularity, the future

2025-12-31 12:35:02

# Trust Wallet Reveals Details of $8.5 Million Hack

The Trust Wallet team published an incident report regarding the event that occurred on December 26. Malicious actors compromised the browser extension and withdrew assets totaling $8.5 million.

According to the statement, the attack affected 2,520 addresses. The developers committed to fully compensate the victims for their losses.

How it happened

The breach was caused by a large-scale supply chain attack on Sha1-Hulud, detected in November. Hackers gained access to developers’ secrets on GitHub and the Chrome Web Store API key.

Using the stolen data, the attackers:

Uploaded a malicious version of extension (2.68) to the Chrome Web Store, bypassing Trust Wallet’s internal review.
Registered the domain metrics-trustwallet.com to collect confidential data (seed phrases and private keys).
Automatically distributed the update to users after passing Google’s review.

The malicious version was active from December 24 to 26. After discovering the issue, the team rolled back the extension to a safe version 2.69 and revoked the compromised keys.

Who was affected

The vulnerability impacted only desktop extension users of version 2.68 who accessed their wallets during the specified dates. The Trust Wallet mobile app and other extension versions remained secure.

Analysts identified 17 addresses controlled by the hacker. The total damage amounted to $8.5 million.

“We see this incident not only as a critical lesson for us but also as a turning point for the entire industry regarding supply chain attacks,” said Trust Wallet.

Fund recovery process

The company has already begun working with the victims. To receive compensation, users need to submit a request through the official support form and verify ownership of their wallet.

Trust Wallet emphasized the complexity of the process due to the influx of scammers. Over 5,000 applications have been received from the 2,520 affected addresses. The team urged users to be patient and beware of phishing: official support will never ask for seed phrases.

To prevent similar incidents in the future, the project has strengthened security measures, including code dependency audits and credential rotation.

Recall that in 2025, the amount of funds stolen via phishing attacks decreased by 83%, totaling $83.85 million, according to SlowMist.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.