ZachXBT flags suspected Trust Wallet extension issue as users report drained funds

ambcryptoPublicado a 2025-12-25Actualizado a 2025-12-25

Resumen

Security concerns emerged around the Trust Wallet browser extension on December 25, after blockchain investigator ZachXBT flagged suspicious activity potentially linked to a recent update. Reports suggest a supply-chain compromise may have been introduced in a December 24 update, where newly added code could silently exfiltrate sensitive wallet data—particularly during seed phrase imports—leading to immediate fund draining. Multiple users reported losses, with unverified estimates exceeding $2 million. The malicious code allegedly sent data to a recently registered external domain mimicking Trust Wallet infrastructure. The issue appears limited to the browser extension, with no evidence of mobile app compromise. Trust Wallet has not yet issued an official response or advisory. Researchers emphasize the situation remains under investigation, warning users to avoid importing seed phrases into the extension until clarified. If confirmed, this would represent a significant supply-chain attack.

Security concerns have emerged around the Trust Wallet browser extension on 25 December, after blockchain investigator ZachXBT flagged suspicious activity potentially linked to a recent update, prompting warnings from developers and security-focused accounts.

According to posts circulating on X, the issue may stem from a suspected supply-chain compromise introduced in a 24 December browser extension update.

Newly added code within the extension could silently exfiltrate sensitive wallet data when users import a seed phrase. The claims suggest that this has led to immediate wallet draining.

Alleged Trust Wallet malicious code and data exfiltration claims

Developers examining the extension allege that a JavaScript file added in the update contains logic disguised as analytics.

The code is said to activate specifically when a seed phrase is imported. It then silently transmits wallet-related data to an external domain designed to resemble official Trust Wallet infrastructure.

The domain referenced in the reports was reportedly registered only days ago and has since gone offline.

Researchers argue that its recent creation and the timing of the extension update raise concerns about a coordinated supply-chain attack rather than user-side phishing.

Users report wallet drains following seed imports

Multiple users have reported wallets being drained shortly after importing seed phrases into the Trust Wallet browser extension.

Publicly shared estimates suggest that more than $2 million may have been lost. Although these figures have not been independently verified.

Analysts indicate that funds were routed through multiple addresses, a pattern more commonly associated with automated exploitation than isolated user error.

Scope appears limited to browser extension

At this stage, there is no indication that Trust Wallet’s mobile applications are affected.

The warnings circulating online are focused specifically on the browser extension. This is where update mechanisms and third-party dependencies present higher supply-chain risk.

Users are advised not to import seed phrases into the Trust Wallet browser extension until further clarification is provided.

No official response from Trust Wallet yet

As of the time of writing, Trust Wallet has not issued any public response, clarification, or security advisory addressing the allegations.

There has been no confirmation or denial of the claims, nor any announcement of an extension, rollback, or emergency patch.

Investigation ongoing

Researchers have emphasized that the situation remains under active investigation. Conclusions should not be drawn until the extension code and related on-chain activity have been fully reviewed.

If confirmed, the incident would represent a serious supply-chain compromise.

This is a class of attack that differs significantly from phishing or user-side mistakes. Also, it has historically resulted in rapid, large-scale losses across the crypto ecosystem.

Final Thoughts

The allegations point to a potentially serious supply-chain risk affecting wallet extensions, underscoring how code updates can become a critical attack vector if compromised.
With no response yet from Trust Wallet, users and researchers are left relying on independent investigation as scrutiny around the incident continues.

Preguntas relacionadas

QWhat security concern was flagged by ZachXBT regarding the Trust Wallet browser extension?

AZachXBT flagged suspicious activity potentially linked to a recent update of the Trust Wallet browser extension, suggesting it could be a supply-chain compromise that leads to the silent exfiltration of sensitive wallet data and immediate draining of funds.

QHow does the suspected malicious code in the Trust Wallet extension allegedly operate?

AThe malicious JavaScript code, added in an update and disguised as analytics, is said to activate when a user imports a seed phrase. It then silently transmits wallet-related data to an external domain designed to look like official Trust Wallet infrastructure.

QWhat is the estimated financial impact based on user reports, and how were the funds moved?

APublicly shared estimates suggest that more than $2 million may have been lost, though this is unverified. Analysts indicate the funds were routed through multiple addresses, a pattern associated with automated exploitation rather than isolated user error.

QAre Trust Wallet's mobile applications also affected by this suspected compromise?

ANo, there is no indication that Trust Wallet’s mobile applications are affected. The warnings are specifically focused on the browser extension, which has higher supply-chain risk due to its update mechanisms and third-party dependencies.

QWhat is the current status of Trust Wallet's official response to these allegations?

AAs of the time the article was written, Trust Wallet had not issued any public response, clarification, or security advisory addressing the allegations. There has been no confirmation, denial, or announcement of an emergency patch.

Lecturas Relacionadas

Base Under Pressure

**Title: The Pressure Mounts for Base** Base, the Ethereum Layer 2 scaling solution backed by Coinbase, is facing significant pressure and public scrutiny from its leadership following the launch of Robinhood Chain. Base co-founder Jesse Pollak recently acknowledged strategic missteps, admitting that the chain's past focus on social and creator tokens (e.g., through Farcaster, Zora) failed to deliver sustainable adoption. He has refocused on core infrastructure, handing leadership of the Base App back to Coinbase's Cobie. While Base remains a top L2 contender alongside OP Mainnet and Arbitrum, and boasts the highest TVL (nearly $12B), its weaknesses are being highlighted by the new competitor. Key criticisms include its slow progress on decentralization. Base has faced issues with its single sequencer causing block production halts, and L2BEAT is reportedly considering downgrading its decentralization rating from Stage 1 to Stage 0. This contrasts sharply with the rapid initial success of Robinhood Chain, whose DEX quickly entered the top five by volume. The leadership styles of the parent companies are also being compared: Robinhood's CEO actively engages with new projects, while a recent incident where Coinbase's Brian Armstrong briefly changed his profile picture—sparking and then crashing a related meme token—drew community ire and mockery. Pollak stated Base is working with Coinbase on tokenized stocks backed 1:1 by real equity, differentiating it from Robinhood's derivatives model. However, the article argues that Base's most urgent task is to address its long-standing technical and trust issues. With more traditional finance players likely to emulate Robinhood's path, Base must use this competitive pressure to solidify its position as long-term financial infrastructure.

Foresight NewsHace 11 min(s)

Foresight NewsHace 11 min(s)

White House Concession Removes Ethical Hurdle, Clarity Act Races Against Final Window Before Recess?

On July 21st, industry sources reported that the Trump administration has agreed to include an ethics provision in the "Clarity Act" (Digital Asset Market Clarity Act of 2025). This concession addresses the long-standing conflict-of-interest concerns regarding government officials and the crypto industry, potentially removing the final major obstacle to the bill's progress. Additionally, Patrick Witt, the executive director of the White House's Digital Asset Advisory Committee, confirmed he will remain in his role to help finalize the bill, alleviating previous concerns about his potential departure. The Clarity Act aims to establish a unified federal regulatory framework for the U.S. digital asset market. Its core objective is to resolve regulatory ambiguity by defining different types of digital assets (digital commodities, investment contract assets, and permitted payment stablecoins) and clarifying the respective oversight roles of the SEC and CFTC. This would end the long-running jurisdictional dispute between the two agencies and provide clearer compliance paths for the industry. With the ethics issue moving toward resolution, the most urgent challenge now is time. The U.S. Congress is set to begin its August recess in mid-August, leaving only a few working weeks to finalize the text and advance the bill through the Senate. Industry advocates, like the Blockchain Association's Kristin Smith, stress that this is a critical moment. If negotiations conclude successfully in the coming weeks, the Clarity Act could pass a key hurdle before the recess; otherwise, it may face significant delays. If enacted, the Clarity Act could mark a historic turning point in crypto regulation. By providing a clearer and more predictable legal framework, it aims to reduce uncertainty for businesses, developers, and traditional financial institutions looking to enter the digital asset space, potentially setting a global benchmark for market structure regulation.

Odaily星球日报Hace 17 min(s)

White House Concession Removes Ethical Hurdle, Clarity Act Races Against Final Window Before Recess?

Odaily星球日报Hace 17 min(s)

Midnight’s 515M NIGHT hack sends token down 32% – Will $0.015 hold?

In July 2026, the Midnight network was hacked, with 515 million NIGHT tokens drained from a cross-chain bridge contract. The attacker sold a large portion, causing the token price to crash 32% to an all-time low of $0.015. This triggered panic selling, spiking trading volume and driving market indicators into deeply oversold territory. While the Midnight Foundation stated its core network remained secure, the incident left the wrapped token on BNB unbacked. Analysts warn of continued bearish pressure, with the key question being whether the $0.015 support level will hold.

ambcryptoHace 22 min(s)

Midnight’s 515M NIGHT hack sends token down 32% – Will $0.015 hold?

ambcryptoHace 22 min(s)

AI Era, Industrial Revolution, and Future Civilization Interview — Zhang Dingwen: The Future Does Not Belong to Chasers

"AI Era, Industrial Revolution and Future Civilization: An Interview with Zhang Dingwen – The Future Does Not Belong to Those Who Chase" In this interview, entrepreneur Zhang Dingwen reflects on his entrepreneurial journey and philosophy, moving beyond discussions of financing or success to emphasize understanding the "era" itself. He argues that true entrepreneurs should not chase short-term trends ("winds"), but position themselves in the direction of long-term technological and societal evolution. Zhang shares key lessons from his early days, including the realization that user value does not automatically translate to commercial value. For him, the core of entrepreneurship is not building a company but constantly upgrading one's own "cognition" – the ability to interpret information, ask the right questions, and understand the underlying "causes" behind business outcomes, not just the effects. His thinking has evolved from a focus on creating good products to a strategic focus on building "entrances" – platforms that naturally connect users to digital services. He sees smart wearables, like watches, not merely as hardware but as potential future gateways combining technological, financial, social, and even fashion attributes to create sustained user relationships and ecosystems. Ultimately, Zhang's vision transcends individual products or companies. He discusses business competition in three stages: product, platform, and finally, "civilization" – where the greatest companies influence how society operates by defining new rules and ways of life. He believes the mission of a truly great enterprise is to solve problems of its time, build enduring trust, and contribute lasting value, leaving behind not just wealth but a positive impact on how the world works. The future, he concludes, belongs not to the fastest, but to those with the correct long-term direction and a commitment to continuous learning and evolution.

marsbitHace 28 min(s)

AI Era, Industrial Revolution, and Future Civilization Interview — Zhang Dingwen: The Future Does Not Belong to Chasers

marsbitHace 28 min(s)

Cryptocurrency & Stock Market Barometer丨Strategy Cash Reserves Increase to $3.23 Billion, Halting BTC Purchases; Vanguard and Other Asset Managers Increase Holdings in Strategy Stock (July 21)

Market Overview & Warnings: The article warns of high volatility in South Korean stocks and continued dependence on U.S. stocks on geopolitics. Chinese A-shares remain under pressure. It advises against using leverage in current equity markets. For crypto-linked stocks, most have limited growth except Robinhood, with caution advised. U.S. Stock Market: Bearish bets on U.S. stocks, particularly targeting AI-related companies, have reached record highs since 2010, signaling deep skepticism about the sustainability of the AI-driven rally. Tech and chip stocks led a market decline, with the Philadelphia Semiconductor Index potentially entering a bear market. Increased expectations for Federal Reserve interest rate hikes and geopolitical tensions contributed to the negative sentiment. Bitcoin Treasury Company Updates: * Strategy: Increased its cash reserves to $3.23 billion and paused Bitcoin purchases. Several major asset managers, including Vanguard Group and Capital Group, increased their holdings of Strategy (MSTR) stock. * Global corporate Bitcoin buying slowed significantly to just $1.33 million last week. * Other notable activity: Strive purchased 21 BTC; ORANGE JUICE raised $40 million for Bitcoin acquisitions; Bitcoin Japan Corp. raised $60 million, allocating $4.08 million for its first BTC purchase. Other Crypto Treasury Holdings: * Ethereum: BitMine increased its ETH holdings to 5.78 million, nearing its 5% of supply goal. Its total crypto assets, cash, and securities are valued at $11.5 billion. * Solana: No significant corporate treasury activity reported. * Altcoins: HypeStrat made no adjustments to its treasury; its mNAV ratio fell to a long-term low. (Note: This summary is for informational purposes only and does not constitute investment advice.)

marsbitHace 29 min(s)

Cryptocurrency & Stock Market Barometer丨Strategy Cash Reserves Increase to $3.23 Billion, Halting BTC Purchases; Vanguard and Other Asset Managers Increase Holdings in Strategy Stock (July 21)

marsbitHace 29 min(s)

Trading

Spot