ZachXBT flags suspected Trust Wallet extension issue as users report drained funds

ambcryptoPublicado em 2025-12-25Última atualização em 2025-12-25

Resumo

Security concerns emerged around the Trust Wallet browser extension on December 25, after blockchain investigator ZachXBT flagged suspicious activity potentially linked to a recent update. Reports suggest a supply-chain compromise may have been introduced in a December 24 update, where newly added code could silently exfiltrate sensitive wallet data—particularly during seed phrase imports—leading to immediate fund draining. Multiple users reported losses, with unverified estimates exceeding $2 million. The malicious code allegedly sent data to a recently registered external domain mimicking Trust Wallet infrastructure. The issue appears limited to the browser extension, with no evidence of mobile app compromise. Trust Wallet has not yet issued an official response or advisory. Researchers emphasize the situation remains under investigation, warning users to avoid importing seed phrases into the extension until clarified. If confirmed, this would represent a significant supply-chain attack.

Security concerns have emerged around the Trust Wallet browser extension on 25 December, after blockchain investigator ZachXBT flagged suspicious activity potentially linked to a recent update, prompting warnings from developers and security-focused accounts.

According to posts circulating on X, the issue may stem from a suspected supply-chain compromise introduced in a 24 December browser extension update.

Newly added code within the extension could silently exfiltrate sensitive wallet data when users import a seed phrase. The claims suggest that this has led to immediate wallet draining.

Alleged Trust Wallet malicious code and data exfiltration claims

Developers examining the extension allege that a JavaScript file added in the update contains logic disguised as analytics.

The code is said to activate specifically when a seed phrase is imported. It then silently transmits wallet-related data to an external domain designed to resemble official Trust Wallet infrastructure.

The domain referenced in the reports was reportedly registered only days ago and has since gone offline.

Researchers argue that its recent creation and the timing of the extension update raise concerns about a coordinated supply-chain attack rather than user-side phishing.

Users report wallet drains following seed imports

Multiple users have reported wallets being drained shortly after importing seed phrases into the Trust Wallet browser extension.

Publicly shared estimates suggest that more than $2 million may have been lost. Although these figures have not been independently verified.

Analysts indicate that funds were routed through multiple addresses, a pattern more commonly associated with automated exploitation than isolated user error.

Scope appears limited to browser extension

At this stage, there is no indication that Trust Wallet’s mobile applications are affected.

The warnings circulating online are focused specifically on the browser extension. This is where update mechanisms and third-party dependencies present higher supply-chain risk.

Users are advised not to import seed phrases into the Trust Wallet browser extension until further clarification is provided.

No official response from Trust Wallet yet

As of the time of writing, Trust Wallet has not issued any public response, clarification, or security advisory addressing the allegations.

There has been no confirmation or denial of the claims, nor any announcement of an extension, rollback, or emergency patch.

Investigation ongoing

Researchers have emphasized that the situation remains under active investigation. Conclusions should not be drawn until the extension code and related on-chain activity have been fully reviewed.

If confirmed, the incident would represent a serious supply-chain compromise.

This is a class of attack that differs significantly from phishing or user-side mistakes. Also, it has historically resulted in rapid, large-scale losses across the crypto ecosystem.

Final Thoughts

  • The allegations point to a potentially serious supply-chain risk affecting wallet extensions, underscoring how code updates can become a critical attack vector if compromised.
  • With no response yet from Trust Wallet, users and researchers are left relying on independent investigation as scrutiny around the incident continues.

Perguntas relacionadas

QWhat security concern was flagged by ZachXBT regarding the Trust Wallet browser extension?

AZachXBT flagged suspicious activity potentially linked to a recent update of the Trust Wallet browser extension, suggesting it could be a supply-chain compromise that leads to the silent exfiltration of sensitive wallet data and immediate draining of funds.

QHow does the suspected malicious code in the Trust Wallet extension allegedly operate?

AThe malicious JavaScript code, added in an update and disguised as analytics, is said to activate when a user imports a seed phrase. It then silently transmits wallet-related data to an external domain designed to look like official Trust Wallet infrastructure.

QWhat is the estimated financial impact based on user reports, and how were the funds moved?

APublicly shared estimates suggest that more than $2 million may have been lost, though this is unverified. Analysts indicate the funds were routed through multiple addresses, a pattern associated with automated exploitation rather than isolated user error.

QAre Trust Wallet's mobile applications also affected by this suspected compromise?

ANo, there is no indication that Trust Wallet’s mobile applications are affected. The warnings are specifically focused on the browser extension, which has higher supply-chain risk due to its update mechanisms and third-party dependencies.

QWhat is the current status of Trust Wallet's official response to these allegations?

AAs of the time the article was written, Trust Wallet had not issued any public response, clarification, or security advisory addressing the allegations. There has been no confirmation, denial, or announcement of an emergency patch.

Leituras Relacionadas

Google TPU Shipments Revised Up by 50%

Recent industry research indicates a significant upward revision in the shipments of Google's TPU (Tensor Processing Unit) chips. Previous expectations for 2027 were set at around 10 million units, but new estimates now point to 15 million units, a 50% increase. This substantial boost directly translates to higher demand across the entire supporting supply chain. Google's TPU clusters utilize a standardized all-optical interconnect architecture. Consequently, key hardware components are deeply integrated and scaled in fixed ratios with the chips. The 15 million TPU target will drive corresponding demand increases for NPO optical engines (roughly a 1:1 match), 1.6T optical modules, OCS optical switches, high-end server power supplies, fiber optics & MPO connectors, and liquid cooling solutions. Among these, liquid cooling is highlighted as the sector experiencing the most significant transformation and offering the most stable potential for excess returns. As next-generation TPU chips reach power levels where traditional air cooling is insufficient, liquid cooling becomes essential. 2026 is forecasted as the first year of substantial adoption for Google's liquid cooling solutions. This shift, coupled with delivery and capacity bottlenecks faced by incumbent overseas manufacturers, is creating a prime window for domestic Chinese suppliers to enter and secure Google's core supply chain. The market size for Google-specific liquid cooling is projected to potentially triple from a baseline of hundreds of billions to around 300 billion units by 2028. The logic for the fiber optic sector is also being rewritten. Once considered a cyclical commodity tied to telecom operator procurement, fiber is now a strategic and scarce resource for AI Data Centers (AIDC). A severe supply-demand imbalance, driven by the long lead time for preform production (18-24 months) and surging demand from cloud giants, is supporting strong performance. Chinese fiber manufacturers are well-positioned to capture a significant share of global AIDC demand, with exports potentially reaching 200-300 million core kilometers in 2026. Overall, the investment focus within the AI computing industry is shifting from pure "chip performance speculation" towards the more certain incremental growth in computing infrastructure and its supporting ecosystem. The upward revision in Google TPU shipments, along with the potential for further doubling by 2028, is seen as solidifying performance visibility for the entire supporting supply chain over the next two years.

marsbitHá 30m

Google TPU Shipments Revised Up by 50%

marsbitHá 30m

What Wall Street Really Wants After the Crypto Story Recedes

The tide of speculative crypto narratives has receded, revealing Wall Street's true objective: building a controlled, yield-generating, and compliant financial pipeline on distributed ledgers. They are migrating core functions onto blockchains, not for decentralization, but for efficiency and new revenue streams. Key developments include BlackRock's BUIDL fund, a tokenized treasury fund acting as a foundational reserve asset, and the rise of Securitize, which is going public and partnering with the NYSE to build a 24/7 digital securities trading and settlement system. This signals a major shift of securities clearing to blockchain technology. To make volatile assets like Bitcoin palatable for institutional investors, firms like BlackRock and Goldman Sachs are creating "covered call" ETFs (e.g., BITA). These products systematically sell options on Bitcoin holdings, transforming price volatility into stable monthly income, effectively repackaging crypto as a yield-bearing asset. Stablecoins are being positioned not as speculative tools but as efficient payment rails. Companies like Stripe and Mastercard are integrating them for instant, low-cost merchant settlements and cross-border card payments, respectively. Critically, new legislation like the GENIUS Act shapes them as non-interest-bearing, heavily regulated extensions of the US dollar system. In summary, Wall Street is quietly constructing a parallel, blockchain-based financial infrastructure featuring tokenized traditional assets, structured crypto yields, and programmable dollar pipelines—all under its control and fully integrated with existing regulatory and credit frameworks.

marsbitHá 46m

What Wall Street Really Wants After the Crypto Story Recedes

marsbitHá 46m

Tying Itself to SpaceX: Cursor's $60 Billion Rise

This article recounts the rapid rise of AI-powered coding startup Cursor and its 25-year-old MIT graduate CEO, Michael Truell. Launched in 2023, Cursor achieved explosive growth, reaching over 10 billion USD in revenue by late 2025. However, its journey highlights a central dilemma for AI application companies: dependence on foundational model providers. Cursor initially relied heavily on Anthropic's models but faced an existential threat when Anthropic launched its own competing coding tool, Claude Code. In response, Cursor declared an internal emergency in early 2026 and accelerated development of its own model, Composer. To secure the immense computing power needed, Truell struck a pivotal deal with Elon Musk's SpaceX in April 2026. The collaboration grants Cursor access to SpaceX's supercomputing resources for Composer, while SpaceX's Grok model benefits from Cursor's programming data. The agreement includes a potential 600 billion USD acquisition of Cursor by SpaceX later in the year, though a substantial termination fee is in place if the deal falls through. The story explores Cursor's intense, sometimes controversial hiring practices involving lengthy unpaid "work trials," its complex partnership-turned-rivalry with Anthropic, and its high-stakes gamble to ensure independence through the SpaceX alliance. The core question remains: will Cursor evolve into a defining, independent "generational" software company, or become a key piece in a tech giant's AI arsenal?

marsbitHá 51m

Tying Itself to SpaceX: Cursor's $60 Billion Rise

marsbitHá 51m

Kraken Plans CFTC-Regulated Perpetual Futures For US Professional Traders

Kraken plans to launch CFTC-regulated perpetual futures for eligible US professional traders through its acquired derivatives exchange, Bitnomial. These contracts, featuring continuous pricing, no expiry, and regular funding, aim to provide a regulated domestic route to a product that is central to global crypto trading but has been largely inaccessible on US platforms. The offering is expected to be integrated into Kraken Pro, allowing traders to manage various exposures in one interface. Key factors for success will include eligibility criteria, contract design, and the development of sufficient liquidity. This move could pave the way for more regulated perpetual products in the US market.

bitcoinistHá 10h

Kraken Plans CFTC-Regulated Perpetual Futures For US Professional Traders

bitcoinistHá 10h

Warsh's Debut: Will the FED Chair Who Knows Crypto Best Bring Surprises or Shocks to the Market?

Kevin Warsh, the new Federal Reserve Chairman, prepares for his inaugural press conference amidst a challenging macroeconomic landscape: resurgent inflation, a bond market sell-off, and political pressure from President Trump for rate cuts. Uniquely, Warsh holds indirect investments in over 20 crypto and Web3 entities (e.g., Solana, dYdX), making him the first Fed Chair with disclosed crypto exposure. His stance may combine a hawkish, inflation-focused monetary policy with a crypto-friendly regulatory philosophy that shifts from Powell’s “same risk, same rule” approach toward a framework acknowledging blockchain’s productivity value. Warsh’s leadership could impact crypto markets across three dimensions: a paradigm shift in regulation (potentially accelerating pro-innovation legislation and stable币 rules), a re-pricing of risk premiums based on clearer communication and his view of AI as a structural disinflationary force, and a long-term reallocation of global institutional capital driven by increased legitimacy. Two potential scenarios for the press conference are outlined. A “positive surprise” would involve a dovish-leaning tone on rates coupled with signals of regulatory openness, potentially boosting crypto asset valuations. Conversely, a “negative shock” would see a more hawkish-than-expected stance on inflation and rates, triggering a broad risk-asset selloff that crypto markets would not escape. While ethics rules required Warsh to divest his crypto holdings upon confirmation, his deep understanding of the technology may fundamentally lower policy uncertainty and build a more receptive long-term foundation for digital assets’ integration into the mainstream financial system.

marsbitHá 11h

Warsh's Debut: Will the FED Chair Who Knows Crypto Best Bring Surprises or Shocks to the Market?

marsbitHá 11h

Trading

Spot
Futuros
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow