Trust Wallet Hit by Malicious Update, $7M Stolen — What Happened and What Users Should Do Now

Key Takeaways

• The Trust Wallet Chrome extension was compromised by malicious code in a recent update.
• Users who imported seed phrases into version 2.68 lost an estimated $6–7 million.
• Binance has said affected users will be fully reimbursed through its SAFU fund.

What should have been a quiet Christmas night turned into a nightmare for hundreds of Trust Wallet users, after a malicious update to the wallet’s Chrome extension exposed private keys and led to millions of dollars in stolen crypto.

The issue surfaced late on Dec. 25, when users began reporting that their wallets had been drained shortly after importing their recovery phrases into Trust Wallet’s browser extension.

By the time the dust settled, losses were approaching $7 million, according to Binance founder Changpeng Zhao (CZ).

Try Our Recommended Crypto Exchanges

Sponsored

Disclosure

We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.

XM.com

promotions

Get 100% Bonus up to $100 on your first Deposit.

Coins

28

• 
  Bitcoin
• 
  Ethereum
• 
  Ripple
• 
  Solana
• 
  Dogecoin
• 
  Cardano
• 
  Litecoin
• 
  Stellar
• 
  Bitcoin Cash
• 
  Avalanche
• 
  Shiba Inu
• 
  Polkadot
• 
  Chainlink
• 
  Enjin Coin
• 
  Polygon Ecosystem Token
• 
  SushiSwap
• 
  Ethereum Classic
• 
  Uniswap
• 
  Filecoin
• 
  Axie Infinity
• 
  Aave
• 
  Algorand
• 
  Tezos
• 
  Synthetix
• 
  The Sandbox
• 
  The Graph
• 
  Internet Computer
• 
  Basic Attention Token
• 
  APEcoin
• 
  Arbitrum
• 
  NEAR Protocol
• 
  Storj
• 
  Cosmos

No result

Claim Offer

Bitunix

promotions

Receive up to $100,000 worth of exclusive gifts for newcomers upon registration.

Coins

151

• 
  Bitcoin
• 
  Ethereum
• 
  Tether
• 
  USD Coin
• 
  Solana
• 
  Ripple
• 
  Dogecoin
• 
  Cardano
• 
  Toncoin
• 
  Shiba Inu
• 
  Avalanche
• 
  TRON
• 
  Chainlink
• 
  Polygon Matic
• 
  Polkadot
• 
  Wrapped Bitcoin
• 
  Litecoin
• 
  Dai
• 
  NEAR Protocol
• 
  Bitcoin Cash
• 
  Stellar
• 
  Cosmos
• 
  Filecoin
• 
  Ethereum Classic
• 
  Aptos
• 
  Hedera Hashgraph
• 
  Immutable
• 
  Optimism
• 
  Arbitrum
• 
  VeChain
• 
  The Sandbox
• 
  Decentraland
• 
  Axie Infinity
• 
  Injective Protocol
• 
  Render
• 
  The Graph
• 
  Maker
• 
  Aave
• 
  Chiliz
• 
  Helium
• 
  PAX Gold
• 
  Compound
• 
  Lido DAO Token
• 
  Sui
• 
  Conflux Network
• 
  Lido Staked ETH
• 
  OKB
• 
  Uniswap
• 
  Pepe
• 
  Ondo
• 
  Mantle
• 
  First Digital USD
• 
  XDC Network
• 
  Artificial Superintelligence Alliance
• 
  Jupiter
• 
  Quant
• 
  Worldcoin
• 
  Bonk
• 
  Tether Gold
• JITO
• 
  JasmyCoin
• 
  Core
• 
  Floki Inu
• 
  Ethereum Name Service
• 
  SushiSwap
• 
  1inch Network
• 
  Tezos
• 
  Algorand
• 
  Flow
• 
  Trust Wallet Token
• 
  Curve DAO Token
• 
  MultiversX
• 
  Basic Attention Token
• 
  Enjin Coin
• 
  Ethena
• 
  Ethena Staked USDe
• 
  Audius
• 
  Alchemy Pay
• 
  Arkham
• 
  API3
• 
  Bounce Token
• 
  Altlayer
• 
  Aergo
• 
  Amp
• 
  Aevo
• 
  Ankr
• 
  Axelar
• 
  Alpaca Finance
• 
  Blur
• 
  Biconomy
• 
  Tranchess
• 
  Celer Network
• 
  Shentu
• 
  Civic
• 
  Convex Finance
• 
  Cartesi
• 
  Cyber
• 
  COTI
• 
  DIA
• 
  dYdX
• 
  ether.fi
• 
  FLUX
• 
  Ampleforth
• 
  Golem
• 
  Holo
• 
  Illuvium
• 
  JUST
• 
  Livepeer
• 
  Memecoin
• 
  Manta Network
• 
  Treasure
• 
  Mask Network
• 
  Origin Protocol
• 
  ORDI
• 
  Ontology
• 
  Phala Network
• 
  Pendle
• 
  Portal
• 
  Pyth Network
• 
  ConstitutionDAO
• 
  iExec RLC
• 
  Reserve Rights
• 
  Ravencoin
• 
  Storj
• 
  Status
• 
  Spell Token
• 
  Sun (New)
• 
  SuperVerse
• 
  Tellor
• 
  LayerZero
• 
  Scroll
• 
  Usual
• 
  Eigenlayer
• 
  Hamster Kombat
• 
  Catizen
• 
  Berachain
• 
  KAITO
• 
  Pudgy Penguins
• 
  Solayer
• 
  Bio Protocol
• 
  ChainGPT
• 
  Cookie DAO
• 
  Solv Protocol
• 
  Movement
• 
  DeXe
• 
  Nexo
• 
  Hyperliquid
• 
  STEPN
• 
  Synthetix
• 
  Neo
• 
  APEcoin
• 
  Gala
• 
  Internet Computer
• 
  Pi Network
• 
  IoTex
• 
  Build'N'Build

No result

Claim Offer

Bitget

promotions

Earn rewards worth up to 5,000 USDT on your first deposit

Coins

88

• 
  Bitcoin
• 
  Ethereum
• 
  Tether
• 
  Litecoin
• 
  Bitcoin Cash
• 
  TRON
• 
  Ripple
• 
  Cardano
• 
  Binance USD
• 
  USD Coin
• 
  Polkadot
• 
  Shiba Inu
• 
  Basic Attention Token
• 
  Qtum
• 
  Ethereum Classic
• 
  Chainlink
• 
  Solana
• 
  Polygon Matic
• 
  Cosmos
• 
  Wrapped Bitcoin
• 
  PancakeSwap
• 
  The Sandbox
• 
  Storj
• 
  iExec RLC
• 
  Bancor
• 
  Uniswap
• 
  Enjin Coin
• 
  1inch Network
• 
  Chiliz
• 
  Aave
• 
  Synthetix
• 
  Maker
• 
  Compound
• 
  Theta Network
• 
  Celo
• 
  Curve DAO Token
• 
  Decentraland
• 
  JUST
• 
  Axie Infinity
• 
  Gala
• 
  Internet Computer
• 
  The Graph
• 
  Filecoin
• 
  dYdX
• 
  Mask Network
• 
  Lido DAO Token
• 
  Reserve Rights
• 
  Chromia
• 
  Ankr
• 
  Ocean Protocol
• 
  Adventure Gold
• 
  Origin Protocol
• 
  Celer Network
• 
  NKN
• 
  Bitget Token
• 
  Alchemix
• 
  Immutable
• 
  Ethereum Name Service
• 
  Avalanche
• 
  Zilliqa
• 
  JasmyCoin
• 
  Toncoin
• 
  Convex Finance
• 
  Spell Token
• 
  Holo
• 
  Render Token
• 
  SushiSwap
• 
  MetisDAO
• 
  Audius
• 
  Illuvium
• 
  ARPA Chain
• 
  Osmosis
• 
  Fantom
• 
  Neo
• 
  Arweave
• 
  Algorand
• 
  Kusama
• 
  XDC Network
• 
  APEcoin
• 
  MultiversX
• 
  THORChain
• 
  NEAR Protocol
• 
  Nexo
• 
  Amp
• 
  Livepeer
• 
  PAX Gold
• 
  TrueUSD
• 
  BitTorrent
• 
  Golem
• 
  FLUX
• 
  Helium
• 
  Dai
• 
  Build'N'Build

No result

Claim Offer

Trust Wallet Hack: What Went Wrong

The breach was traced to Trust Wallet’s Chrome extension version 2.68.

Users who installed the update and imported their seed phrases unknowingly handed attackers the keys to their wallets.

Investigators later determined that the incident was the result of a supply-chain attack.

Malicious code had been quietly slipped into the extension’s JavaScript files, disguised as routine analytics functionality.

When users imported their recovery phrases, the code activated and transmitted sensitive wallet data to a domain controlled by the attacker.

Because the exploit ran silently in the background, there were no obvious warning signs.

Victims didn’t click phishing links or approve suspicious transactions. In many cases , funds disappeared almost immediately after the wallet was restored.

The attacker-controlled domain was registered shortly before the exploit went live and has since been taken offline.

Trust Wallet Responds

Trust Wallet said the vulnerability was limited to the Chrome browser extension and did not affect its mobile apps or the underlying blockchains themselves.

A patched version, 2.69, was released shortly after the issue was identified.

“We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69.”

Users were urged to disable the affected version immediately and update before reopening the extension.

Anyone who imported a seed phrase into version 2.68 has been advised to assume that the wallet is compromised.

While the investigation is still ongoing, early findings suggest the attack targeted the extension’s update process rather than Trust Wallet’s core infrastructure.

It’s the kind of breach that’s become increasingly common as crypto wallets rely more heavily on third-party tooling and browser environments.

Will Users Be Reimbursed? 

CZ confirmed that Binance will cover the losses using its Secure Asset Fund for Users (SAFU), saying affected users would be fully reimbursed.

“So far, $7 million has been affected by this hack. Trust Wallet will cover. User funds are SAFU. Appreciate your understanding for any inconveniences caused. The team is still investigating how hackers were able to submit a new version.”

On-chain investigators, including ZachXBT , traced more than $6 million in early losses, with individual users reporting everything from a few thousand dollars gone to much larger balances wiped out.

What Users Should Do Now

Security experts advise that anyone who interacted with the compromised version should transfer funds to a new wallet immediately and never reuse the exposed seed phrase.

Revoking existing approvals tied to affected addresses is also strongly recommended.

The incident has reignited debate around browser-based wallets, which offer convenience but come with added risk, especially during updates.

Many security professionals continue to recommend that users with larger balances rely on hardware wallets, which store private keys offline.

For Trust Wallet users, the timing couldn’t have been worse.

However, the episode serves as a stark reminder of a harsh truth in crypto: the blockchain itself may be resilient, but the software people use to access it remains a frequent point of failure.

As the industry heads into 2026, the Trust Wallet breach adds to a growing list of supply-chain attacks—and a reminder that even trusted tools can become liabilities overnight.