Hundreds of Wallets Targeted in Ongoing Cross-Chain Attack, ZachXBT Reports

An ongoing cross-chain exploit is draining hundreds of crypto wallets across various EVM-compatible blockchains, with losses surpassing $107,000 and continuing to rise. Blockchain investigator ZachXBT has raised awareness about this situation, indicating that the victims are losing smaller amounts per wallet, generally under $2,000, while the underlying cause remains uncertain. This alarming trend follows a troubling December for crypto security, characterized by numerous significant exploits.

Key Takeaways

A cross-chain exploit is currently draining hundreds of crypto wallets, with losses over $107,000.
ZachXBT has urged victims of this attack to report their losses.
The attack mimics patterns seen in recent high-profile hacks, suggesting sophisticated multi-chain strategies.
A separate incident involving Trust Wallet highlights broader vulnerabilities within the industry.
Experts warn of a shift in attack methods targeting operational security rather than just smart contract vulnerabilities.

Ongoing Cross-Chain Attack Overview

ZachXBT has detected a significant exploit affecting numerous wallets across EVM-compatible blockchains. As of early Friday morning, losses have climbed to over $107,000 with a continuing threat to users’ assets. The investigation revealed that victims typically lose modest amounts—generally less than $2,000—while the source of the issue remains unidentified.

The coordinated nature of this attack follows a troubling month for cryptocurrency security, as evidenced by $76 million being stolen across 26 notable exploits in December alone. This included a $50 million address poisoning scam and a breach of Trust Wallet that led to the loss of roughly $7 million.

Ongoing Cross-Chain Attack - ZachXBT Announcement

Uncovering the Attack Pattern Across Multiple Blockchains

The blockchain investigator uncovered a suspicious address (0xAc2***9bFB) believed to be associated with the thefts targeting EVM chains. As more victims present themselves, ZachXBT is compiling verified addresses to aid in the investigation and has encouraged those affected to reach out directly via X (formerly known as Twitter).

This distributed attack shares similarities with tactics used in prominent recent incidents, where attackers opt to exploit several smaller wallets instead of targeting a single large asset. This method often prevents early detection while allowing for a more extensive extraction of funds from compromised accounts.

Security experts indicate that the cross-chain method of this attack suggests a high level of sophistication, with attackers operating simultaneously across different blockchains, siphoning off funds before victims can respond. The methodology is reminiscent of recent address-poisoning schemes and private-key compromises that have challenged the ecosystem in the past few months.

Trust Wallet Breach Exposes Broader Security Issues

The warning from ZachXBT comes just days after issues surfaced for Trust Wallet users, where the company had to temporarily remove its Chrome extension from the Chrome Web Store. This decision delayed the availability of a vital claims verification tool for those affected by a Christmas Day hack. Trust Wallet CEO Eowyn Chen shared that Google had identified a technical glitch during the new version release.

"We understand how concerning this is, and our team is actively working on it," Trust Wallet remarked after discovering 2,520 drained wallet addresses linked to around $8.5 million in stolen assets distributed across 17 wallets controlled by the attackers.

The breach on December 25 originated from a malicious version of Trust Wallet’s browser extension that masqueraded as legitimate, passing through Chrome’s review system but concealing harmful code that extracted sensitive recovery phrases. Users who installed this compromised version between December 24 and 26 faced immediate outflows of assets across several blockchains, including Ethereum, Bitcoin, and Solana.

Trust Wallet traced the breach to a wider supply-chain attack named Sha1-Hulud, which emerged in November and compromised several firms through exposed GitHub secrets and a leaked Chrome Web Store API key. This attack successfully bypassed internal approval checks, allowing attackers to directly upload malicious code that appeared valid to both automated security measures and human reviewers.

The Human-Layer Security Crisis in the Crypto Industry

Mitchell Amador, CEO of Immunefi, warns that the cryptocurrency sector is at a critical security juncture as attack strategies increasingly target operational vulnerabilities instead of solely focusing on smart contract flaws.

"The threat landscape is shifting from on-chain code vulnerabilities to operational security and treasury-level attacks," he stated during an interview with Cryptonews. Despite a 60% decline in hack losses in December, totaling $76 million compared to November’s $194.2 million, security specialists assert that persistent threats remain pervasive.

"Crypto is facing a security reckoning," Amador emphasized, noting that many hacks this year occurred not due to inadequate audits, but emerged after launches, during protocol updates, or as a result of integration vulnerabilities.

The blockchain security firm PeckShield reported 26 significant exploits in December, with address-poisoning scams and private-key leaks causing substantial losses. One user lost $50 million by accidentally copying a fraudulent address similar to their legitimate destination. Another incident involved a private key leak linked to a multi-signature wallet, leading to approximately $27.3 million in losses.

The industry's vulnerability encompasses not just technical exploits, but also social engineering schemes, exemplified by Brooklyn resident Ronald Spektor, who faces charges for allegedly defrauding around 100 Coinbase users of $16 million by impersonating company workers.