Trust Wallet Browser Extension Hacked: Over $6 Million in User Funds Compromised

Trust Wallet, a multi-chain crypto wallet provider, has confirmed a serious security breach that led to the loss of more than $6 million from user funds. This incident primarily impacted users who had downloaded the latest version of the Trust Wallet browser extension.

Key Takeaways

Trust Wallet confirmed a security breach impacting the Browser Extension version 2.68.
Users installing version 2.68 saw unauthorized withdrawals, with losses exceeding $6 million.
Affected cryptocurrencies included SOL, BTC, and other EVM tokens.
Users are advised to disable the compromised extension and upgrade to version 2.69 immediately.

Trust Wallet Hack

Trust Wallet Users Report Unapproved Withdrawals

On Christmas Day, numerous Trust Wallet users noticed that their funds had been withdrawn from their accounts within a very short period. One user expressed their frustration on X, stating they had lost over $300,000 right after the holiday, saying, “Everything I’ve been building for. Stolen on Christmas Day.” The transactions occurred in just a four-minute span, though ZachXBT flagged this user’s X account as suspicious.

Victims reported that various blockchains, including EVM-compatible networks, Bitcoin, and Solana, were affected by this breach.

What Happened?

Trust Wallet rolled out an update to its browser extension on Wednesday, which users installed via the standard updating process. Initially, the extension seemed legitimate. However, hackers disguised the code address to extract users' seed phrases, leading to a quick draining of their wallets.

One user warned, “Reports indicate that importing a seed phrase into the extension can result in immediate wallet draining.” Browser extensions have high-level access to web pages, cookies, storage, and user activity. When exploited, they create an ideal pathway for credential theft without triggering conventional security measures.

Several reports have recently emerged highlighting threats related to wallet extensions. According to HackerNews, over 40 fraudulent crypto wallet extensions were stealing users’ keys and IP addresses earlier this year.

Trust Wallet has assured users that those on mobile-only versions and other browser extension versions have not been affected by this breach.

In a communication shared on X, the Trust Wallet team stated, “We understand how concerning this is, and our team is actively working on the issue. We’ll keep sharing updates as soon as possible.” Furthermore, they noted that customer support is already reaching out to impacted users to discuss the next steps.