The Christmas Heist: How Shai-Hulud Hijacked Trust Wallet for an $8.5M Score

The Christmas Heist reveals that Trust Wallet, a Binance-owned non-custodial wallet, was compromised through an NPM supply-chain attack orchestrated by a hacking group known as Shai-Hulud. Attackers replaced the Trust Wallet listing in the Google Chrome Web Store with a backdoored extension, enabling them to harvest seed phrases from wallets by December 25, 2025.

They gained access to the extension’s source code and Google Chrome Web Store API keys, allowing them to publish malicious updates without the Trust Wallet team's review process. By Christmas Day, the first confirmed wallet thefts were reported, with security researchers identifying the anomaly and tracing attacker wallet addresses, and white-hat efforts disrupting the attackers’ domains to limit further losses.

In total, around $8.5 million in cryptocurrency was stolen, though Binance has stepped in to cover losses and ensure affected users receive full compensation. The attackers also registered a new domain, metrics.trustwallet[.]com, in December 2025 to host infrastructure later used by the backdoored extension. According to Security researchers 0xAkinator and ZachXBT, the incident underscores the broad impact of supply-chain compromises in crypto ecosystems.