Trust Wallet Chrome Extension Breach Caused $7 Million Crypto Loss via Malicious Code

Trust Wallet has urged users to update its Chrome extension to the latest version after what it described as a security incident that led to the loss of approximately $7 million. The issue affects version 2.68, with the firm advising users to upgrade to version 2.69; the extension lists about one million users on the Chrome Web Store.

According to SlowMist, version 2.68 introduced malicious code that iterates through all wallets stored in the extension to request mnemonic phrases, which are then exfiltrated to an attacker‑controlled server via a decrypted mnemonic. The attackers registered the domain metrics-trustwallet[.]com on 8 December 2025, with the first request to api[.]metrics-trustwallet[.]com beginning on 21 December 2025, and they leveraged the PostHog analytics library as the data‑exfiltration channel.

The stolen assets include about $3 million in Bitcoin, $431 in Solana, and more than $3 million in Ethereum, with funds moving to centralised exchanges and cross‑chain bridges for laundering; PeckShield and others have flagged hundreds of victims. The investigation notes the backdoor originated from malicious internal code rather than a compromised third‑party dependency, and there is a possibility the attackers were nation‑state‑linked or insiders, though no conclusive evidence is provided.