Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist

SecurityWeek reports that the Shai-Hulud 2.0 self-replicating worm, which initially hit the NPM registry in late November, is linked to an $8.5 million heist from Trust Wallet. Trust Wallet disclosed that hackers targeted users on version 2.68 of its Chrome browser extension, with malicious versions published on December 24 and users logging in between December 24 and 26 affected.

The incident affected 2,520 wallet addresses and drained about $8.5 million in assets, with funds tied to 17 attacker-controlled wallet addresses, and Trust Wallet says it will reimburse all affected users. The attackers leaked Trust Wallet’s Developer GitHub secrets, gaining access to the source code and the Chrome Web Store API key, enabling the publication of a backdoor extension outside the normal release process.

SecurityWeek notes that the Shai-Hulud 2.0 outbreak infected more than 640 NPM packages, and that Wiz observed a surge of over 25,000 data-leaking repositories at its peak, before broader eradication efforts took effect. According to Wiz, a major ongoing challenge is the continued exposure of critical infrastructure and AI credentials even after many tokens were revoked.