Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack

Trust Wallet says a second wave of the Shai-Hulud supply chain attack in November 2025 was likely responsible for the hack of its Google Chrome extension, resulting in about $8.5 million in assets being drained. The incident followed the exposure of developer GitHub secrets that gave the attacker access to the extension’s source code and the Chrome Web Store API key, enabling fraudulent builds to be uploaded without Trust Wallet’s standard release process, according to Trust Wallet.

The attacker then registered the domain metrics-trustwallet[.]com and pushed a trojanised extension with a backdoor capable of harvesting users’ wallet mnemonic phrases. The breach coincided with a December 24, 2025 malicious update (version 2.68) pushed by unknown threat actors, after which Trust Wallet urged affected users to update to version 2.69.

In total, around 2,520 wallet addresses were drained to no less than 17 attacker-controlled wallets, with the first wallet-draining activity reported a day after the malicious update, and Trust Wallet has since initiated a reimbursement process while increasing monitoring around its release practices.