The Christmas Drain: How a Backdoor in Trust Wallet v2.68 Stole $7M

The Christmas Drain describes a supply-chain attack on Trust Wallet, with backdoor code injected into the v2.68.0 release to harvest users’ recovery phrases and allow attackers to drain wallets. According to SlowMist founder Yu Xian, the backdoored version included PostHog to collect highly sensitive data, with exfiltration to an attacker‑controlled server at hxxp://api.metrics-trustwallet[.]com.

Domain records show the domain was registered on 8 December 2025, and the backdoor was implanted by 22 December, after which the attackers remained dormant until 25 December when funds began moving. The developer issued an emergency fix to v2.69.0, and the article notes that at the time of writing the stolen value exceeds $6 million, with the final scale of losses yet to be determined; the headline, however, claims $7 million.

It also recalls a prior incident in November 2022 when wallets created during that period suffered losses of about $170,000, which Trust Wallet fully reimbursed.