Trust Wallet confirms second Shai-Hulud supply-chain attack, $8.5M in crypto stolen

Trust Wallet says a second Shai-Hulud supply-chain attack likely compromised its Chrome extension, resulting in the theft of about $8.5M in crypto. The investigation found that the attacker independently developed and published a malicious Trust Wallet extension (v2.68) using a leaked Chrome Web Store API key, likely linked to the November Sha1-Hulud supply-chain incident.

After that prior event, Trust Wallet’s developer GitHub secrets were exposed, enabling access to the browser extension source code and the Chrome Web Store API key, which allowed the attacker to upload tampered builds without standard release controls.

In December, the attacker registered a malicious domain and published version 2.68 via the leaked key, with wallet-draining activity reported on December 25, prompting alerts, wallet tracking, DDoS mitigation by white hats, a rollback to a clean version, user warnings, and a reimbursement process.

Security firm Koi disclosed that the malicious code in extension v2.68 exfiltrates data on every unlock, not just during seed phrase import, and that seed phrases were embedded in an “errorMessage” field to evade casual checks. Trust Wallet subsequently rolled back to a verified version (2.67 released as 2.69), blocked publishing access, and began coordinating with analytics partners to reimburse affected users.