Trust Wallet identified 2,520 affected wallet addresses and approximately $8.5 million in stolen crypto assets. Subsequent investigations provided a clearer picture of how the compromised extension was distributed and how the attacker obtained access to users\u2019 funds.\u00a0<\/span><\/p>\n On December 24, 2025, an unauthorized version of the Trust Wallet browser extension – version 2.68 – was published on the Chrome Web Store. It contained malicious code designed to extract users\u2019 decrypted seed phrases, from which the corresponding private keys could be derived.\u00a0<\/span><\/p>\n Unlike a conventional phishing attack, which relies on tricking users into approving malicious transactions, the code operated directly inside the compromised extension. When users opened the extension and logged into their wallets between December 24 and December 26, the malicious code collected sensitive wallet information and transmitted it to a server controlled by the attacker. This allowed the attacker to access the affected wallets and transfer funds without any further approval from their owners.<\/span><\/p>\n The first public signs of the attack emerged on D<\/span>ecember 25, when blockchain researchers, <\/span>including ZachXBT, <\/span><\/a>identified a series of suspicious transfers from Trust Wallet addresses. Trust Wallet subsequently acknowledged the incid<\/span>ent, released version 2.69 and instructed users to stop using version 2.68.<\/span><\/p>\n Trust Wallet later linked the incident with high confidence to the industry-wide<\/span> Sha1-Hulud supply-chain attack<\/b> of November 2025<\/span><\/a>. Rather than exploiting a vulnerability in the wallet itself or tricking individual users, the attackers compromised systems used in Trust Wallet\u2019s software-development process.<\/span><\/p>\n The Sha1-Hulud campaign targeted companies through compromised npm packages – reusable pieces of JavaScript code used by software developers. According to Trust Wallet, the attack exposed developer credentials stored on GitHub, giving the attackers access to the browser extension\u2019s source code and its Chrome Web Store publishing key.<\/span><\/p>\n Using this access, the attackers prepared a modified version of the extension and submitted it to the Chrome Web Store outside Trust Wallet\u2019s normal release process. They also registered their own domain to host the malicious code embedded in the extension. The modified version passed the Chrome Web Store\u2019s review but bypassed Trust Wallet\u2019s internal review and approval procedures.<\/span><\/p>\n The attack was limited to users of one specific browser extension version during a relatively short period.<\/span><\/p>\n Users were potentially affected if they:<\/span><\/p>\n According to Trust Wallet, the following users were not affected:<\/span><\/p>\n Trust Wallet ultimately identified <\/span>2,520 affected wallet addresses<\/b>, from which approximately <\/span>$8.5 million in crypto assets<\/b> was stolen. The funds were linked to <\/span>17 addresses controlled by the attackers<\/b>.<\/span><\/p>\n Trust Wallet noted that the 17 attacker-controlled addresses had also received assets stolen from wallets unrelated to the Trust Wallet incident.\u00a0 Not all activity involving them could therefore be attributed to this particular attack.<\/span><\/p>\n Separate on-chain analysis by Scorechain found that the stolen assets were quickly divided among multiple intermediary wallets. Some of the funds were then moved through swap services and across different blockchains, making their subsequent movement more difficult to trace.<\/span><\/p>\n After confirming the breach, Trust Wallet rolled back the compromised extension to a verified clean version and released it as v2.69. Users who had logged in through v2.68 during the affected period were advised to transfer any remaining assets to a newly created wallet with a new seed phrase. <\/span>Any wallet exposed through the compromised extension had to be considered permanently unsafe.<\/b><\/p>\n Trust Wallet also committed to reimbursing affected users and introduced a claims process requiring applicants to prove ownership of the compromised wallets. By its latest published update in July 2026, reviews were still being handled individually. The company had received more than 5,000 claims relating to 2,520 confirmed affected addresses, indicating that many submissions were duplicates or potentially fraudulent.<\/span><\/p>\n Following the incident, Trust Wallet said it had revoked the exposed publishing credentials, restricted deployment permissions and strengthened its controls around software releases, access management, monitoring and incident response.<\/span><\/p>\n What makes this incident notable is that users were compromised through an official software update. They did not need to disclose their seed phrases, visit a phishing website or approve fraudulent transactions. Simply opening and unlocking the compromised extension was enough to expose their wallet credentials.<\/span><\/p>\n The incident provides a real-world example of the supply-chain risks discussed in our<\/span> earlier examination of the 2025 npm attacks<\/span><\/a>. The attacker did not need to break Trust Wallet\u2019s cryptography or target thousands of users individually. By obtaining developer credentials and access to the release process, malicious software could be distributed under Trust Wallet\u2019s name through the official Chrome Web Store.<\/span><\/p>\n For users, the broader lesson is that self-custody does not eliminate software risk. Browser extensions and other hot wallets rely on internet-connected devices, software updates and development systems – any of which may become compromised. They are useful for everyday transactions, but significant long-term holdings are better isolated behind a hardware wallet that keeps the private keys offline and allows transaction details to be verified independently.<\/span><\/p>\n Once again: software and browser wallets should hold little more than pocket money – if anything. As convenient as these tools may be, they are equally convenient targets for threat actors seeking to steal your money. The sheer number of potential software vulnerabilities means that no internet-connected device should ever be considered fully secure. The vast majority of successful crypto thefts from individuals involve precisely these kinds of hot wallets.\u00a0<\/span><\/p>\n As a practical rule of thumb, once you hold more than approximately <\/span>$1,000 in crypto assets<\/b>, procure and utilize a dedicated hardware wallet. This keeps your private keys and transaction signing capabilities inside a separate device rather than on your internet-connected computer or phone, where malware may be able to access and steal your wallet contents.\u00a0<\/span><\/p>\n Modern hardware wallets are relatively affordable and straightforward to use. Entry-level devices such as <\/span>the <\/span>Trezor Safe 3<\/b><\/a> or <\/b>Ledger Nano S Plus<\/b><\/a> p<\/span>rovide everything most users nee<\/span>d. <\/span>Premium<\/span><\/a> models<\/span><\/a> offer larg<\/span>er touchscreens, improved ergonomics and additional convenience features, but an entry-level device is perfectly adequate for establishing the essential separation.<\/span><\/p>\n Whichever model you choose, always <\/span>verify the destination address and transaction details on the hardware wallet\u2019s own screen<\/span><\/a>. A <\/span>hardware wallet can prevent a compromised computer from extracting your private keys, but it cannot protect you if you approve a malicious transaction without checking it.<\/span><\/p>\n If you\u2019re based in – or visiting – Vietnam, our colleagues at BitcoinVN Shop offer a wide selection of genuine hardware wallets from leading manufacturers, including <\/span>Trezor, Ledger and Keystone<\/span><\/a>. Buying locally avoids the hassle, delays and uncertainty often involved in importing a device yourself.<\/span><\/p>\n Orders can also be collected directly from our Saigon headquarters or <\/span>Da Nang showroom<\/span><\/a>. This allows you to avoid attaching your name and home address to the delivery of your device – an option we strongly encourage as part of our data-minimization approach.<\/span><\/p>\n Furthermore, the shop also offers <\/span>\u201cdisaster-proof\u201d steel backup plates<\/span><\/a> for securely recording your seed phrase. Unlike paper or digital backups, these are designed to withstand fire, flooding and other forms of physical damage.<\/span><\/p>\n If you would like to get serious about protecting your digital assets, our team has accumulated more than a decade of experience in securing and storing them. As one of the <\/span>world\u2019s longest-running crypto exchanges<\/span><\/a>, we are also – in many ways by necessity – daily \u201cin the trenches,\u201d analyzing and defending against emerging cyber threats.<\/span><\/p>\n As a result, we have built considerable expertise, which you can access through our <\/span>personal, one-to-one self-custody consulting service<\/span><\/a>.<\/span><\/p>\n One of our senior cybersecurity team members will walk you through the process, answer your questions and discuss a setup that works for your personal circumstances. We will help ensure that you avoid the common pitfalls that can lead to a loss of funds when taking on the freedom – but also the responsibility –\u00a0 that comes with self-custodial crypto holdings.<\/span><\/p>\n Once you have \u201cmade it\u201d – and most likely de-risked your digital-asset holdings by allocating a significant share of your personal portfolio to \u201cboring but predictable\u201d Bitcoin – a simple single-signature setup is no longer good enough.<\/span><\/p>\nTimeline of the Trust Wallet Browser Extension v2.68 Incident<\/b><\/h2>\n
![\"The](\"https:\/\/bitcoinvn.io\/insights\/wp-content\/uploads\/2026\/09\/trust-wallet-hack-5.webp\")
How the Attack Happened<\/b><\/h2>\n
![\"\"](\"https:\/\/bitcoinvn.io\/insights\/wp-content\/uploads\/2026\/09\/trust-wallet-hack-2.webp\")
<\/p>\nWho Was Affected?<\/b><\/h2>\n
\n
\n
Losses reach up to $8.5 million\u00a0<\/b><\/h2>\n
How Trust Wallet Responded<\/b><\/h2>\n
Lessons from the Trust Wallet Hack<\/b><\/h2>\n
![\"\"](\"https:\/\/bitcoinvn.io\/insights\/wp-content\/uploads\/2026\/09\/trust-wallet-hack-4.webp\")
<\/p>\nHow to harden your personal self-custody setup<\/b><\/h2>\n
![\"Investing](\"https:\/\/bitcoinvn.io\/insights\/wp-content\/uploads\/2026\/09\/trust-wallet-hack-6.webp\")
![\"\"](\"https:\/\/bitcoinvn.io\/insights\/wp-content\/uploads\/2026\/09\/trust-wallet-hack-3.webp\")
<\/p>\nAccess Qualified Assistance Securing Your Digital Assets<\/b><\/h2>\n
Securing large amounts of Bitcoin – Multivendor Multisig a Must<\/b><\/h2>\n