Trust Wallet is urging users to update its Google Chrome extension to the latest version following what it described as a "security incident" that led to the loss of approximately $7 million.
The issue, the multi‑chain, non‑custodial cryptocurrency wallet service said, impacts version 2.68. The extension has about one million users, according to the Chrome Web Store listing. Users are advised to update to version 2.69 as soon as possible.
"We've confirmed that approximately $7M has been impacted and we will ensure all affected users are refunded," Trust Wallet said in a post on X. "Supporting affected users is our top priority, and we are actively finalizing the process to refund the impacted users."
Trust Wallet is also urging users to refrain from interacting with any messages that do not come from its official channels. Mobile-only users and all other browser extension versions are not affected.
According to details shared by SlowMist, version 2.68 introduced malicious code that's designed to iterate through all wallets stored in the extension and trigger a mnemonic phrase request for each wallet.
"The encrypted mnemonic is then decrypted using the password or passkeyPassword entered during wallet unlock," the blockchain security firm said. "Once decrypted, the mnemonic phrase is sent to the attacker's server api.metrics-trustwallet[.]com."
The domain "metrics-trustwallet[.]com" was registered on December 8, 2025, with the first request to "api.metrics-trustwallet[.]com" commencing on December 21, 2025.
Further analysis has revealed that the attacker has leveraged an open‑source full‑chain analytics library named posthog-js to harvest wallet user information.
The digital assets drained so far include about $3 million in Bitcoin, $431 in Solana, and more than $3 million in Ethereum. The stolen funds have been moved through centralized exchanges and cross-chain bridges for laundering and swapping. According to an update shared by blockchain investigator ZachXBT, the incident has claimed hundreds of victims.
"While ~$2.8 million of the stolen funds remain in the hacker's wallets (Bitcoin/ EVM/ Solana), the bulk – >$4M in cryptos – has been sent to CEXs [centralized exchanges]: ~$3.3 million to ChangeNOW, ~$340,000 to FixedFloat, and ~$447,000 to KuCoin," PeckShield said.
"This backdoor incident originated from malicious source code modification within the internal Trust Wallet extension codebase (analytics logic), rather than an injected compromised third‑party dependency (e.g., malicious npm package)," SlowMist said.
"The attacker directly tampered with the application's own code, then leveraged the legitimate PostHog analytics library as the data‑exfiltration channel, redirecting analytic traffic to an attacker‑controlled server."
The company said there is a possibility that it's the work of a nation-state actor, adding the attackers may have gained control of Trust Wallet‑related developer devices or obtained deployment permissions prior to December 8, 2025.
Changpeng Zhao, a co-founder of crypto exchange Binance, which owns the utility, hinted that the exploit was "most likely" carried out by an insider, although no further evidence was provided to support the theory.
Update
Trust Wallet, in a follow-up update, has urged affected users to complete a form on their support desk at "trustwallet-support.freshdesk[.]com" to start the compensation process. Victims have been asked to provide their contact email address, country of residence, compromised wallet address(es), the address to which the funds were drained to, and the corresponding transaction hashes.
"We are seeing scams via Telegram ads, fake 'compensation' forms, impersonated support accounts, and DMs," the company cautioned. "Always verify links, never share your recovery phrase, and use official Trust Wallet channels only."
Eowyn Chen, Trust Wallet's CEO, said an investigation into the incident is underway, reiterating that the issue impacts only Chrome browser extension version 2.68 users who logged in and before December 26, 2025, 11 a.m. UTC.
"The malicious extension v2.68 was NOT released through our internal manual process," Chen said. "Our current findings suggest it was most likely published externally through the Chrome Web Store API key, bypassing our standard release checks."
"The hacker used a leaked Chrome Web Store API key to submit the malicious extension version v2.68. This successfully passed the Chrome Web Store's review and was released on December 24, 2025, at 12:32 p.m. UTC."
Following the discovery of the breach, Chen said the company has taken the step of suspending the malicious domain, expiring all release APIs, and processing reimbursement for affected victims.
(The story was updated after publication to reflect the latest developments.)
