Loading story…
A compromised update to the Trust Wallet Chrome extension, version 2.68.0 released on December 24, resulted in the theft of over $7 million in cryptocurrency from hundreds of users. Attackers injected malicious JavaScript code, disguised as analytics, which activated when users imported their seed phrases, exfiltrating sensitive wallet data to a domain mimicking Trust Wallet's infrastructure. The attack was first flagged by blockchain investigators and security researchers, who noted that only desktop extension users were affected, while the mobile app remained secure. Trust Wallet responded by releasing an urgent warning and a subsequent extension update, while security firms highlighted the likely supply-chain nature of the compromise.
In parallel to the direct compromise, threat actors launched phishing campaigns using domains such as fix-trustwallet.com, luring affected users with promises of a vulnerability fix but instead further draining their wallets. The incident underscores the risks of supply-chain attacks on browser extensions and the sophistication of attackers, who combined technical compromise with social engineering to maximize their haul. Security analysts and blockchain investigators continue to monitor the situation, advising users to avoid the Chrome extension until further notice and to remain vigilant against related phishing attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said the Trust Wallet compromise stole about $8.5 million from more than 2,500 wallets. The updated assessment accompanied stronger attribution to the Shai-Hulud campaign and ongoing remediation measures.
In early January, Trust Wallet said the incident was tied to the broader Shai-Hulud npm supply-chain attack. It reported that leaked developer GitHub secrets and a Chrome Web Store API key enabled attackers to bypass release controls and publish the malicious extension.
By December 29, Trust Wallet said the attack had drained 2,596 wallets and stolen roughly $7 million in cryptocurrency. The company said it had begun reimbursing affected users while verifying claims to prevent fraud.
Following public confirmation of the breach, Trust Wallet said it would refund affected users, and Binance founder Changpeng Zhao said impacted funds would be covered. The company also warned users to move assets to new wallets with fresh seed phrases.
Independent researchers including Akinator and Andrew Mohawk confirmed the presence of the malicious code and its data theft function. Additional analysis said the backdoor was inserted into Trust Wallet's own codebase rather than a third-party dependency.
Trust Wallet publicly confirmed that only Chrome extension version 2.68.0 was compromised and advised users to update immediately to version 2.69. It also said mobile users and other extension versions were not affected.
After the attack was discovered on December 25, Trust Wallet rolled back to a clean version and began emergency response actions. The company later said it expired release APIs and reported the exfiltration domain to the registrar, which suspended it.
At the same time as the malicious update, threat actors launched phishing activity using fake Trust Wallet-branded sites and social media accounts. The campaign tricked users into entering recovery phrases under the pretense of a security fix.
After installing or using version 2.68.0, affected users had wallet data stolen and their cryptocurrency drained. Early reporting put losses above $6 million, later rising to about $7 million, with only the Chrome extension affected.
On December 24, a trojanized Trust Wallet Chrome extension update, version 2.68.0, was published to the Chrome Web Store. The update contained obfuscated JavaScript that exfiltrated wallet seed phrases or mnemonic data to attacker-controlled infrastructure.
Days before the compromise was discovered, attackers registered domains including metrics-trustwallet[.]com and lookalike phishing sites such as fix-trustwallet[.]com. Multiple reports said the domains used the same registrar, indicating a coordinated operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
10 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious Chrome extension named **Safery: Ethereum Wallet** was discovered on the Chrome Web Store, masquerading as a legitimate Ethereum wallet while secretly exfiltrating users' seed phrases. The extension encodes the BIP-39 mnemonic seed phrases into synthetic Sui blockchain addresses and sends microtransactions (0.000001 SUI) from a hardcoded attacker-controlled wallet, embedding the sensitive information within normal-looking blockchain transactions. This method allows the threat actor to later decode the recipient addresses and reconstruct the original seed phrase, enabling them to drain victims' cryptocurrency assets without relying on a traditional command-and-control server. Security researchers from both Socket and Koi Security analyzed the extension, confirming its backdoor functionality and detailing its technical behavior, including the use of a hardcoded Base64 wallet seed and global exposure of sensitive wallet functions in the browser. The extension remained available for download at the time of reporting, and a takedown request was submitted to Google. Users are advised to avoid untrusted wallet extensions and defenders are recommended to scan for mnemonic encoders, synthetic address generators, and suspicious on-chain writing behaviors in browser add-ons to mitigate similar threats.
Jun 29, 2026
Researchers uncovered a campaign dubbed **Offside Wallet Theft Factory** that used at least **40 malicious Firefox extensions** impersonating Web3 products including **OKX**, **Rabby Wallet**, and **TronLink** to steal cryptocurrency wallet data. The operation is tied to a broader cluster of **77 browser add-ons** sharing source code and infrastructure, and is believed to have been active since **March 2026**. Investigators said some of the add-ons were initially published on the official Firefox marketplace as benign sports-score or utility extensions before being repurposed under the same Firefox IDs into wallet-stealing malware. The extensions used several theft methods, including fake wallet pages and phishing redirects, embedded logic to capture **seed phrases**, serialized keyrings, credentials, and clipboard contents, and exfiltration through **Cloudflare Workers** and attacker-controlled **Supabase** projects that also acted as remote switches. Reporting also identified recurring code markers and infrastructure overlap across the packages, including shared request tokens, hard-coded command-and-control elements, custom hook endpoints, a dedicated IP address, and a phishing page on `pages.dev` delivered by a fake **0KX WEB3** extension. The activity has not been attributed to a known threat actor.
Aug 20, 2026
Attackers compromised several legitimate Chrome extensions by phishing developers’ Google Account credentials and then using those accounts to push malicious updates through the Chrome Web Store. Proofpoint reported that affected extensions included **Web Developer** (`0.4.9`), **Chrometana**, **Infinity New Tab**, **CopyFish**, **Web Paint**, and **Social Fixer**, with **TouchVPN** and **Betternet VPN** also likely impacted. Because the updates came from trusted publisher accounts, the malicious code was delivered to existing users as if it were a normal extension release. The injected code delayed execution after installation, retrieved additional payloads from **DGA-generated domains**, and then manipulated browser activity to hijack traffic, replace advertisements, display fake repair alerts, and redirect victims to affiliate programs. Researchers also identified credential-theft components in the campaign, including scripts intended to steal and exfiltrate **Cloudflare** credentials, showing that the operation combined ad fraud, traffic interception, and account compromise in a broad extension hijacking spree.
Aug 14, 2026