Trust Wallet Chrome extension version 2.68 contained malicious code that iterates through all wallets stored in the extension and triggers mnemonic phrase requests for each wallet. The encrypted mnemonic is decrypted using the password or passkeyPassword entered during wallet unlock. Once decrypted, the mnemonic phrase is sent to the attacker's server api.metrics-trustwallet[.]com. The attacker leveraged the open-source full-chain analytics library posthog-js to harvest wallet user information and used the legitimate PostHog analytics library as the data-exfiltration channel, redirecting analytic traffic to an attacker-controlled server.