top of page
perceptive_background_267k.jpg

Trust Wallet says 2,596 wallets drained in $7 million crypto theft attack

Published:

29 December 2025 at 16:43:02

Alert date:

29 December 2025 at 17:02:45

Source:

bleepingcomputer.com

Click to open the original link from this advisory

Web Technologies, Data Breach & Exfiltration

Trust Wallet's browser extension was compromised by attackers right before Christmas, resulting in the theft of approximately $7 million from 2,596 cryptocurrency wallet addresses. The attack targeted the browser extension specifically, draining funds from nearly 3,000 wallet addresses. This represents a significant supply chain attack against a popular cryptocurrency wallet service. The timing of the attack during the Christmas period suggests deliberate targeting when security teams might have reduced monitoring. The scale of the breach affected thousands of users and resulted in substantial financial losses.

Technical details

Attackers compromised Trust Wallet Chrome extension version 2.68.0 by using a leaked Chrome Web Store API key to bypass internal release processes. The malicious extension contained a JavaScript file that exfiltrated sensitive wallet data. The attack occurred on December 24, 2025 at 12:32 UTC. Attackers also launched a follow-up phishing campaign using a fake Trust Wallet-branded website to collect wallet recovery seed phrases.

Mitigation steps:

Immediately update to Trust Wallet extension version 2.69
Submit claims through official form at https://be-support.trustwallet.com
Verify links before clicking
Never share recovery phrases or private keys
Only use official Trust Wallet communication channels
Be aware of threat actors impersonating support accounts via Telegram ads and fake compensation forms

Affected products:

Trust Wallet Chrome Extension version 2.68.0
Trust Wallet browser extension

Related links:

Related CVE's:

Related threat actors:

IOC's:

fix-trustwallet[.]com, Trust Wallet Chrome Extension version 2.68.0

This article was created with the assistance of AI technology by Perceptive.

© 2025 by Perceptive Security. All rights reserved.

email: info@perceptivesecurity.com

Disclaimer: Deze website toont informatie afkomstig van externe bronnen. Perceptive aanvaardt geen verantwoordelijkheid voor de inhoud, juistheid of volledigheid van deze informatie.

bottom of page