Trust Wallet links $8.5 million crypto theft to Shai-Hulud NPM attack

Trust Wallet's Chrome extension version 2.68.0 was compromised after attackers gained access to exposed GitHub developer secrets, which provided access to browser extension source code and Chrome Web Store API keys. The attackers registered malicious domains (metrics-trustwallet.com and api.metrics-trustwallet.com) to host malicious code, then built a trojanized version of the extension using the legitimate source code with embedded malicious JavaScript. The malicious extension was published to Chrome Web Store using leaked CWS keys, bypassing internal approval processes. This attack is linked to the Shai-Hulud NPM supply chain attack that compromised over 800 packages and exposed approximately 400,000 developer secrets across 30,000+ GitHub repositories. The malware used TruffleHog tool for credential harvesting and featured self-propagating capabilities.