How Trust Wallet Crypto Users Lost $6M+ in a Browser Extension Incident

On Christmas Day, a growing number of cryptocurrency users reported a serious security incident involving unauthorized wallet drains . The issue was first publicly flagged by on-chain investigator ZachXBT, who issued a community alert after receiving multiple independent reports from affected users.

Within hours, the warning spread across Telegram and X , raising alarms throughout the self-custody community.

Hundreds of “Trust Wallet” wallets have been hacked in the last 2 hours. The @TrustWallet Chrome extension is suspected. If you are using that extension, be cautious. pic.twitter.com/k80CZEzdQv

— Mickael | Powered by $CAPS (@mickal) December 25, 2025

What initially appeared to be isolated cases quickly escalated into a broader investigation involving multiple blockchains , suspected supply-chain compromise indicators, and millions of dollars in losses.

While details continue to emerge, the incident has renewed scrutiny around browser-based wallets , extension security, and the risks associated with importing seed phrases into hot wallets .

According to ZachXBT , numerous users of Trust Wallet reported that funds were drained from their wallet addresses within a short time window.

The reports spanned multiple blockchains, including EVM-compatible networks, Bitcoin , and Solana , suggesting the issue was not confined to a single chain or isolated smart contract interaction.

TRUST WALLET IS HACKED!

SECOND MOST POPULAR CRYPTO WALLET IS EXPLOITED, HACKERS ARE DRAINING MILLIONS RIGHT NOW.

IMMEDIATELY WITHDRAW ALL YOUR FUNDS, REVOKE APPROVALS, AND REMOVE THE APP/EXTENSION! pic.twitter.com/urv3hvmcXT

— 0xNobler (@CryptoNobler) December 25, 2025

ZachXBT shared lists of wallet addresses believed to be associated with the thefts and later provided an update stating that hundreds of victims may have been affected.

Based on initial address tracking and on-chain flows, losses were estimated to exceed $6 million, though these figures remain preliminary and subject to further verification as more victims come forward.

Crucially, ZachXBT emphasized that while the exact root cause was initially undetermined, the reports coincided closely with a recent update to the Trust Wallet Chrome browser extension, released on December 24. This temporal proximity raised concerns a potential extension-level issue, though timing alone does not establish causation.

At the time, no immediate official security advisory had been issued, leading to heightened speculation within the community. As is often the case during active investigations, the lack of early confirmation contributed to uncertainty and misinformation.

Independent security researchers and community members later began examining the Trust Wallet browser extension update more closely. According to multiple publicly shared analyses, a JavaScript file within the extension (identified as 4482.js) appeared to include newly added code that was not clearly documented in release notes.

It appears that the @TrustWallet browser extension may have been compromised via a supply-chain attack in the Dec 24 update.

Reports indicate that importing a seed phrase into the extension can result in immediate wallet draining.

⚠️ Do NOT use the Trust… pic.twitter.com/2nuFCHdM4T

— EpiK (@0xTheGreatApe) December 25, 2025

Researchers alleged that:

Community researchers further noted that the referenced domain had been registered only days earlier and later became inaccessible.

These findings led some researchers to raise the possibility of a supply-chain style compromise, though it is important to stress that these conclusions were based on third-party analysis and not an official audit at the time.

Several users publicly stated that wallets were drained almost immediately after importing a seed phrase into the Trust Wallet browser extension. One widely circulated post on X claimed losing $700k.

Trust wallet has been hacked @Trustwallet

I lost all my money in there $700k 💔💔😩😭 pic.twitter.com/dR588VaQ3U

— Hailey Welch (@hailey_cryptoo) December 25, 2025

While individual user reports cannot be independently verified in isolation, the consistency of these accounts, combined with on-chain evidence of rapid fund movement, strengthened concerns that the act of importing seed phrases into the affected extension version may have exposed users to immediate risk.

TRUST WALLET CHROME EXTENSION IS HACKED.

IF YOU HAVE IT, OR EVER IMPORTED YOUR SEED INTO IT,

WITHDRAW ALL YOUR FUNDS IMMEDIATELY!!

BETTER SAFE THAN SORRY. pic.twitter.com/cFTIkcmZXl

— Wimar.X (@DefiWimar) December 25, 2025

Following the growing reports, Trust Wallet issued an official statement acknowledging a security incident affecting Trust Wallet Browser Extension version 2.68 only.

According to the company:

We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69.

Please refer to the official Chrome Webstore link here:

Please note: Mobile-only users…

— Trust Wallet (@TrustWallet) December 25, 2025

Trust Wallet stated that its team was actively investigating the issue and would continue providing updates. The company directed users to download the updated extension only through the official Chrome Web Store listing.

This incident underscores a critical reality in cryptocurrency security : self-custody failures do not always require breaking cryptography or blockchain protocols.

In many cases, losses result from:

Even when a wallet’s core cryptography remains secure, compromising the environment in which keys are handled can be sufficient to drain funds.

Browser-based wallets are particularly attractive targets for attackers due to:

This does not mean browser wallets are inherently unsafe, but it does mean they demand higher operational security and user awareness.

Based on currently available information, security researchers and investigators have advised users to:

Additionally, you should disconnect affected machines from the internet if funds remain at risk, as a precautionary measure.

While investigations are ongoing, the Trust Wallet incident serves as a stark reminder that self-custody shifts responsibility entirely onto the user and their environment. Even well-known wallets can become vectors for loss if update mechanisms, signing environments, or user practices are compromised.

As the industry continues to mature, incidents like this highlight the need for:

For now, users are urged to remain cautious, follow verified updates, and treat every wallet interaction, especially seed phrase imports, as a critical security event.

In crypto, control comes with responsibility and mistakes are irreversible.

You May Also Like $4.1M Shibarium Bridge Hack: SHIB Tanks, BONE Collapses & Validator Keys Compromised Upbit Hack Timeline: From the $50M Ethereum Heist in 2019 to the $36M Solana Breach in 2025 Crypto Hacks 2025: Full List of Scams, Exchange Exploits & DeFi Vulnerabilities [Updated October]

Was Trust Wallet officially hacked? At the time of reporting, Trust Wallet has acknowledged a security incident affecting Browser Extension version 2.68 only, but has not described it as a protocol-level hack. Investigations suggest a potential extension-related or supply-chain issue rather than a blockchain or cryptographic failure. Which users were affected by this incident? According to Trust Wallet, only users of the browser extension version 2.68 were impacted. Mobile-only users and users on other extension versions were not affected. Reports indicate that users who imported seed phrases into the affected extension were at the highest risk. How much money was stolen in the Trust Wallet incident? Based on on-chain analysis shared by ZachXBT, more than $6 million appears to have been drained across multiple blockchains. This figure is based on an initial list of theft addresses and may increase as additional victims are identified. Is it safe to use Trust Wallet now? Trust Wallet has advised users to disable version 2.68 and upgrade to version 2.69 via the official Chrome Web Store. Users should only reinstall or use the extension after confirming they are on the patched version and should avoid importing seed phrases unless absolutely necessary.

At the time of reporting, Trust Wallet has acknowledged a security incident affecting Browser Extension version 2.68 only, but has not described it as a protocol-level hack. Investigations suggest a potential extension-related or supply-chain issue rather than a blockchain or cryptographic failure.

According to Trust Wallet, only users of the browser extension version 2.68 were impacted. Mobile-only users and users on other extension versions were not affected. Reports indicate that users who imported seed phrases into the affected extension were at the highest risk.

Based on on-chain analysis shared by ZachXBT, more than $6 million appears to have been drained across multiple blockchains. This figure is based on an initial list of theft addresses and may increase as additional victims are identified.

Trust Wallet has advised users to disable version 2.68 and upgrade to version 2.69 via the official Chrome Web Store. Users should only reinstall or use the extension after confirming they are on the patched version and should avoid importing seed phrases unless absolutely necessary.