Trust Wallet Chrome Extension Flaw Drains $7M in Crypto

Trust Wallet, a leading cryptocurrency wallet provider, confirmed a security vulnerability in version 2.68 of its Chrome browser extension that led to unauthorized fund drains affecting hundreds of users, with losses estimated at around 7 million dollars. The incident, which surfaced on December 25, 2024, followed a software update released the previous day and primarily impacted users who had installed the affected extension version.

Blockchain investigator ZachXBT first alerted the community to the issue, reporting multiple cases of sudden outflows from Trust Wallet addresses across blockchains including Bitcoin, Solana, and Ethereum Virtual Machine-compatible networks. Users described funds being siphoned within minutes, often after importing seed phrases into the extension. One affected individual shared on social media that over 300,000 dollars had been stolen in a four-minute window on Christmas Day, stating, "Everything I've been building for. Stolen on Christmas Day."

Security firm SlowMist's analysis pointed to a potential supply chain attack, where malicious code may have been injected into the extension update. This code allegedly exfiltrated users' seed phrases when...