A serious security incident affecting cryptocurrency wallet users has come to light as the year draws to a close. Trust Wallet, a cryptocurrency wallet provider supporting multiple blockchains, confirmed a loss exceeding $6 million due to a vulnerability discovered in a specific version of its browser extension. It was specifically emphasized that the incident only affected version 2.68 of the Trust Wallet browser extension, and that mobile app users and other versions were not affected.
Trust Wallet Issues Statement
According to information shared by the company, the security vulnerability was first discovered on December 24th. As of December 25th, on-chain data revealed unauthorized fund withdrawals from wallets across several different blockchains, including Bitcoin, Ethereum, and Solana networks. Within a short time, hundreds of users began reporting that their wallet balances had suddenly been zeroed or significantly reduced.
The incident gained widespread public attention thanks to the posts of blockchain researcher ZachXBT. ZachXBT reported receiving hundreds of messages on and after Christmas Day from users who had similarly experienced losses. Community reviews revealed that malicious code was infiltrated into version 2.68 of the browser extension, redirecting user data to a fake website. This allowed attackers to gain access to seed phrase information and empty wallets.
Trust Wallet officially acknowledged the security breach and urged users to take immediate action. The company requested that version 2.68 be immediately disabled and that users update only to version 2.69, available through the official Chrome Web Store. According to Trust Wallet, version 2.69 is secure and does not contain the issue. They also stated that their support team is contacting affected users individually and investigating the details of the incident. No compensation plan has been announced yet, but affected users are being guided through a roadmap.
Data shared by the on-chain analytics platform Arkham also revealed the extent of the attack. According to this data, attackers used multiple recipient addresses to distribute the stolen funds to different wallets, making tracing difficult. It is reported that the majority of losses occurred through SOL, BTC, and EVM-compatible tokens.
The accounts of the victimized users also revealed the psychological impact of the incident. Some statements on social media reported that one user discovered they had lost over $300,000 in assets upon returning from a Christmas vacation, and that the transactions occurred in just a few minutes. Although the reliability of some accounts is questioned, the overall picture shows that hundreds of users experienced a similar scenario. In general, browser extensions, because they have high access privileges to web pages, cookies, and browsing data, can create serious security vulnerabilities if misused. Indeed, earlier this year, reports were published about dozens of fake cryptocurrency wallet extensions stealing user keys. Trust Wallet says that the investigation is ongoing and that the public will be informed as new developments occur.
TWT token price was minimally affected by the development
Meanwhile, the TWT coin, belonging to the Trust Wallet wallet ecosystem, experienced a slight drop in the first hours after the news of the theft broke, but has recovered at the time of writing. It is trading around $0.8.
