Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

Bitcoin getting ‘stable’? 2025 volatility lower than Nvidia

Decode Bitget TradFi: How to Bridge the Final Gap Between Crypto and Traditional Assets?

Built on Compliance and Security, AI Empowering Users, KuCoin is Redefining the Crypto Partner

I made $200,000 in two weeks, how do I bootstrap on Hyperliquid?

Why AI Trading Bots Are Becoming Essential in 24/7 Crypto Markets
Cryptocurrency markets operate continuously and move faster than human attention can reliably sustain. Prices react instantly to global events, liquidity shifts across regions, and tradeable opportunities often exist for minutes rather than hours. For many traders, the core challenge is no longer generating ideas, but executing decisions consistently without constant monitoring or emotional interference. This is where AI trading bots are increasingly being adopted — not as profit guarantees, but as tools designed to translate predefined strategies into reliable, repeatable execution.

AI Crypto Trading Competition: Full Guide to Knowing WEEX Alpha Awakens
The integration of artificial intelligence into cryptocurrency trading has evolved from a novel experiment into a core utility. In 2026, AI-driven tools have become indispensable for traders seeking enhanced discipline, superior execution speed, and structured, data-informed decision-making amid market volatility. This guide provides a practical, step-by-step breakdown of how to participate in WEEX Alpha Awakens, with a focused examination of how these strategies are implemented within live trading environments.

Crypto Fear & Greed Index Stable, “Fear” Emotion Requires Addressing
Key Takeaways Cryptocurrency fear and greed index remains at a low of 26, improving from “extreme fear” but…

Why Are We Bullish on Stablecoins as FinTech 4.0?
Key Takeaways: FinTech evolution has advanced through multiple stages, leading to the emergence of stablecoins and permissionless finance…

2025 Crypto Violence Retrospective: Increasing Assaults and Fatal Incidents in a Growing Market
Key Takeaways Violent incidents involving cryptocurrency holders have escalated, with 2025 documenting 65 attacks, including 4 fatalities. The…

Key Macro Events and Crypto Whale Movements This Week
Key Takeaways Upcoming releases of key U.S. economic data on unemployment and non-farm payrolls could significantly impact markets.…

Venezuela’s 60 Billion BTC “Shadow Reserve”, Walmart to Embrace Bitcoin Payments: Global Cryptocurrency Conversations Today
Key Takeaways Recent developments in the cryptocurrency market have highlighted significant macroeconomic discussions and ecosystem-specific advancements. The Curve…

Maduro Ousted, “Unlocks” $60 Billion Bitcoin “Shadow Reserve,” Will Reshape Global Market Landscape
Key Takeaways Venezuela under Maduro accumulated a massive reserve of Bitcoin and USDT as a method to evade…

USD1 Finance Playbook: Examining Lista DAO’s Diverse Yield Farming Strategies for Capital Efficiency
Key Takeaways: Lista DAO is becoming crucial in the BNB ecosystem by providing a wide range of financial…

Solana On-Chain Spot Volume Surpasses All CEXes Excluding Binance
Key Takeaways Solana’s on-chain spot trading volume has surged to $1.6 trillion in 2025, surpassing major platforms like…

CVX Surges Over 40% Amidst Manipulation Concerns, Bot Wallets Drive Price Hike
Key Takeaways CVX (Convex Finance) experienced a more than 40% surge in price due to suspected manipulation by…

Court Sentences Criminal in Virtual Currency Fraud Case with Major Global Implications
Key Takeaways A landmark case in Beijing reveals a significant cross-border telecom and internet fraud scheme involving virtual…

Japanese and South Korean Stock Markets Surge, South Korea’s KOSPI Index Hits New Record
Key Takeaways Both Japan’s Nikkei 225 Index and South Korea’s KOSPI have seen significant gains, reaching new heights…

Japanese Finance Ministry Ushers in 2026 as “Digital First Year” with Focus on Digital Assets
Key Takeaways Japan’s Minister of Finance, Okatsuka Katsuki, has declared 2026 as Japan’s “Digital First Year,” highlighting the…
Bitcoin getting ‘stable’? 2025 volatility lower than Nvidia
Decode Bitget TradFi: How to Bridge the Final Gap Between Crypto and Traditional Assets?
Built on Compliance and Security, AI Empowering Users, KuCoin is Redefining the Crypto Partner
I made $200,000 in two weeks, how do I bootstrap on Hyperliquid?
Why AI Trading Bots Are Becoming Essential in 24/7 Crypto Markets
Cryptocurrency markets operate continuously and move faster than human attention can reliably sustain. Prices react instantly to global events, liquidity shifts across regions, and tradeable opportunities often exist for minutes rather than hours. For many traders, the core challenge is no longer generating ideas, but executing decisions consistently without constant monitoring or emotional interference. This is where AI trading bots are increasingly being adopted — not as profit guarantees, but as tools designed to translate predefined strategies into reliable, repeatable execution.
AI Crypto Trading Competition: Full Guide to Knowing WEEX Alpha Awakens
The integration of artificial intelligence into cryptocurrency trading has evolved from a novel experiment into a core utility. In 2026, AI-driven tools have become indispensable for traders seeking enhanced discipline, superior execution speed, and structured, data-informed decision-making amid market volatility. This guide provides a practical, step-by-step breakdown of how to participate in WEEX Alpha Awakens, with a focused examination of how these strategies are implemented within live trading environments.