Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

Lido DAO’s Increased Development and Market Dynamics Elevate LDO Price
Key Takeaways Lido DAO’s development activities have surged by 690%, signifying substantial growth. The Lido DAO token (LDO)…

Hyperliquid Whales Shift Strategies: BTC Longs Decline, ETH Shorts Dominate
Key Takeaways A significant reduction in Bitcoin long positions has been observed on Hyperliquid, with large holders decreasing…

Token VS Equity: The Aave Controversy

December 26th Market Key Intelligence, How Much Did You Miss?

Trust Wallet Browser Extension Security Incident Leads to Losses
Key Takeaways Trust Wallet identified a significant security breach in its browser extension version 2.68. Approximately over $6…

Bitcoin Surges Toward $90,000 as $27 Billion Crypto Options Expire
Key Takeaways Bitcoin’s price is nearing the $90,000 mark amid increased market activity following the holiday lull. The…

Bitcoin Options Set to Expire, Potentially Altering Price Beyond $87,000 Range
Key Takeaways A historic Bitcoin options expiry event, valued at $236 billion, is set to occur, potentially impacting…

Ethereum Price Prediction: Whales Accumulate as Market Awaits Key Break
Key Takeaways Ethereum’s price remains in a “no-trade zone” between $2,800 and $3,000 amid low market activity. Whale…

Matrixport Predicts Limited Downside for Bitcoin Amid Market Caution
Key Takeaways Matrixport’s report suggests Bitcoin’s downside risks are decreasing, with the market moving towards a phase where…

Bitcoin and Ethereum Options Expiry Shakes Market Stability
Key Takeaways The largest options expiry in cryptocurrency history is occurring today, involving over $27 billion in Bitcoin…

Trust Wallet Hack Results in $3.5 Million Loss for Major Wallet Holder
Key Takeaways A significant Trust Wallet hack led to the theft of $3.5 million from an inactive wallet.…

PancakeSwap Launches LP Rewards on Base Network
Key Takeaways PancakeSwap has introduced liquidity provider (LP) rewards for 12 v3 pools on the Base network, facilitated…

BDXN Wallets Deposit $400,000 in Tokens to Multiple Exchanges
Key Takeaways BDXN project wallets have transferred approximately $400,000 worth of tokens to various exchanges. The transfers involve…

Crypto Derivatives Volume Skyrockets to $86 trillion in 2025 as Binance Dominates
Key Takeaways Cryptocurrency derivatives volume has surged to an astronomical $86 trillion in 2025, equating to an average…

Ethereum in 2026: Glamsterdam and Hegota Forks, Layer 1 Scaling, and More
Key Takeaways Ethereum is poised for crucial developments in 2026, particularly with the Glamsterdam and Hegota forks. Glamsterdam…

Social Engineering in the Crypto Universe: Safeguarding Your Assets in 2025
Key Takeaways Social engineering, a psychological manipulation tactic, has been the leading cause of crypto asset theft in…

Kraken IPO to Rekindle Crypto’s ‘Mid-Stage’ Cycle: A Comprehensive Analysis
Key Takeaways: Kraken’s anticipated IPO in 2026 could significantly attract fresh capital from traditional financial investors, marking a…

Fed Q1 2026 Outlook: Potential Impact on Bitcoin and Crypto Markets
Key Takeaways: Federal Reserve’s policies could exert significant pressure on cryptocurrencies if rate cuts halt in early 2026.…
Lido DAO’s Increased Development and Market Dynamics Elevate LDO Price
Key Takeaways Lido DAO’s development activities have surged by 690%, signifying substantial growth. The Lido DAO token (LDO)…
Hyperliquid Whales Shift Strategies: BTC Longs Decline, ETH Shorts Dominate
Key Takeaways A significant reduction in Bitcoin long positions has been observed on Hyperliquid, with large holders decreasing…
Token VS Equity: The Aave Controversy
December 26th Market Key Intelligence, How Much Did You Miss?
Trust Wallet Browser Extension Security Incident Leads to Losses
Key Takeaways Trust Wallet identified a significant security breach in its browser extension version 2.68. Approximately over $6…
Bitcoin Surges Toward $90,000 as $27 Billion Crypto Options Expire
Key Takeaways Bitcoin’s price is nearing the $90,000 mark amid increased market activity following the holiday lull. The…
Popular coins
Latest Crypto News
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:[email protected]
VIP Services:[email protected]