Trust Wallet Chrome Extension Compromised in Supply Chain Attack Draining $7 Million From User Wallets

Cryptocurrency wallet users woke up to a nightmare on Christmas Eve as Trust Wallet confirmed that a compromised Chrome browser extension update enabled attackers to steal approximately $7 million in digital assets. The incident, which unfolded on December 24, 2023, exposed critical vulnerabilities in software supply chain security within the cryptocurrency ecosystem and sent shockwaves through the non-custodial wallet community.

The Exploit Mechanics

The attack centered on Trust Wallet Chrome extension version 2.68.0, which was released on December 24. Security analyst Akinator, who was among the first to identify the malicious code, discovered that a bundled JavaScript file named 4482.js contained tightly packed malicious logic designed to exfiltrate sensitive wallet data. The code operated under the guise of analytics functionality, secretly capturing seed phrases and transmitting them to an external server hosted at api.metrics-trustwallet[.]com.

The exfiltration mechanism was particularly insidious because it leveraged the normal operation flow of the wallet extension. When users interacted with the extension for routine authorization steps, the malicious code silently captured their seed phrases in the background. This meant that even security-conscious users who followed standard practices were affected, as the compromise occurred at the software distribution level rather than through user error.

In addition to the supply chain attack, researchers identified a coordinated phishing campaign operating through the domain fix-trustwallet[.]com, which was designed to trick users into revealing their recovery phrases directly. This dual-attack vector significantly amplified the potential damage and demonstrated a sophisticated understanding of social engineering tactics.

Affected Systems

Trust Wallet is one of the most widely used non-custodial cryptocurrency wallets, facilitating the storage, management, and interaction with digital assets across multiple blockchains. The Chrome browser extension, specifically targeted in this attack, serves as the primary interface for users interacting with decentralized applications. All users who installed or auto-updated to version 2.68.0 of the Chrome extension were potentially exposed.

With Bitcoin trading at approximately $43,016 and Ethereum at $2,265 on the day of the attack, the $7 million in losses represented a significant sum. Reports from affected users indicated that funds began disappearing immediately after completing what appeared to be routine authorization steps. Initial damage estimates started at $2 million before rapidly climbing to the final figure as more victims came forward.

The Mitigation Strategy

Trust Wallet responded to the incident by releasing version 2.69 of its Chrome extension, which addressed the vulnerability present in the compromised version. The company issued advisories urging all Chrome extension users to immediately update to the patched version and, critically, to move their funds from any potentially compromised wallets to new wallets with fresh seed phrases.

Security researchers emphasized that simply updating the extension was insufficient for users whose seed phrases had already been exfiltrated. Because the attackers had captured recovery phrases, they retained the ability to access affected wallets regardless of subsequent software patches. This underscored the fundamental importance of seed phrase security and the irreversibility of cryptographic key exposure.

Lessons Learned

The Trust Wallet incident highlighted several critical security principles. First, software supply chain attacks represent an escalating threat in the digital asset space, as malicious updates can bypass traditional security measures that rely on user awareness. Second, the attack demonstrated how attackers increasingly combine technical exploits with social engineering, creating multiple pathways to compromise user funds. Third, the speed at which the damage accumulated from initial reports to $7 million in losses within hours illustrates the urgent need for real-time monitoring and rapid response capabilities in wallet software.

User Action Required

If you used Trust Wallet Chrome extension version 2.68.0, immediately create a new wallet with a fresh seed phrase and transfer all funds. Update to version 2.69 or later before using the extension again. Monitor your wallet addresses for unauthorized transactions and report any suspicious activity. Consider using hardware wallets for storing significant amounts of cryptocurrency as an additional layer of protection against software-based supply chain attacks.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding digital asset protection.