Trust Wallet Browser Extension Compromised, Drains Over $6M User Funds

Multi-chain crypto wallet provider Trust Wallet has confirmed a security breach on Thursday, with estimated initial losses exceeding $6 million.

Blockchain security expert ZachXBT flagged the incident after multiple Trust Wallet users experienced unauthorized fund outflows. All victims have one thing in common – they installed the new Trust Wallet extension before the theft.

“We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only,” the crypto wallet wrote on X.

“Users with Browser Extension 2.68 should disable and upgrade to 2.69.”

We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69.

Please refer to the official Chrome Webstore link here: https://t.co/V3vMq31TKb

Please note: Mobile-only users…

— Trust Wallet (@TrustWallet) December 25, 2025

Following the initial report, ZachXBT noted that the number of victims has risen to the hundreds, with funds over $6 million siphoned in SOL, BTC and EVM tokens.

Besides, Arkham data shows that exploiters made use of several receiving addresses, moving funds across various wallets.

Trust Wallet Users Report Losing Funds

Several Trust Wallet users reported that funds were drained from their wallet addresses within a short time frame on Christmas.

One user took to X, reporting the loss of over $300,000 after coming back from Christmas. “Everything I’ve been building for. Stolen on Christmas Day.” The transactions took place within a 4-minute window, the user added. However, ZachXBT flagged that X account as suspicious.

Users reported that multiple blockchains, including EVM-compatible networks, Bitcoin, and Solana, were affected.

That X account is a scammer larping as a girl and lying about being a victim of the hack to bait engagement.

>44 username changes
>countless meme coin scams
>only 234 posts for a 2023 account
>they preblocked me

X User ID: 1725149174780268544 pic.twitter.com/mGyLe5Jvf5

— ZachXBT (@zachxbt) December 26, 2025

What Happened

Trust Wallet released a new browser extension update on Wednesday, which users installed through the usual update process.

At first, the extension appeared legit, however, hackers masqueraded the code address, extracting users’ seed phrases and draining wallets.

“Reports indicate that importing a seed phrase into the extension can result in immediate wallet draining,” wrote one user.

Browser extensions operate with elevated access to web pages, cookies, storage, and browsing activity. When abused, they provide a near-perfect avenue for credential theft – without triggering traditional endpoint defences.

Recently, several reports have surfaced with high-profile extension-related wallet threats. Per HackerNews, more than 40 fake crypto wallet extensions were stealing users’ keys and IPs early this year.

Trust Wallet noted that mobile-only users and other browser extension versions were not impacted by the breach.

“We understand how concerning this is, and our team is actively working on the issue. We’ll keep sharing updates as soon as possible,” the team wrote on X.

Further, in a latest update, the wallet said that the customer support is already in touch with impacted users regarding next steps.