Trust Wallet Browser Extension Hack: What Happened, Who Was Affected, and What Users Should Do
Trust Wallet faced a big problem – a dangerous version of its browser extension was uploaded to the Chrome Web Store, and its version was v2.68.
Usually, Trust Wallet gets every update thoroughly checked by its security team, then releases it. But now, v2.68 has been published without proper review. There was malicious code hidden in the extension, and honestly, the Trust Wallet team didn’t even know that something like this was possible.
What happened?
On December 24, 2025, a fake browser extension of Trust Wallet suddenly appeared on the Chrome Web Store. The version number was v2.68, but this was no ordinary update. To be honest, it was made live without any necessary security checks. Dangerous code was inserted in this compromised version. As soon as a user installed the extension, all their sensitive data went directly to the attacker. Not only this, but the attacker could do the transaction without the user’s consent. In simple words, the user’s entire wallet went into the attacker’s possession.
Who got affected?
According to Trust Wallet’s investigation, this security issue didn’t hit everyone. Only users who fit these three criteria:
They used Trust Wallet Browser Extension version 2.68
They logged in between December 24 and December 26, 2025
They actually opened the extension and logged into their wallet during that time
If you didn’t log in during those dates, your wallet’s considered safe.
Important warning for mobile app users
Trust Wallet also said, If you get a security alert or push notification in the Trust Wallet mobile app, or you see a security incident banner in the browser extension. That means you’re probably still using a compromised wallet, or your wallet’s data was already at risk.
This has become clear from Trust Wallet’s investigation:
This incident directly affected 2,520 wallet addresses. The attackers drained all the cryptocurrency from these wallets.
According to the analysis, approximately $8.5 million USD worth of crypto assets were lost. This entire loss is linked to wallet addresses controlled by 17 attackers. The attackers moved the funds around using different wallets and attempted to conceal their tracks.
Trust Wallet also stated that the attackers are targeting not only Trust Wallet users but also users of other wallets (non-Trust Wallet users). This means that these logs are impacting users across different platforms.
Trust Wallet’s User-Friendly Decision
Trust Wallet has taken a significant step: the company will reimburse the affected users itself. The reimbursement process is currently being finalized, and a system for verifying ownership is being set up to ensure that only the correct wallet owners receive the refunds.
Trust Wallet has begun contacting users who reported this incident in the past few days. This approach demonstrates Trust Wallet’s commitment to accountability and transparency.
What Affected Users Should Do?
These steps are only for users who have used the Trust Wallet browser extension v2.68 and logged into their wallet between December 24-26, 2025. If you fit these criteria, taking action now is crucial.
Step 1: Transfer Funds to a Safe Place
Trust Wallet has stated: Transfer all funds from the compromised wallet to a newly created wallet. The old wallet is or may be compromised, so keeping funds there is risky. The new wallet is safe because it hasn’t been exposed yet.
(A step-by-step guide is available on the Trust Wallet website.)
Step 2: File a Reimbursement Claim
If your funds have been stolen, go to the Trust Wallet website and fill out the official support form to claim reimbursement. This is the only official process for refunds.
Step 3: Be Patient and Only Communicate with Official Support
Trust Wallet has also stated that the entire process can be stressful – it involves money, which is understandable. The team is reviewing every claim, so it may take some time.
Trust Wallet has shared a very important update in its investigation. The company says it has high confidence that the Browser Extension v2.68 incident is connected to the Sha1-Hulud incident that occurred in November 2025.
What did Trust Wallet do after the incident?
As soon as the incident was confirmed, Trust Wallet took immediate action.
- They removed the bad extension (v2.68) and released a clean version (v2.69).
- Users got the safe update without any delay.
- To handle the attack, they disabled publishing access, revoked all related API credentials, and limited deployment permissions.
This was done to prevent any further unauthorized updates and minimize further damage.
Trust Wallet did not work alone. They worked closely with blockchain analytics partners and security experts to track fund movements and identify and assist affected users. This collaboration made testing faster and more accurate.
Before making the public announcement, they replaced the insecure extension with a secure version. The reason for this was simple: avoid panic and confusion, give users a chance to safely update first, and minimize exposure to hacks. As soon as v2.69 went live, users got clear warnings and proper guidelines.
Immediately after the incident, Trust Wallet decided to reimburse the affected users. Planning started immediately. This step shows the company’s commitment to accountability and user trust.
Trust Wallet reiterated: If you received a push notification from the app or see a security banner in the extension, it means you used v2.68 between December 24 and 26, and your wallet may still be at risk. Therefore, transfer your funds to a new wallet immediately.
Now, Trust Wallet is taking another strong step. Extension v2.70 will include a special verification tool that will verify reimbursement claims, provide users with additional proof or verification codes, and prevent fraudulent claims. This will make the reimbursement process safe and fair.
Final Thoughts
This incident clearly shows that no crypto wallet, no matter how famous or trusted, can escape the eyes of hackers. It’s not enough to rely only on big names or old reputations – danger is always looming in the world of crypto.
But Trust Wallet also presented another example here. The company quickly caught the matter and brought it under control. Gave direct and clear information to the users without any twists and turns. And most importantly, it was decided to return the money to those who suffered losses.
It is clear from all this that Trust Wallet kept its users above all else. Even after the loss, the users were not left alone.
Blog Relates to Trust Wallet: Trust Wallet Chrome Extension Breach: $7 Million Crypto Loss
Found this article interesting? Explore more ransomware security insights and threat updates.
Frequently Asked Questions
The Trust Wallet browser extension v2.68 incident was a serious security breach. In this incident, a fake and compromised browser extension (version v2.68) of Trust Wallet was published on the Chrome Web Store, in which malicious code was hidden. When users log in to their wallet by installing this extension, their sensitive wallet data becomes accessible to attackers. This allowed attackers to execute crypto transactions without user permission, stealing funds from users’ wallets. This incident occurred between December 24–26, 2025, and affected only one user who logged in using the compromised version.
Approximately $8.5 million USD worth of cryptocurrency was stolen in this attack. According to Trust Wallet’s investigation, 2,520 wallet addresses were directly affected, and the attackers drained all the crypto from these wallets. These funds were moved to wallets controlled by approximately 17 attackers so that their activity could be hidden.
Attackers stole the funds this way. They used a compromised browser extension (v2.68) of Trust Wallet, which inserted malicious code. When users installed this extension and logged in to their wallet, the extension sent their sensitive data (like private keys/session information) to the attackers’ servers. With the help of this data, attackers got unauthorized access to users’ wallets and transferred all the funds by executing transactions without the users’ permission.
Affected users should immediately take these steps: First of all, transfer all the funds from the compromised wallet to a new, secure wallet, as the old wallet may be under the control of the attackers. After that, if the funds have been stolen, fill out the reimbursement claim form available on the official website of Trust Wallet. Please speak only with the official support channels of Trust Wallet and do not trust any unknown message, email, or link.
After the Trust Wallet incident, it has taken new security steps. Trust Wallet removed the compromised extension v2.68 and immediately released the secure version v2.69. Also, to prevent unauthorized updates, publishing access is disabled, API credentials revoked, and deployment permissions restricted. Moving forward, we are launching the Trust Wallet extension v2.70, which will have a special verification tool. This tool will verify reimbursement claims, provide extra proof/verification codes, and prevent fraudulent claims. This will strengthen the security and trust of users.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!