{"id":7624,"date":"2025-12-27T22:27:25","date_gmt":"2025-12-27T22:27:25","guid":{"rendered":"https:\/\/villpress.com\/?p=7624"},"modified":"2025-12-27T22:27:48","modified_gmt":"2025-12-27T22:27:48","slug":"trust-wallet-launches-7m-reimbursement-program-after-chrome-extension-hack-experts-call-it-an-apt-level-breach","status":"publish","type":"post","link":"https:\/\/villpress.com\/fr\/trust-wallet-launches-7m-reimbursement-program-after-chrome-extension-hack-experts-call-it-an-apt-level-breach\/","title":{"rendered":"Trust Wallet Launches $7M Reimbursement Program After Chrome Extension Hack \u2014 Experts Call It an \u201cAPT-Level\u201d Breach"},"content":{"rendered":"

Trust Wallet is rolling out a full compensation program for users hit by a holiday-season Chrome extension hack that drained roughly $7 million<\/strong> in crypto. The Binance-backed company is promising 100% reimbursement<\/strong> for verified victims as scrutiny intensifies over browser-based wallet security.<\/p>\n\n\n\n

The breach was highly targeted. Only users who interacted with Chrome extension version 2.68<\/strong> between December 24 and December 26, 2025<\/strong> were vulnerable. Trust Wallet\u2019s mobile apps and non-Chrome browser users were unaffected.<\/p>\n\n\n\n

But the fallout is significant: blockchain forensics show that attackers looted millions across Bitcoin, Ethereum, and Solana, moving more than $4 million<\/strong> through exchanges in rapid laundering cycles.<\/p>\n\n\n\n

What Went Wrong<\/h2>\n\n\n\n

According to Trust Wallet, attackers used a leaked Chrome Web Store API key<\/strong> to upload a malicious update (v2.68) on December 24. The tainted build injected seed-phrase-stealing code via a modified analytics library, effectively intercepting users’ recovery phrases the moment they logged in.<\/p>\n\n\n\n

By Christmas Day, reports of drained wallets reached on-chain analyst ZachXBT<\/strong>, who flagged the issue on Telegram. Trust Wallet scrambled to push a clean update (v2.69) on December 25 and told users to disable the compromised version immediately.<\/p>\n\n\n\n

Security firms SlowMist<\/strong> and PeckShield<\/strong> say attackers may have prepared weeks earlier, citing a rogue domain registered on December 8. SlowMist labeled the breach \u201cAPT-level<\/strong>\u201d\u2014suggesting an unusually sophisticated actor or possible insider access. Even Binance co-founder Changpeng Zhao (CZ)<\/strong> speculated it was \u201cmost likely\u201d an inside job, though investigations continue.<\/p>\n\n\n\n

The Damage<\/h2>\n\n\n\n

PeckShield estimates the stolen funds span:<\/p>\n\n\n\n

    \n
  • Bitcoin:<\/strong> ~$3M<\/li>\n\n\n\n
  • Ethereum & L2 tokens:<\/strong> $3M+<\/li>\n\n\n\n
  • Solana:<\/strong> ~$431K<\/li>\n<\/ul>\n\n\n\n

    Of the ~$7M<\/strong> total, more than $4.25M<\/strong> has already been laundered through ChangeNOW, HTX, FixedFloat, KuCoin, and other exchanges. Roughly $2.8M<\/strong> remains in attacker-controlled wallets.<\/p>\n\n\n\n

    This incident adds to more than $713M<\/strong> in wallet-related losses recorded in 2025, underscoring the growing security gaps in self-custody tools.<\/p>\n\n\n\n

    How Affected Users Can Claim Compensation<\/h2>\n\n\n\n

    Trust Wallet has opened an official claims portal at:<\/p>\n\n\n\n

    trustwallet-support.freshdesk.com\/support\/tickets\/new<\/strong><\/p>\n\n\n\n

    Victims must provide:<\/p>\n\n\n\n

      \n
    • Email & country (for possible legal proceedings)<\/li>\n\n\n\n
    • Compromised wallet addresses<\/li>\n\n\n\n
    • Attacker wallet addresses<\/li>\n\n\n\n
    • Transaction hashes<\/li>\n\n\n\n
    • Estimated loss amount<\/li>\n\n\n\n
    • A fresh wallet address for reimbursement<\/li>\n<\/ul>\n\n\n\n

      The company says each case will undergo manual verification<\/strong> to prevent fraudulent claims and warns users to avoid impostor sites requesting seed phrases or passwords.<\/p>\n\n\n\n

      Trust Wallet\u2019s Response, and CZ\u2019s Assurance<\/h2>\n\n\n\n

      Trust Wallet CEO Eowyn Chen<\/strong> acknowledged that the malicious upload bypassed internal safeguards and said the team is now implementing:<\/p>\n\n\n\n

        \n
      • Outside security audits<\/li>\n\n\n\n
      • Stricter internal access controls<\/li>\n\n\n\n
      • Quarterly third-party reviews<\/li>\n<\/ul>\n\n\n\n

        CZ reiterated that affected users\u2019 funds are \u201cSAFU<\/strong>,\u201d referencing Binance\u2019s history of covering over $1 billion<\/strong> in user losses during major incidents.<\/p>\n\n\n\n

        No exact payout timeline has been given, but Trust Wallet says its team is verifying claims \u201caround the clock.\u201d<\/p>\n\n\n\n

        Are Browser Wallets Too Risky?<\/h2>\n\n\n\n

        The hack has reignited debate across X and Telegram about whether browser extensions\u2014even from major brands, are fundamentally unsafe.<\/p>\n\n\n\n

        \u201cBrowser extensions are hack magnets,<\/strong>\u201d one researcher wrote, calling for increased adoption of hardware wallets and multisig setups for high-value storage.<\/p>\n\n\n\n

        For others, Trust Wallet\u2019s rapid reimbursement is a welcome precedent. But the broader takeaway is sobering: as crypto adoption accelerates, attackers are shifting from protocol exploits to software supply-chain attacks<\/strong>, often easier to execute and harder to detect.<\/p>\n\n\n\n

        Timeline of This Events<\/h2>\n\n\n\n
          \n
        • Dec 8, 2025:<\/strong> Rogue exfiltration domain registered.<\/li>\n\n\n\n
        • Dec 24, 12:32 p.m. UTC:<\/strong> Malicious v2.68 pushed to Chrome Web Store via leaked API key.<\/li>\n\n\n\n
        • Dec 25:<\/strong> Community reports; v2.69 safe version released.<\/li>\n\n\n\n
        • Dec 26, 11 a.m. UTC:<\/strong> Exposure window ends.<\/li>\n\n\n\n
        • Dec 26 (later):<\/strong> Forensics reveal >$4M laundered.<\/li>\n\n\n\n
        • Dec 27:<\/strong> Trust Wallet launches compensation program; CZ confirms full coverage.<\/li>\n<\/ul>\n\n\n\n

          Here is What We Should Know<\/h2>\n\n\n\n

          Trust Wallet\u2019s reimbursement move may soften the blow, but the breach adds fuel to longstanding concerns over extension-based wallets. As 2026 approaches, wallet security, especially around supply-chain vulnerabilities, will likely define the next wave of crypto infrastructure debates.<\/p>","protected":false},"excerpt":{"rendered":"

          Trust Wallet is rolling out a full compensation program for users hit by a holiday-season Chrome extension hack that drained roughly $7 million in crypto. The Binance-backed company is promising 100% reimbursement for verified victims as scrutiny intensifies over browser-based wallet security. The breach was highly targeted. Only users who interacted with Chrome extension version […]<\/p>\n","protected":false},"author":1,"featured_media":7625,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[166],"tags":[855,834,692,854],"ppma_author":[331,332],"class_list":{"0":"post-7624","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-crypto","8":"tag-crypto","9":"tag-cyberattack","10":"tag-security","11":"tag-trust-wallet"},"authors":[{"term_id":331,"user_id":1,"is_guest":0,"slug":"pastakutmanwen","display_name":"Villpress Insider","avatar_url":{"url":"https:\/\/villpress.com\/wp-content\/uploads\/2025\/05\/Logo.png","url2x":"https:\/\/villpress.com\/wp-content\/uploads\/2025\/05\/Logo.png"},"0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":332,"user_id":3,"is_guest":0,"slug":"sebastianhills","display_name":"Sebastian Hills","avatar_url":"https:\/\/villpress.com\/wp-content\/uploads\/2024\/08\/sebas-96x96.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/posts\/7624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/comments?post=7624"}],"version-history":[{"count":1,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/posts\/7624\/revisions"}],"predecessor-version":[{"id":7626,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/posts\/7624\/revisions\/7626"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/media\/7625"}],"wp:attachment":[{"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/media?parent=7624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/categories?post=7624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/tags?post=7624"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/villpress.com\/fr\/wp-json\/wp\/v2\/ppma_author?post=7624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}