Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

Top 5 Cryptos to Buy in 2026 Q1: A ChatGPT Deep Dive Analysis
Explore the top 5 cryptos to buy in Q1 2026 including BTC, ETH, SOL, TAO, and ONDO. See price outlooks, key narratives, and institutional catalysts shaping the next market move.

How to Earn $15,000 with Idle USDT Before Altcoin Season 2026
Wondering if altcoin season is coming in 2026? Get the latest market update, and learn how to turn your idle stablecoins waiting for entry into extra rewards up to 15,000 USDT.

Can You Win Joker Returns Without Large Trading Volume? 5 Mistakes New Players Make In WEEX Joker Returns Season 2
Can small traders win WEEX Joker Returns 2026 without huge volume? Yes—if you avoid these 5 costly mistakes. Learn how to maximize card draws, use Jokers wisely, and turn small deposits into 15,000 USDT rewards.

Altcoin Season 2026: 4 Stages to Profit (Before the Crowd FOMO In)
Altcoin Season 2026 is starting — discover the 4 key stages of capital rotation (from ETH to PEPE) and how to position before the peak. Learn which tokens will lead each phase and avoid missing the rally.

Will Alt season come in 2026? 5 Tips to Spot the Next 100x Crypto Opportunities
Will altcoin season arrive in 2026? Discover 5 rotation stages, early signals smart traders watch, and the key crypto sectors where the next 100x altcoin opportunities may emerge.

The bear market has arrived, and cryptocurrency ETF issuers are also getting involved

The richest man had a quarrel with his former boss
BTC Firm Above 70K! Saylor’s "Institutional Logic" vs. Moon’s "Retail Faith": Who is Really Harvesting the Market?
Bitcoin is holding firm above the $70,000 support level following a massive short squeeze that liquidated $427 million. As the "Four-Year Cycle" narrative shifts, the market is split: Michael Saylor’s cold, institutional "indiscriminate stacking" vs. Carl Moon’s high-energy retail "hopium." This article decodes these two polar-opposite strategies for the 2026 bull run and reveals how WEEX’s institutional-grade liquidity and AI trading tools empower every type of investor to convert market volatility into profit.

The Girl Who Created the SBTI Test: A Story of a Doomed Cyber Love, an E-Widow Ratfolk

B.AI Officially Launched: Building AI Agent Financial Bedrock Platform, Driving AGI Era Business Underlying Logic

B.AI Officially Launched: Breaking Down A2A Collaboration Barriers to Unlock the Smart Body Economy's Full Potential

We helped Xu Mingxing write a book called "<OK Life>".

Rare APY of 400%, is TradeXYZ handing out money to oil bulls?

a16z: Perpetual Contracts are Rewriting Global Trading Rules

Bitcoin Hits $73,000 Triggering $427M Short Liquidation | Carl Moon: $200,000 is the Target
April 9, 2026 (UTC+0), 22:17. Bitcoin (BTC) executed a high-velocity surge within minutes, heavy-hitting the $73,000 psychological barrier and touching a local high near $74,000. While the price has since retraced to consolidate above $72,000, this "instant ambush" successfully completed a $427M liquidation of short positions.

a16z partner: perpetual contracts are rewriting the global trading rules
Bitcoin ETF Inflows Just Turned Positive After 5 Months of Outflows: What Does That Mean for BTC Price Now?
The Hidden Risks Behind Bitcoin ETF Inflows in 2026: What Traders Should Know. The question now isn't whether inflows are happening. It's what they're telling you about the next phase and whether your portfolio is positioned for it.
Decoding 2026's Bitcoin ETF Data: How to Trade Alongside Institutional Smart Money in 2026
After months of sustained outflows, rolling 30-day net ETF inflows just crossed 30,000 BTC. That's not noise. Historically, when institutional capital rotates back in at this scale, it marks a regime shift — not just a bounce.
Top 5 Cryptos to Buy in 2026 Q1: A ChatGPT Deep Dive Analysis
Explore the top 5 cryptos to buy in Q1 2026 including BTC, ETH, SOL, TAO, and ONDO. See price outlooks, key narratives, and institutional catalysts shaping the next market move.
How to Earn $15,000 with Idle USDT Before Altcoin Season 2026
Wondering if altcoin season is coming in 2026? Get the latest market update, and learn how to turn your idle stablecoins waiting for entry into extra rewards up to 15,000 USDT.
Can You Win Joker Returns Without Large Trading Volume? 5 Mistakes New Players Make In WEEX Joker Returns Season 2
Can small traders win WEEX Joker Returns 2026 without huge volume? Yes—if you avoid these 5 costly mistakes. Learn how to maximize card draws, use Jokers wisely, and turn small deposits into 15,000 USDT rewards.
Altcoin Season 2026: 4 Stages to Profit (Before the Crowd FOMO In)
Altcoin Season 2026 is starting — discover the 4 key stages of capital rotation (from ETH to PEPE) and how to position before the peak. Learn which tokens will lead each phase and avoid missing the rally.
Will Alt season come in 2026? 5 Tips to Spot the Next 100x Crypto Opportunities
Will altcoin season arrive in 2026? Discover 5 rotation stages, early signals smart traders watch, and the key crypto sectors where the next 100x altcoin opportunities may emerge.
