Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

Why DePIN Is the Next Big Revolution in 2026-2028
Key Takeaways DePINs have emerged as a vital solution to the infrastructural demands of AI, moving from theoretical…

Massive US Storm Forces Bitcoin Miners Offline – What Does That Mean for Bitcoin Holders?
Key Takeaways A severe Arctic storm in the U.S. has significantly impacted Bitcoin mining operations, resulting in substantial…

7 Best Crypto Lightning Network Wallets in 2026: Evaluated & Ranked
Key Takeaways Lightning Network wallets enable fast and cost-effective Bitcoin transactions by using off-chain channels. A variety of…

Solana Price Prediction: Institutions Just Chose SOL Over BTC, ETH, and XRP – Is This the Beginning of a Massive Flippening?
Key Takeaways Institutional investors are increasingly favoring Solana over traditional giants like Bitcoin (BTC), Ethereum (ETH), and XRP.…

Penguin Meme Coin Surged 18,000% After Viral White House Post
Key Takeaways: The Penguin meme coin, known by its ticker PENGUIN, experienced a massive surge in market capitalization…

XRP Price Prediction: XRP Ledger Blasts Past $2 Billion in Tokenized Assets – Why This Could Catapult XRP Parabolic
Key Takeaways XRP Ledger’s (XRPL) tokenized assets have surged past $2 billion, cementing its position in both traditional…

Dogecoin Price Forecast: Impending Developments Could Determine DOGE’s Future
Key Takeaways Dogecoin price momentum has stalled, placing it at a critical juncture between recovery and further losses.…

Shiba Inu Price Prediction: Over 250 Billion SHIB Withdrawn – Are We Hours Away From a Surprise Rally?
Key Takeaways Significant SHIB withdrawals signal potential bullish trends, with over 250 billion tokens moved from exchanges to…

Elon’s Grok AI Predicts the Price of XRP, Solana, and PEPE by the End of 2026
Key Takeaways Grok AI, a project rivaling ChatGPT, provides optimistic forecasts for the future prices of XRP, Solana,…

Pump.fun ($PUMP) Price Prediction 2026, 2027 – 2030
Pump.fun has launched its $PUMP token in a much-anticipated ICO, quickly reaching a $2 billion market cap. The…

Is SOL Prepared for a New All-Time High? Solana Captures Nearly Half of Blockchain Activity in Current Bull Run
Key Takeaways: Solana has become a dominant force in the blockchain space, handling nearly half of all blockchain…

XRP (XRP) Price Prediction 2026, 2027 – 2030
Key Takeaways XRP’s price is predicted to fluctuate between $2.05 and $2.32 in 2026, potentially reaching between $3.23…

XRP Price Prediction: How the October 18-25 SEC Deadlines Could Induce a Breakout
Key Takeaways: The approaching October 18-25 SEC deadlines for spot XRP ETF applications could significantly impact XRP’s market…

Best Crypto to Buy Now January 23 – XRP, Dogecoin, PEPE
Key Takeaways Regulatory Shifts: U.S. crypto regulation is becoming inevitable, affecting investment outlooks, especially for altcoins. XRP Developments:…

Ethereum Price Prediction: Ethereum Developers Prepare for Quantum Computers – Major Update on the Horizon?
Key Takeaways The Ethereum Foundation has initiated a post-quantum security team to counteract threats posed by future quantum…

XRP Price Prediction: Institutional On-Ramp Commences in October – Can XRP Rise as Wall Street’s Next Favorite?
Key Takeaways Institutional interest in XRP derivatives is on the rise, suggesting a promising future for the cryptocurrency.…

6 Leading Decentralized Prediction Markets Without KYC in 2026
Key Takeaways Decentralized prediction markets enable users to speculate on various real-world events without intermediaries, offering freedom from…

8 Most Expensive Cryptocurrencies by Price in 2026
Key Takeaways Bitcoin remains the most expensive cryptocurrency as of January 2026, valued at $88,877.30 per coin, highlighting…
Why DePIN Is the Next Big Revolution in 2026-2028
Key Takeaways DePINs have emerged as a vital solution to the infrastructural demands of AI, moving from theoretical…
Massive US Storm Forces Bitcoin Miners Offline – What Does That Mean for Bitcoin Holders?
Key Takeaways A severe Arctic storm in the U.S. has significantly impacted Bitcoin mining operations, resulting in substantial…
7 Best Crypto Lightning Network Wallets in 2026: Evaluated & Ranked
Key Takeaways Lightning Network wallets enable fast and cost-effective Bitcoin transactions by using off-chain channels. A variety of…
Solana Price Prediction: Institutions Just Chose SOL Over BTC, ETH, and XRP – Is This the Beginning of a Massive Flippening?
Key Takeaways Institutional investors are increasingly favoring Solana over traditional giants like Bitcoin (BTC), Ethereum (ETH), and XRP.…
Penguin Meme Coin Surged 18,000% After Viral White House Post
Key Takeaways: The Penguin meme coin, known by its ticker PENGUIN, experienced a massive surge in market capitalization…
XRP Price Prediction: XRP Ledger Blasts Past $2 Billion in Tokenized Assets – Why This Could Catapult XRP Parabolic
Key Takeaways XRP Ledger’s (XRPL) tokenized assets have surged past $2 billion, cementing its position in both traditional…