TLDR
The Trust Wallet hack was caused by a malicious update to its Chrome browser extension (version 2.68), a supply chain compromise that injected code to steal seed phrases and drain wallets The Defiant report.
- Attackers likely used a leaked Chrome Web Store API key to publish the malicious update, bypassing release controls CoinGape coverage.
- Losses were about $7 million, and the team says verified victims will be reimbursed Cointelegraph update.
- The issue was confined to the extension and fixed in v2.69; mobile app users were not affected Bitcoinist summary.
Deep Dive
1. Malicious Update
The root cause was a compromised browser extension update that harvested recovery phrases from affected desktops. Security analysts compared versions and found code inserted into v2.68 that iterated wallets and requested mnemonics, then exfiltrated data via an analytics-like module The Defiant analysis. Independent summaries describe a supply chain attack where malicious JavaScript was embedded in the update, triggering drains when users imported seed phrases CCN explainer.
Browser extensions add attack surface. Avoid entering seed phrases in any browser context, and prefer hardware or well-audited desktop clients for high balances.
2. API Key Leak Path
Multiple reports point to a leaked Chrome Web Store API key that let attackers push the malicious v2.68 update on 24 Dec, sidestepping normal release checks CoinGape coverage. Follow-ups echo this as the likely submission vector while the exact injection step is still under investigation U.Today note.
Distribution pipelines are critical. Even if core code is secure, compromised publishing credentials can insert backdoors into trusted channels.
3. Scope and Reimbursement
Trust Wallet and Binances founder confirmed roughly $7 million was stolen, and verified users will be compensated, with the extension fixed in v2.69 and mobile unaffected Cointelegraph update. The team identified 2,596%%CKPROTECTED5%% impacted addresses and moved to a verification phase to filter false claims before reimbursements TradingView summary.
Reimbursement reduces direct losses, but expect a careful verification process and delays. Monitor official notices for eligibility and next steps.
Conclusion
The hack stemmed from a supply chain compromise of the Trust Wallet Chrome extension, likely enabled by a leaked publishing key and malicious code that captured seed phrases. The impact was limited to desktop extension users during the affected window, a fix was shipped quickly, and reimbursements are underway. The broader takeaway is to harden software distribution and minimize browser-based exposure for sensitive wallet operations.
CoinsKid.Com