Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like
AI Trading's Ultimate Test: Empower Your AI Strategy with Tencent Cloud to Win $1.88M & a Bentley
AI traders! Win $1.88M & a Bentley by crushing WEEX's live-market challenge. Tencent Cloud powers your AI Trading bot - can it survive the Feb 9 finals?

Russia’s Largest Bitcoin Miner BitRiver Faces Bankruptcy Crisis – What Went Wrong?
Key Takeaways BitRiver, the largest Bitcoin mining operator in Russia, faces a bankruptcy crisis due to unresolved debts…

Polymarket Predicts Over 70% Chance Bitcoin Will Drop Below $65K
Key Takeaways Polymarket bettors forecast a 71% chance for Bitcoin to fall below $65,000 by 2026. Strong bearish…

BitMine Reports 4.285M ETH Holdings, Expands Staked Position With Massive Reward Outlook
Key Takeaways BitMine Immersion Technologies holds 4,285,125 ETH, which is approximately 3.55% of Ethereum’s total supply. The company…

US Liquidity Crisis Sparked $250B Crash, Not a ‘Broken’ Crypto Market: Analyst
Key Takeaways: A massive $250 billion crash shook the cryptocurrency markets, attributed largely to liquidity issues in the…

Vitalik Advocates for Anonymous Voting in Ethereum’s Governance — A Solution to Attacks?
Key Takeaways Vitalik Buterin proposes a two-layer governance framework utilizing anonymous voting to address collusion and capture attacks,…

South Korea Utilizes AI to Pursue Unfair Crypto Trading: Offenders Face Severe Penalties
Key Takeaways South Korea is intensifying its use of AI to crack down on unfair cryptocurrency trading practices.…

Average Bitcoin ETF Investor Turns Underwater After Major Outflows
Key Takeaways: U.S. spot Bitcoin ETFs hold approximately $113 billion in assets, equivalent to around 1.28 million BTC.…

Japan’s Biggest Wealth Manager Adjusts Crypto Strategy After Q3 Setbacks
Key Takeaways Nomura Holdings, Japan’s leading wealth management firm, scales back its crypto involvement following significant third-quarter losses.…

CFTC Regulatory Shift Could Unlock New Opportunities for Coinbase Prediction Markets
Key Takeaways: The U.S. Commodity Futures Trading Commission (CFTC) is focusing on clearer regulations for crypto-linked prediction markets,…

Hong Kong Set to Approve First Stablecoin Licenses in March — Who’s In?
Key Takeaways Hong Kong’s financial regulator, the Hong Kong Monetary Authority (HKMA), is on the verge of approving…

BitRiver Founder and CEO Igor Runets Detained Over Tax Evasion Charges
Key Takeaways: Russian authorities have detained Igor Runets, CEO of BitRiver, on allegations of tax evasion. Runets is…

Crypto Investment Products Struggle with $1.7B Outflows Amid Market Turmoil
Key Takeaways: The recent $1.7 billion outflow in the crypto investment sector represents a second consecutive week of…

Why Is Crypto Down Today? – February 2, 2026
Key Takeaways: The crypto market has seen a downturn today, with a significant decrease of 2.9% in the…

Nevada Court Temporarily Bars Polymarket From Offering Contracts in the State
Key Takeaways A Nevada state court has temporarily restrained Polymarket from offering event contracts in the state, citing…

Bitcoin Falls Below $80K As Warsh Named Fed Chair, Triggers $2.5B Liquidation
Key Takeaways Bitcoin’s price tumbled below the crucial $80,000 mark following the announcement of Kevin Warsh as the…

Strategy’s Bitcoin Holdings Face $900M in Losses as BTC Slips Below $76K
Key Takeaways Strategy Inc., led by Michael Saylor, faces over $900 million in unrealized losses as Bitcoin price…

Trump-Linked Crypto Company Secures $500M UAE Investment, Sparking Conflict Concerns
Key Takeaways A Trump-affiliated crypto company, World Liberty Financial, has garnered $500 million from UAE investors, igniting conflict…
AI Trading's Ultimate Test: Empower Your AI Strategy with Tencent Cloud to Win $1.88M & a Bentley
AI traders! Win $1.88M & a Bentley by crushing WEEX's live-market challenge. Tencent Cloud powers your AI Trading bot - can it survive the Feb 9 finals?
Russia’s Largest Bitcoin Miner BitRiver Faces Bankruptcy Crisis – What Went Wrong?
Key Takeaways BitRiver, the largest Bitcoin mining operator in Russia, faces a bankruptcy crisis due to unresolved debts…
Polymarket Predicts Over 70% Chance Bitcoin Will Drop Below $65K
Key Takeaways Polymarket bettors forecast a 71% chance for Bitcoin to fall below $65,000 by 2026. Strong bearish…
BitMine Reports 4.285M ETH Holdings, Expands Staked Position With Massive Reward Outlook
Key Takeaways BitMine Immersion Technologies holds 4,285,125 ETH, which is approximately 3.55% of Ethereum’s total supply. The company…
US Liquidity Crisis Sparked $250B Crash, Not a ‘Broken’ Crypto Market: Analyst
Key Takeaways: A massive $250 billion crash shook the cryptocurrency markets, attributed largely to liquidity issues in the…
Vitalik Advocates for Anonymous Voting in Ethereum’s Governance — A Solution to Attacks?
Key Takeaways Vitalik Buterin proposes a two-layer governance framework utilizing anonymous voting to address collusion and capture attacks,…