Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

Alibaba Backed Latin America Stablecoin Company, Why VelaFi?
AI Crypto Trading in 2026: How AI Agents Use Stablecoins for Capital Management and Settlement
Learn how AI agents use stablecoins for crypto trading in 2026 — managing capital, settling transactions, and operating across exchanges and DeFi protocols.

US Senate Agriculture Committee Schedules January 27 for Crypto Market Structure Hearing
Key Takeaways The Senate Agriculture Committee will release its crypto market structure bill on January 21, followed by…

Key Market Information Discrepancy on January 14th – A Must-See! | Alpha Early Report
Key Takeaways Bitcoin reached a new milestone, hitting $96,000, while Ethereum surpassed $3,300. Privacy coins such as ORDI…

Tether Freezes $182 Million in Assets in a Day: Is USDT Still a Neutral Coin?
Key Takeaways Tether recently froze $182 million in USDT across five wallets on the Tron blockchain, raising questions…

A Developer’s Three-Year Gamble on Base and the Turn Towards Solana
Key Takeaways: Base’s promise to support developers fell short, leading many to seek more supportive ecosystems. Developer frustration…

ETHGas Foundation Coin Issuance: Examining the Emotional Transaction Mechanism and Global Insights
Key Takeaways Zama’s token auction on CoinList is polarizing, showcasing potential for future applications amidst short-term market skepticism.…

a16z Secures $15 Billion: Redefining Venture Capital Through Visionary Storytelling
Key Takeaways a16z Raises Capital: The firm has raised an astronomical $15 billion, marking a significant point in…

Founder of DeepSeek’s Magic Square Quantitative Strategy Achieved a 56.55% Return in 2025
Key Takeaways Huansquare Quant, led by Liang Wenfeng, achieved a 56.55% return in 2025. The fund’s assets under…

Analyst: MSTR is the “Mullet” of this Bitcoin Bull Cycle, Acting as a Bitcoin Pressure Relief
MSTR absorbed significant volatility in this Bitcoin cycle, easing potential pressure on Bitcoin itself. Michael Saylor’s strategic issuance…

XMR Surges Over 50% in One Week: Who’s Buying?
Key Takeaways Monero (XMR) defies regulatory pressures, marking a 262% increase since January 2025, reaching an all-time high…

BitGo’s Revenue Surges with Upcoming IPO as Institutional Interest Grows
Key Takeaways BitGo, a major player in cryptocurrency custody, aims to raise $201 million through a U.S. IPO…

The New Era in Bitcoin Core Development: The Rise of Core Maintainer TheCharlatan
Key Takeaways Integration of a New Maintainer: For the first time in three years, a new Bitcoin Core…

Bitwise CIO Predicts Parabolic Bitcoin Surge with Sustained ETF Demand
Key Takeaways Prolonged demand for Bitcoin ETFs may lead to a parabolic rise in Bitcoin’s price, drawing parallels…

Binance Alpha to Launch Empire of Sight (Sight) on January 14
Key Takeaways Binance Alpha will kick off the trading of Empire of Sight (Sight) at 16:00 (UTC+8) on…

Today’s Trump Tariff Decision and Economic Data Releases
Key Takeaways The U.S. Supreme Court is set to rule on a significant Trump tariff case that could…

Binance Wallet Partners with Aster, Launches Seamless On-chain Perpetual Contract Trading
Key Takeaways: Binance Wallet has integrated with Aster to offer a streamlined and stable perpetual contract trading feature…

Final Federal Reserve Chair Candidate Rick Rieder, How He Views Cryptocurrency
Key Takeaways Rick Rieder stands out among the Federal Reserve Chair candidates due to his strong pro-crypto stance,…
Alibaba Backed Latin America Stablecoin Company, Why VelaFi?
AI Crypto Trading in 2026: How AI Agents Use Stablecoins for Capital Management and Settlement
Learn how AI agents use stablecoins for crypto trading in 2026 — managing capital, settling transactions, and operating across exchanges and DeFi protocols.
US Senate Agriculture Committee Schedules January 27 for Crypto Market Structure Hearing
Key Takeaways The Senate Agriculture Committee will release its crypto market structure bill on January 21, followed by…
Key Market Information Discrepancy on January 14th – A Must-See! | Alpha Early Report
Key Takeaways Bitcoin reached a new milestone, hitting $96,000, while Ethereum surpassed $3,300. Privacy coins such as ORDI…
Tether Freezes $182 Million in Assets in a Day: Is USDT Still a Neutral Coin?
Key Takeaways Tether recently froze $182 million in USDT across five wallets on the Tron blockchain, raising questions…
A Developer’s Three-Year Gamble on Base and the Turn Towards Solana
Key Takeaways: Base’s promise to support developers fell short, leading many to seek more supportive ecosystems. Developer frustration…