Trust Wallet Hack Drains $6.7M as CZ Vows Full User Reimbursement

Trust Wallet users have lost almost $7 million to hackers on Christmas Day. This follows hackers compromising a version of its web browser extension to drain users’ wallets.

Onchain sleuth ZachXBT first alerted the crypto community about the incident on Telegram. He noted the wallet drained during the update. Trust Wallet pushed a new Chrome extension at the same time.

Trust Wallet Attributes Incident to Browser Extension 2.68

The Trust Wallet team later acknowledged the incident. They noted that it identified a security incident in its browser extension 2.68. It has now asked everyone to disable the extension and upgrade to 2.69.

However, the incident only affected that version of the wallet. The team confirmed that every other version, including the mobile wallet, is fine and without issues.

It added:

Meanwhile, blockchain security experts have identified how the hackers compromised the Trust Wallet extension. Security analyst Akinator claimed that the issue was due to a supply chain attack before the 2.68 version on December 24.

The bad actors reported included a hidden code in the update that sends wallet data to external sources. The code disguises itself as analytics but actually tracks wallet activity and triggers when a seed phrase is imported.

The seed wallet gets sent to a recently registered but now inactive domain, metrics-trustwallet[.]com. This means that hackers were using the seed phrases to drain the wallet.

CZ Promises to Refund Users

With almost $7 million lost by Trust Wallet users, concerns about recovery have increased. ZachXBT, who identified several of the initial theft addresses, noted that several victims have contacted him regarding compensation.

In response to this question, the Trust Wallet team claims its support has started reaching out to affected users. It added that the next steps are being communicated to the victims, and anyone else affected can reach out.

The Trust Wallet team is silent on what the next steps would be. However, Binance co-founder Changpeng Zhao has stated Trust Wallet will cover the losses for victims.

He said:

He added that the team is still investigating how the hackers were able to submit a new version. Some believe that it is most likely traceable to an insider on the team, which Zhao also agrees to as possible.

Zhao’s comment is likely because Binance is the owner of Trust Wallet. Nevertheless, some people believe that the incident could be damaging to the Trust Wallet brand.

However, some expect that the hackers could be tracked down, particularly because the hacker has moved some of the funds. $4.25 million has been sent to HTX, ChangeNOW, FixedFloat, and KuCoin.