Hacked Christmas: What happened to Trust Wallet

Traders Union
All News
Editors' Picks
What happened to Trust Wallet

The path to mass adoption

Trust Wallet emerged in 2017, at a time when non-custodial wallets were not yet a mass phenomenon. Most users kept their crypto assets on exchanges, while the idea of full personal control over private keys remained largely a principle for enthusiasts. Trust Wallet offered a simple alternative. It was a mobile wallet without complex settings and with a clear premise: the keys belong to the user, not the service.

In 2018, the project was acquired by Binance. For Trust Wallet, this meant scale and credibility, but not a change in its underlying model. The wallet retained its non-custodial status and gradually became part of the basic toolkit for new participants entering the crypto market. It was often recommended as a first wallet, the starting point for getting acquainted with Web3.

A wallet as a universal tool

As the market evolved, so did Trust Wallet itself. It moved beyond simple asset storage and became a multifunctional product. Support for dozens of blockchains, integration with DeFi protocols, NFTs, staking, and a built-in decentralized application browser gradually shaped its image as an everyday wallet.

A separate milestone was the launch of the browser extension. It allowed users to interact with Web3 services directly from their browsers and became an alternative to already familiar solutions. For many, it was the same Trust Wallet in a different environment, with the same level of trust in the brand.

The day an update became a threat

The events of December 25 showed just how fragile that trust could be. The common factor among all affected users was the Trust Wallet browser extension for Chrome, updated on December 24 to version 2.68. Users did not install third-party software or interact with suspicious resources. They simply applied an official update.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

A malicious JavaScript fragment appeared in the extension’s code. It was disguised as analytics and did not interfere with normal wallet usage. The code was triggered only at a specific moment, when a user imported a seed phrase. The data was sent to a third-party domain registered just days before the attack. Once attackers gained access to seed phrases, they were able to drain funds from wallets almost instantly.

The scale of the attack and the community’s response

The first to systematically draw attention to the incident was blockchain investigator ZachXBT. He identified several addresses that were accumulating funds from hundreds of wallets. The attack affected multiple networks at once, including Bitcoin, Ethereum, and Solana. According to analysts’ estimates, total losses reached $6–7 million. Part of the funds was quickly transferred to centralized services for cash-out.

The Trust Wallet team confirmed the incident on social media and urged users to immediately disable version 2.68 and update to version 2.69. The company emphasized that mobile applications were not impacted. Binance founder Changpeng Zhao stated that Trust Wallet would compensate users for their losses.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

What this hack says about the state of Web3

The Trust Wallet incident has become illustrative for the entire industry. In 2025, crypto-related crime continues to grow, and attacks increasingly target infrastructure rather than individual users. Browser wallet extensions, with their elevated access privileges, are becoming critical points of risk.

The Trust Wallet hack was not the result of user error or a weakness in blockchain technology. It strongly suggested that the most vulnerable layer remains the software between people and networks. That is where the main frontline of cybersecurity in the crypto industry lies today.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.