Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

AI Trading Hackathon 2026: Win $1.88M Prize Pool with CoinGecko API (Live Market Data)
One hackathon. Two opportunities. Builders can now win the CoinGecko API track while sharpening their AI trading edge with data-driven strategies in the $1.88 million main competition.

a16z-Backed Crypto Custody Startup to Close, Returning Investor Capital
Key Takeaways Entropy, a decentralized crypto custody startup, is closing its doors after four years due to strategic…
![[LIVE] Crypto News Today: Latest Updates for Jan. 23, 2026 – BTC Slides Below $90K as Crypto Market Extends Broad Sell-Off](https://weex-prod-cms.s3.ap-northeast-1.amazonaws.com/medium_21_2c30f7df62.png)
[LIVE] Crypto News Today: Latest Updates for Jan. 23, 2026 – BTC Slides Below $90K as Crypto Market Extends Broad Sell-Off
Key Takeaways The crypto market is in a downward trend, with GameFi, AI, and RWA sectors showing some…

Solana Price Prediction: 200+ U.S. Stocks Just Landed on SOL – Is This the Most Bullish News of the Year?
Key Takeaways: Solana has integrated over 200 tokenized U.S. stocks and ETFs, enhancing its status as the preferred…

XRP Price Prediction: $1.88 Triple-Bottom Support Amid ETF Money Pull Back – Analyzing Future Directions
Key Takeaways XRP currently stabilizes around $1.88 with triple-bottom support after recent price slips below $2.00. Institutional ETF…

CZ Declares He Won’t Return to Binance After Trump Pardon – What’s Going On?
Changpeng Zhao (CZ) has confirmed he will not return to Binance following his presidential pardon from Donald Trump.…

Crypto Price Prediction Today 22 January – XRP, Solana, Sui
Key Takeaways XRP Price Outlook: XRP remains in a fragile state within a descending channel, with the $1.80…

Cryptocurrency Price Prediction Today 23 January – XRP, Bitcoin, Ethereum
Key Takeaways Bitcoin, Ethereum, and XRP are in distinct phases of consolidation or resistance, with potential for significant…

Ethereum Launches $2M Quantum Defense Team as Threat Timeline Accelerates
Key Takeaways Ethereum has prioritized quantum resistance by establishing a dedicated Post Quantum (PQ) team, allocating $2 million…

Bitcoin & Ethereum ETFs Shed Over $1Billion, Solana and XRP Attract Inflows
Key Takeaways Bitcoin and Ethereum ETFs experienced substantial outflows exceeding $1 billion in just one day, reflecting a…

Ethereum Price Prediction: $3,000 Rejected, But On-Chain Data Reveals a Different Outlook
Key Takeaways Despite the recent price dip, Ethereum’s network fundamentals remain robust and are a strong indicator of…

Shiba Inu Price Prediction: SHIB Team Asserts ‘We’re Not Done Yet’ – Is a Parabolic Move Imminent?
Key Takeaways: Shiba Inu core members suggest the current market cycle may not be complete, hinting at potential…

Solana Price Prediction: Why $126 Could Be the Calm Before SOL’s Next Surge
Key Takeaways Solana’s price hovers around $126, showing signs of stability despite a recent pullback, as traders remain…

XRP Price Prediction: When Traders Get This Quiet, XRP Has a History of Going Wild – Is It About to Happen Again?
Key Takeaways XRP’s Market Quietness as Bullish Signal: Historically, a decrease in trading interest has often been a…

Ethereum Price Prediction: Wall Street Giant BlackRock Embraces Ethereum as Financial Infrastructure – Could ETH Embody the Internet of Money?
Key Takeaways BlackRock sees Ethereum as a cornerstone of future financial systems, positioning it as a leading digital…

Bitcoin Price Prediction: Rich Dad Poor Dad Author Kiyosaki Shrugs Off Price Crash – Here’s Why He’s More Optimistic Than Ever
Key Takeaways Robert Kiyosaki, author of “Rich Dad Poor Dad,” remains bullish on Bitcoin despite recent price fluctuations.…

XRP Price Prediction: XRP Approaches Accumulation Breakout with $1.85 Support as Bullish Targets Eye $4
Key Takeaways XRP’s long-term price indicators suggest a major accumulation phase, maintaining critical support around $1.85. The restoration…

XRP Price Outlook: Steady Gains Amid ETF Revival – Are Whales Ahead of the Curve?
Key Takeaways XRP-linked exchange-traded funds (ETFs) have resumed accumulation after a brief market dip. The resurgence of ETF…
AI Trading Hackathon 2026: Win $1.88M Prize Pool with CoinGecko API (Live Market Data)
One hackathon. Two opportunities. Builders can now win the CoinGecko API track while sharpening their AI trading edge with data-driven strategies in the $1.88 million main competition.
a16z-Backed Crypto Custody Startup to Close, Returning Investor Capital
Key Takeaways Entropy, a decentralized crypto custody startup, is closing its doors after four years due to strategic…
[LIVE] Crypto News Today: Latest Updates for Jan. 23, 2026 – BTC Slides Below $90K as Crypto Market Extends Broad Sell-Off
Key Takeaways The crypto market is in a downward trend, with GameFi, AI, and RWA sectors showing some…
Solana Price Prediction: 200+ U.S. Stocks Just Landed on SOL – Is This the Most Bullish News of the Year?
Key Takeaways: Solana has integrated over 200 tokenized U.S. stocks and ETFs, enhancing its status as the preferred…
XRP Price Prediction: $1.88 Triple-Bottom Support Amid ETF Money Pull Back – Analyzing Future Directions
Key Takeaways XRP currently stabilizes around $1.88 with triple-bottom support after recent price slips below $2.00. Institutional ETF…
CZ Declares He Won’t Return to Binance After Trump Pardon – What’s Going On?
Changpeng Zhao (CZ) has confirmed he will not return to Binance following his presidential pardon from Donald Trump.…