Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

HYPE Price Target Achieves $50 as Hyperliquid Reduces Team Token Unlock by 90% — Assessing The Rally’s Longevity
Key Takeaways Hyperliquid significantly cut its monthly token unlocks by 90%, sparking renewed interest in its HYPE token’s…

Hong Kong-Based OSL Group Launches $200M Equity Raise for Stablecoin and Payments Expansion
Key Takeaways OSL Group, a prominent digital asset platform in Asia, has initiated a significant $200 million equity…

Gold Price Prediction: Current Trends and Future Outlook for January 28, 2026
Key Takeaways Gold and silver prices play a significant role in the global economy, reflecting both market trends…

GameStop 2.0? Why Robinhood’s CEO Advocates Tokenization for Trading Halts
Key Takeaways Tokenized stocks are seen as a solution to counteract the disruptions seen in traditional equity markets…

Central Bank of the UAE Endorses First USD-Backed Stablecoin
Key Takeaways The UAE Central Bank has endorsed the first US dollar-backed stablecoin, USDU, to streamline compliant settlements…

Can the Gold Price Rise to $6,000?
Key Takeaways Gold prices in 2026 have experienced dramatic surges, reaching unprecedented levels in just the first month…

Solana Loses Major Portion of Validators as Smaller Nodes Exit: Concerns Over Centralization
Key Takeaways: Solana has experienced a significant drop in active validators from a high of 2,560 in March…

Gold Price Prediction as Tom Lee Says Metals Rally Could Hit Crypto
Key Takeaways: Gold recently reached an all-time high of $5,598, reflecting a strong investor shift towards safe-haven assets…

Bitcoin’s Historical Bottom Indicator Points to $62K – Could BTC Fall That Low?
Key Takeaways Bitcoin is nearing a critical support level of \$62,000, with key indicators suggesting potential further declines.…

Talos Raises $45M Series B Extension Backed by Robinhood, Bringing Total Funding to $150M
Key Takeaways: Talos, a leading provider of institutional digital asset trading technology, has raised $45 million in a…

What is the Next Milestone for Gold Prices and Will It Reach $6,000 by Year End?
Key Takeaways: Gold prices recently crossed the $5,000 per ounce mark, spurring predictions of further increases amidst global…

Bitcoin Price Prediction: Binance Inflows Just Hit a 4-Year Low – Violent Move Above $100K is Next
Key Takeaways: Bitcoin inflows into Binance have dropped to their lowest in four years, potentially signaling a tight…

Gold to $10,000 and Silver to $150: My Wild, Or Perhaps Not-So-Wild 2026 Price Predictions
Key Takeaways Geopolitical uncertainties are significantly driving up the demand for gold and silver, suggesting the prices may…

Hong Kong Enhances Gold Market Access Through Hang Seng Gold ETF and Tokenized Units
Key Takeaways: The Hang Seng Gold ETF offers Hong Kong investors direct access to gold by launching a…

XRP “Millionaire” Wallets Rise Despite Modest Price Dip: Santiment
Key Takeaways: The count of XRP wallets holding over 1 million tokens is increasing, despite a slight dip…

Russia Caps Crypto Investments at $4,000 Annually for Non-Qualified Investors – Will Others Follow Suit?
Key Takeaways Russia’s proposal sets a $4,000 annual investment limit for non-qualified crypto investors, sparking discussions on regulatory…

Japan’s Metaplanet Announces $137 Million Capital Raise Via Third-Party Allotment
Key Takeaways Japanese firm Metaplanet Inc. has strategized a $137 million capital raising through the third-party allotment of…

Crypto Price Prediction for January 28 – XRP, Solana, Bitcoin
Key Takeaways Bitcoin price recently hit $90,000 but struggled to maintain this peak. XRP and Solana are following…
HYPE Price Target Achieves $50 as Hyperliquid Reduces Team Token Unlock by 90% — Assessing The Rally’s Longevity
Key Takeaways Hyperliquid significantly cut its monthly token unlocks by 90%, sparking renewed interest in its HYPE token’s…
Hong Kong-Based OSL Group Launches $200M Equity Raise for Stablecoin and Payments Expansion
Key Takeaways OSL Group, a prominent digital asset platform in Asia, has initiated a significant $200 million equity…
Gold Price Prediction: Current Trends and Future Outlook for January 28, 2026
Key Takeaways Gold and silver prices play a significant role in the global economy, reflecting both market trends…
GameStop 2.0? Why Robinhood’s CEO Advocates Tokenization for Trading Halts
Key Takeaways Tokenized stocks are seen as a solution to counteract the disruptions seen in traditional equity markets…
Central Bank of the UAE Endorses First USD-Backed Stablecoin
Key Takeaways The UAE Central Bank has endorsed the first US dollar-backed stablecoin, USDU, to streamline compliant settlements…
Can the Gold Price Rise to $6,000?
Key Takeaways Gold prices in 2026 have experienced dramatic surges, reaching unprecedented levels in just the first month…