Crypto Christmas Heist: Over $6 Million Lost, Trust Wallet Chrome Extension Wallet Hacked Analysis
Original Title: "Christmas Heist | Trust Wallet Browser Extension Wallet Hacked Analysis"
Original Source: SlowMist Technology
Background
Early this morning Beijing time, @zachxbt announced in the channel, "Some Trust Wallet users reported that funds in their wallet addresses have been stolen in the past few hours." Subsequently, Trust Wallet's official X also released an official statement confirming a security vulnerability in Trust Wallet Browser Extension version 2.68, advising all users using version 2.68 to immediately disable this version and upgrade to version 2.69.

Tactics
Upon receiving the intelligence, the SlowMist security team promptly conducted an analysis of the relevant samples. Let's first compare the core code of the previously released 2.67 and 2.68 versions:


By diffing the code of the two versions, we found the malicious code added by the hacker:

The malicious code will traverse all wallets in the plugin, make a "get mnemonic phrase" request for each user's wallet to obtain the user's encrypted mnemonic phrase, and finally use the password or passkeyPassword entered by the user when unlocking the wallet for decryption. If decryption is successful, the user's mnemonic phrase will be sent to the attacker's domain `api.metrics-trustwallet[.]com`.

We also analyzed the attacker's domain information; the attacker used the domain: metrics-trustwallet.com.

Upon investigation, the registration time of this malicious domain was 2025-12-08 02:28:18, and the domain registrar is: NICENIC INTERNATIONA.
Request records targeting api.metrics-trustwallet[.]com began on 2025-12-21.

This timestamp and the implantation of the backdoor with code 12.22 are roughly the same.
We continue to reproduce the entire attack process through code tracking analysis:
Through dynamic analysis, it can be seen that after unlocking the wallet, the attacker filled the mnemonic information into the error in R1.

And the source of this Error data is obtained through the GET_SEED_PHRASE function call. Currently, Trust Wallet supports two ways to unlock: password and passkeyPassword. The attacker, during the unlocking process, obtained the password or passkeyPassword, then called GET_SEED_PHRASE to obtain the wallet's mnemonic phrase (private key as well), and then placed the mnemonic phrase in the "errorMessage".

Below is the code using emit to call GetSeedPhrase to obtain the mnemonic phrase data and fill it into the error.

Traffic analysis performed through BurpSuite shows that after obtaining the mnemonic phrase, it is encapsulated in the request body's errorMessage field and sent to a malicious server (https[://]api[.]metrics-trustwallet[.]com), which is consistent with the previous analysis.

Through the above process, the theft of the mnemonic phrase/private key is completed. In addition, the attacker is also familiar with the source code and utilizes the open-source full-lifecycle product analysis platform PostHogJS to collect user wallet information.
Stolen Asset Analysis

(https://t.me/investigations/296)
According to ZachXBT's disclosed hacker address, we have calculated that as of the time of publication, the total amount of stolen assets on the Bitcoin blockchain is approximately 33 BTC (valued at around 3 million USD), the stolen assets on the Solana blockchain are valued at around 431 USD, and the stolen assets on the Ethereum mainnet and Layer 2 chains are valued at around 3 million USD. After stealing the coins, the hacker used various centralized exchanges and cross-chain bridges to transfer and exchange some of the assets.


Summary
This backdoor incident originated from a malicious code modification to the Trust Wallet extension's internal codebase (analytics service logic), rather than the introduction of a tampered third-party package (such as a malicious npm package). The attacker directly altered the application's own code, using the legitimate PostHog library to redirect analytics data to a malicious server. Therefore, we have reason to believe this was a professional APT attack, where the attacker may have gained control of Trust Wallet-related developers' device or release deployment permissions prior to December 8.
Recommendations:
1. If you have installed the Trust Wallet extension wallet, you should immediately disconnect from the internet as a prerequisite for investigation and actions.
2. Immediately export your private key/mnemonic phrase and uninstall the Trust Wallet extension wallet.
3. After backing up your private key/mnemonic phrase, promptly transfer your funds to another wallet.
You may also like

What Happened in Crypto Today? Solana-Native Rails Launch on Digitap ($TAP) as the Best Crypto to Buy
Key Takeaways Digitap ($TAP) spearheads the transition toward real-world utility in cryptocurrency, offering a seamless financial ecosystem through…

Here’s Why Fed Contender Kevin Warsh is Seen as Bearish for Bitcoin
Key Takeaways Kevin Warsh is a potential nominee for the U.S. Federal Reserve chair, causing concerns due to…

XRP Breaks Below Its 1-Year Support Range: What’s Next?
Key Takeaways XRP has slipped below its critical support range of $1.8 to $2.1, which had been steadfast…

XRP Price Breakdown Intensifies — Can Support Mitigate the Shock?
Key Takeaways XRP has dipped below the significant $1.80 mark, continuing its downtrend. The asset is trading beneath…

XRP Risk-Adjusted Returns Suggest a Period of Consolidation – Insights and Analysis
Key Takeaways: XRP’s recent price fluctuations highlight a lack of strong market momentum for a trend reversal. The…

Kevin Warsh Associated with Crypto Project Basis and Electric Capital
Key Takeaways Kevin Warsh, former U.S. Federal Reserve Board Governor, is associated with crypto initiatives Basis and Electric…

Why is Trump’s Fed Chair Pick Kevin Warsh Seen as Bad News for Precious Metals, Commodities, Bitcoin, and Equities?
Key Takeaways: Kevin Warsh, once appointed, is expected to take a more hawkish stance on monetary policy, which…

Who Is Kevin Warsh? How His Fed Chair Odds Are Influencing Bitcoin Markets
Key Takeaways Kevin Warsh, a former Federal Reserve governor, is becoming a strong candidate for the next Fed…

Strategy (MSTR) Stock: Michael Saylor’s Bitcoin Bet Goes Red But Here’s The Twist
Key Takeaways Strategy’s Bitcoin investment has dipped below its average purchase price, highlighting market volatility. No immediate financial…

Gov-Backed Asset or Solana Meme? Uncovering the Reality Behind the USOR Crypto Frenzy
Key Takeaways USOR, a Solana token, sparked a debate over its legitimacy by claiming associations with U.S. strategic…

Bitcoin Hashrate Falls 12% After US Winter Storms Hit Miners
Key Takeaways: The total network hashrate for Bitcoin has declined by approximately 12% since November 11, marking the…

Gold’s Six-Month Rally Against Bitcoin Shows Parallels to 2019 Cycle
Key Takeaways Gold has consistently outperformed bitcoin over the last six months, despite being typically considered the haven…

Mantle’s Cross-Chain Era on Solana: Onboarding the Bybit Express to Mantle Super Portal
Key Takeaways Bybit joins forces with Mantle to enhance cross-chain asset flows through the Mantle Super Portal. Mantle…

XRP Price Outlook for 2026: Is Bitcoin Hyper Part of Long Term Themes?
Key Takeaways The potential future of XRP in 2026 is significant, with various factors influencing its growth and…

Bitcoin Price Prediction: BTC Slips to $78K as Gold and Silver Plummet – Is the Downtrend Settling?
Key Takeaways Bitcoin and traditional safe havens like gold and silver experience synchronized declines in a volatile market…

$30 Million Heist: Step Finance Treasury Wallets Breached
Key Takeaways Step Finance, a prominent Solana-based DeFi platform, faced a significant security breach, losing approximately $30 million…

Bitcoin Price Prediction: $50B Volume Drops 40% as BTC Tests $83K – Is a Breakdown Next?
Key Takeaways: Bitcoin’s trading volume has seen a significant decline, indicating cautious trader behavior. Bitcoin prices remain under…

Bitcoin’s 7% Drop to $77K Might Indicate Cycle Low, Analyst Suggests
Key Takeaways: Bitcoin has experienced a significant drop from $77,000 to around $78,600 after a modest rebound. Analyst…
What Happened in Crypto Today? Solana-Native Rails Launch on Digitap ($TAP) as the Best Crypto to Buy
Key Takeaways Digitap ($TAP) spearheads the transition toward real-world utility in cryptocurrency, offering a seamless financial ecosystem through…
Here’s Why Fed Contender Kevin Warsh is Seen as Bearish for Bitcoin
Key Takeaways Kevin Warsh is a potential nominee for the U.S. Federal Reserve chair, causing concerns due to…
XRP Breaks Below Its 1-Year Support Range: What’s Next?
Key Takeaways XRP has slipped below its critical support range of $1.8 to $2.1, which had been steadfast…
XRP Price Breakdown Intensifies — Can Support Mitigate the Shock?
Key Takeaways XRP has dipped below the significant $1.80 mark, continuing its downtrend. The asset is trading beneath…
XRP Risk-Adjusted Returns Suggest a Period of Consolidation – Insights and Analysis
Key Takeaways: XRP’s recent price fluctuations highlight a lack of strong market momentum for a trend reversal. The…
Kevin Warsh Associated with Crypto Project Basis and Electric Capital
Key Takeaways Kevin Warsh, former U.S. Federal Reserve Board Governor, is associated with crypto initiatives Basis and Electric…