🚨SlowMist: Analysis of Trust Wallet Browser Extension Hack🚨 Today,...
SlowMist@SlowMist_Team
20 views
Dec 28, 2025
~2 min read
Advertisement
1
🚨SlowMist: Analysis of Trust Wallet Browser Extension Hack🚨
Today, @TrustWallet issued a statement confirming that version 2.68 of the Trust Wallet browser extension contains a security risk. Below is our detailed breakdown:👇
Today, @TrustWallet issued a statement confirming that version 2.68 of the Trust Wallet browser extension contains a security risk. Below is our detailed breakdown:👇
Trust Wallet@TrustWallet
We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69.
Please refer to the official Chrome Webstore link here: chrome.google.com/webstore/detai…
Please note: Mobile-only users and all other browser extension versions are not impacted.
We understand how concerning this is and our team is actively working on the issue.
We’ll keep sharing updates as soon as possible.
Please refer to the official Chrome Webstore link here: chrome.google.com/webstore/detai…
Please note: Mobile-only users and all other browser extension versions are not impacted.
We understand how concerning this is and our team is actively working on the issue.
We’ll keep sharing updates as soon as possible.
2
1️⃣A diff comparison between v2.67 and v2.68 revealed malicious code secretly inserted into the 2.68 update. This injected code iterates through all wallets stored in the extension, triggering a get mnemonic phrase request for each wallet. The encrypted mnemonic is then decrypted using the password or passkeyPassword entered during wallet unlock.
🕸️Once decrypted, the mnemonic phrase is sent to the attacker’s server: api.metrics-trustwallet[.]com
👁️Further analysis of domain information shows that the attacker used the domain metrics-trustwallet[.]com was registered on 2025-12-08 02:28:18 (registrar: NICENIC INTERNATIONAL). Network records indicate the first requests to api.metrics-trustwallet[.]com began on 2025-12-21, which aligns with the code backdoor insertion time on Dec 22.
🕸️Once decrypted, the mnemonic phrase is sent to the attacker’s server: api.metrics-trustwallet[.]com
👁️Further analysis of domain information shows that the attacker used the domain metrics-trustwallet[.]com was registered on 2025-12-08 02:28:18 (registrar: NICENIC INTERNATIONAL). Network records indicate the first requests to api.metrics-trustwallet[.]com began on 2025-12-21, which aligns with the code backdoor insertion time on Dec 22.
3
2️⃣We further traced and reproduced the entire attack flow through code execution:
👉 After unlocking the wallet, the attacker populates the mnemonic data into the “Error” field (visible in register R1), this Error data is obtained through a call to the GET_SEED_PHRASE function.
👉 When the wallet is unlocked, the attacker obtains the password or passkeyPassword, then calls GET_SEED_PHRASE to retrieve the wallet’s mnemonic phrase (similarly for the private key), and then places the mnemonic phrase into the “errorMessage.”
👉 Traffic analysis through BurpSuite reveals that after retrieving the mnemonic, it is wrapped inside the request body’s errorMessage field and then transmitted to the malicious server (https[://]api[.]metrics-trustwallet[.]com), matching our previous assessment.
🧵Additionally, it appears the attacker is familiar with the extension‑source code, leveraging an open‑source full‑chain analytics platform — PostHog JS — to harvest wallet user information.
👉 After unlocking the wallet, the attacker populates the mnemonic data into the “Error” field (visible in register R1), this Error data is obtained through a call to the GET_SEED_PHRASE function.
👉 When the wallet is unlocked, the attacker obtains the password or passkeyPassword, then calls GET_SEED_PHRASE to retrieve the wallet’s mnemonic phrase (similarly for the private key), and then places the mnemonic phrase into the “errorMessage.”
👉 Traffic analysis through BurpSuite reveals that after retrieving the mnemonic, it is wrapped inside the request body’s errorMessage field and then transmitted to the malicious server (https[://]api[.]metrics-trustwallet[.]com), matching our previous assessment.
🧵Additionally, it appears the attacker is familiar with the extension‑source code, leveraging an open‑source full‑chain analytics platform — PostHog JS — to harvest wallet user information.
4
3️⃣Based on addresses disclosed by @zachxbt and @MistTrack_io on-chain tracking:
🔹BTC losses: ~33 BTC (~$3M)
🔹Solana losses: ~$431
🔹Ethereum + L2 losses: ~$3M+
The attacker moved stolen funds through centralized exchanges and cross-chain bridges for laundering and swapping.
🔹BTC losses: ~33 BTC (~$3M)
🔹Solana losses: ~$431
🔹Ethereum + L2 losses: ~$3M+
The attacker moved stolen funds through centralized exchanges and cross-chain bridges for laundering and swapping.
5
4️⃣Conclusion
This backdoor incident originated from malicious source code modification within the internal Trust Wallet extension codebase (analytics logic), rather than an injected compromised third‑party dependency (e.g., malicious npm package). The attacker directly tampered with the application’s own code, then leveraged the legitimate PostHog analytics library as the data‑exfiltration channel, redirecting analytic traffic to an attacker‑controlled server.💻
🔍Thus, we have strong reason to believe this is a professional #APT‑level attack. The attacker may have already gained control of Trust Wallet‑related developer devices or publishing‑deployment permissions prior to December 8.
This backdoor incident originated from malicious source code modification within the internal Trust Wallet extension codebase (analytics logic), rather than an injected compromised third‑party dependency (e.g., malicious npm package). The attacker directly tampered with the application’s own code, then leveraged the legitimate PostHog analytics library as the data‑exfiltration channel, redirecting analytic traffic to an attacker‑controlled server.💻
🔍Thus, we have strong reason to believe this is a professional #APT‑level attack. The attacker may have already gained control of Trust Wallet‑related developer devices or publishing‑deployment permissions prior to December 8.
6
5️⃣Mitigation Recommendations🛡
🔹If you have ever installed the Trust Wallet browser extension, immediately disconnect your device from the network before performing any investigation or operations.
🔹Export your private key/mnemonic phrase immediately and uninstall the Trust Wallet browser extension.
🔹After backing up the mnemonic/private key, quickly transfer your funds to another secure wallet.
📄 Full detailed analysis by SlowMist:
slowmist.medium.com/christmas-heis…
🔹If you have ever installed the Trust Wallet browser extension, immediately disconnect your device from the network before performing any investigation or operations.
🔹Export your private key/mnemonic phrase immediately and uninstall the Trust Wallet browser extension.
🔹After backing up the mnemonic/private key, quickly transfer your funds to another secure wallet.
📄 Full detailed analysis by SlowMist:
slowmist.medium.com/christmas-heis…
