The Trust Wallet Hacker Code Breach: $6M in Cryptocurrency Stolen Through Malicious Extension

A sophisticated attack targeting Trust Wallet users has resulted in the theft of over $6 million in digital assets, exposing one of the most serious security vulnerabilities in the crypto wallet space. The attack involved hacker code directly embedded into the browser extension’s source code—a development that security researchers classify as an Advanced Persistent Threat (APT) operation.

How the Hacker Code Exploited Trust Wallet Users

On December 8, 2025, attackers registered the malicious domain metrics-trustwallet.com. Two weeks later, on December 21-22, security researchers detected the first data exfiltration attempts. The hacker code operated through a deceptively simple yet effective mechanism: when users unlocked their Trust Wallet browser extension (version 2.68), the malicious code would intercept their encrypted seed phrases.

The vulnerability wasn’t introduced through a compromised third-party library or dependency—instead, the attackers directly injected malicious code into Trust Wallet’s internal codebase. This distinction is critical: it suggests the threat actors gained access to Trust Wallet’s development infrastructure or deployment systems weeks before the attack became public.

The attack methodology relied on stealing users’ encrypted mnemonic phrases by leveraging the passwords or passkeys they entered when unlocking their wallets. The hacker code would then decrypt these phrases and transmit them to the attacker’s command-and-control server (api.metrics-trustwallet[.]com), giving hackers complete control over compromised wallets.

Inside the Attack: Technical Breakdown of the Malicious Hacker Code

Security researchers from SlowMist conducted a detailed analysis by comparing version 2.67 and version 2.68 of the Trust Wallet extension. The findings revealed precisely how the hacker code functioned at the application level.

The malicious payload iterated through all wallets stored in the extension and issued requests to extract the user’s encrypted mnemonic phrase. Once obtained, the code would decrypt the phrase using the authentication credentials the user had entered during wallet unlock. If decryption succeeded—which it would for every legitimate user—the exposed mnemonic phrase was automatically sent to the attacker’s server.

The sophistication of this hacker code suggests professional-grade development. Attackers utilized the legitimate PostHogJS analytics library as a cover, redirecting legitimate analytics data to their malicious infrastructure. This technique allowed the hacker code to blend in with normal wallet operations, evading immediate detection.

Dynamic analysis of the attack revealed that once decrypted, the mnemonic phrase data was embedded in the error message field of network requests—a clever obfuscation technique that allowed stolen credentials to traverse network traffic without raising immediate red flags. BurpSuite traffic analysis confirmed that the stolen recovery phrases were consistently packaged in the errorMessage field before transmission to the attacker’s server.

Tracking the Stolen Assets and Attacker Infrastructure

According to data disclosed by security researcher zachxbt, the heist resulted in substantial losses across multiple blockchains:

• Bitcoin blockchain: Approximately 33 BTC stolen, valued at roughly $2.96 million (at current rates of $89.57K per BTC as of January 2026)
• Ethereum and Layer 2 networks: Around $3 million in combined losses
• Solana blockchain: Approximately $431 stolen
• Other networks: Additional losses from various blockchain ecosystems

Post-theft analysis shows that attackers immediately began moving and exchanging stolen assets through decentralized bridges and multiple centralized exchanges, likely attempting to obscure the origin of funds and complicate recovery efforts.

The malicious domain itself was registered on December 8, 2025, at 02:28:18 UTC through domain registrar NICENIC INTERNATIONA. The timing between domain registration and the first observed data exfiltration attempts strongly suggests this was a carefully coordinated operation—the hacker code wasn’t hastily deployed but rather part of a well-planned campaign.

Immediate Actions: Protecting Your Wallet from Similar Code-Based Attacks

Trust Wallet’s development team confirmed the vulnerability in version 2.68 and released an urgent security advisory. The official response included these critical directives:

If you use Trust Wallet’s browser extension:

1. Disconnect from the internet immediately—this should be your first step before taking any troubleshooting action. Remaining connected while your wallet is potentially compromised increases the risk of complete asset loss.

2. Export your private keys or mnemonic phrases while offline, then uninstall the Trust Wallet extension immediately. Do not re-enable version 2.68 under any circumstances.

3. Upgrade to version 2.69 only after moving your funds to a completely new, secure wallet (either a different wallet application, a hardware wallet, or a fresh account with a newly generated recovery phrase).

4. Transfer all funds to a new wallet address as soon as safely possible. Any cryptocurrency remaining in wallets previously accessed through the compromised version 2.68 should be considered at risk.

The hacker code vulnerability affects all users who had version 2.68 installed, regardless of whether they actively used the extension—the malicious payload executes automatically upon wallet unlock.

Why This Was an APT-Level Hacker Code Threat

Security analysts classify this attack as a sophisticated Advanced Persistent Threat (APT) for several compelling reasons. First, the scope and coordination suggest professional threat actors, not opportunistic hackers. Second, the attacker’s apparent access to Trust Wallet’s development or deployment systems indicates a targeted compromise of infrastructure, not just the public-facing wallet application.

The precision of the hacker code—its ability to target specific wallet unlock mechanisms, decrypt secured phrases, and exfiltrate data through legitimate-looking analytics requests—demonstrates advanced technical capabilities. The month-long gap between domain registration and the attack’s detection window suggests careful planning and reconnaissance.

This incident serves as a stark reminder that even established, well-resourced projects can fall victim to sophisticated supply chain attacks. The hacker code was positioned not as an external threat but as part of the legitimate application itself, making detection extraordinarily difficult for end users until security researchers flagged the anomaly.

Critical reminder: Users should assume that any cryptocurrency stored in wallets previously connected to Trust Wallet version 2.68 is now at risk, and immediate migration to secure alternatives is essential.