Trust Wallet Exploit Results in $7 Million Loss for Users
Trust Wallet users lost approximately $7 million in a Christmas Day exploit that had been planned since early December. The exploit targeted the browser extension version 2.68 of Trust Wallet, a cryptocurrency wallet that claims to serve 220 million users and is owned by Binance. According to Trust Wallet, the security incident impacted desktop users, and the company advised users to upgrade to version 2.89 to prevent further damage.
Changpeng Zhao, co-founder of Binance, announced in a Friday X post that the lost funds will be covered. This move aims to reassure users and maintain trust in the platform. Cryptocurrency wallet exploits have become an increasing threat to digital asset investors, with personal wallet compromises accounting for 37% of the value stolen in 2025, excluding the $1.4 billion Bybit hack in February, according to Chainalysis.
Crypto hack volume over time, personal wallet hack proportion with 2025 adjustment scenario for the Bybit hack. Source: Chainalysis.com
The $7 million Trust Wallet exploit is significant but pales in comparison to some of the biggest wallet hacks. In February 2024, the co-founder of play-to-earn game Axie Infinity, Jeff Zirlin, lost $9.7 million worth of Ether (ETH) to a suspected wallet exploit. The increasing frequency and severity of these exploits highlight the need for enhanced security measures in the cryptocurrency industry.
Crypto Industry Watchers Raise Insider Concerns
The orchestrators of the attack on Trust Wallet had been preparing the exploit as early as Dec. 8, according to Yu Xian, co-founder of blockchain security firm SlowMist. A machine translation of his post revealed that the attacker started preparations on Dec. 8, successfully implanted the backdoor on Dec. 22, began transferring funds on Christmas Day, and was thus discovered. The backdoor code was also collecting users’ personal information, which was sent to the attacker’s server.
According to onchain detective ZachXBT, “hundreds” of Trust Wallet users were affected. Some industry watchers pointed to signs of potential insider activity from the exploit, as the attacker was able to submit a new version of the Trust Wallet extension on the website. This has raised concerns about the possibility of an insider being involved in the exploit.
Source: Cos
CZ agreed that the exploit was “most likely” an insider. SlowMist’s Xian also noted that the attacker was “very familiar with the Trust Wallet extension’s source code,” which enabled them to implement the backdoor code necessary to collect sensitive user information. The involvement of an insider would have significant implications for the security and trust of cryptocurrency platforms.
Conclusion and Next Steps
The Trust Wallet exploit is a reminder of the importance of robust security measures in the cryptocurrency industry. As the industry continues to evolve, it is crucial for platforms to prioritize user security and implement effective measures to prevent such exploits. For more information on the Trust Wallet exploit and the latest developments in the cryptocurrency industry, visit Here
Smart Tip for Readers
To protect your cryptocurrency assets, always keep your wallet software up to date and be cautious when installing extensions or providing personal information online. Regularly monitoring your accounts and transactions can also help detect any suspicious activity early on.
