Trust Wallet

Documented events with consequences still open. Each entry carries a source and a date.

1. Dec 24, 2025 Hack / funds theft Critical $9M ● open

   A malicious version of the browser extension (2.68) was published to the Chrome Web Store outside the release process: 2,520 wallets drained, about $8.5 million, voluntary reimbursement still under way

   On 24 December 2025 an "unauthorized and malicious" version of the Trust Wallet Browser Extension, 2.68, was published to the Chrome Web Store "outside of our standard release process" — Trust Wallet's own words in its community update, published on 30 December 2025 and updated on 17 July 2026. Opening the extension on desktop with that version meant having the wallet drained. The official figures: "2,520 wallet addresses that were affected by this incident and drained by the attackers, with approximately $8.5 million in assets impacted that can be associated with 17 wallet addresses controlled by the attacker". The fix is version 2.69, to be installed in place of 2.68. On the cause Trust Wallet publishes no technical post-mortem but a stated likelihood: "the Browser Extension v2.68 incident is likely related to the industry-wide Sha1-Hulud incident in November", which it believes gave the attacker "access to the browser extension source code and the Chrome Web Store API key" — the key used to publish an update signed as if it came from the company. The figure grew over time, worth remembering because all three still circulate: on 25 December ZachXBT spoke of "upwards of $6 million" from an initial list of theft addresses, Changpeng Zhao the same day of "$7m affected so far", and only the later official count reached $8.5 million. On reimbursement: Trust Wallet decided to "voluntarily reimburse the affected users", but the process is NOT closed. The company states it received "over 5,000 claims" against 2,520 verified addresses, "indicating a significant number of duplicate or false submissions", and that "claim reviews are ongoing and handled on a case-by-case basis". As of 30 September 2026 there is no past-tense statement saying reimbursements have been completed, which is why this stays open. Scope, because it matters: the desktop browser extension was hit, not the mobile app.

   ↗ source

verified on Sep 30, 2026

Weighted average across 2 public review platforms (199,681 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.