Trust Wallet Warns Chrome Users of Key Harvesting Issue
Trust Wallet issues emergency warning after malicious script in browser extension endangers private keys. $7 million loss expected.
- Trust Wallet’s Chrome extension security breach risks private keys.
- Malicious version bypassed manual release checks.
- Users face potential $7 million crypto losses.
Trust Wallet identified a malicious script in a Chrome extension update on December 24, 2025, which compromised user private keys, resulting in approximately $7 million losses.
The incident raised significant security concerns, focusing on potential insider exploitation and highlighted vulnerabilities in software release processes, affecting Trust Wallet Chrome users globally.
Breach and Impact
Trust Wallet recently issued an emergency warning for its users after identifying a security flaw in the Chrome extension. The issue involved a malicious script that harvested private keys, posing a threat to user assets.
Eowyn Chen, CEO of Trust Wallet, confirmed a breach resulting from a compromised Chrome API key, bypassing standard release procedures. The malicious version, 2.68, went live without official approval, affecting users who logged in pre-December 26.
The malicious extension v2.68 was NOT released through our internal manual process. Our current findings suggest it was most likely published externally through the Chrome Web Store API key, bypassing our standard release checks. — Eowyn Chen, CEO, Trust Wallet
The breach has led to approximately $7 million in losses, impacting crypto users globally. Three hundred Trust Wallet users entered their seed phrases during the affected period, exposing assets across multiple blockchain networks.
Despite these losses, Trust Wallet pledged to refund affected users while warning against scams exploiting this security breach. Instructions will be provided via their official channels, emphasizing caution among the user community.
Industry Implications
Trust Wallet’s incident underscores broader risks in extension security, joining a lineup of industry challenges in 2025. While no specific government actions have been documented, user vigilance is urged amid this breach.
Industry experts anticipate tighter security measures and potential regulatory scrutiny following this incident. The breach serves as a reminder of the importance of cybersecurity, with 713 million reported in similar losses in 2025 due to compromised browser extensions.
More From Crypto News
Cross River Integrates Ripple’s RLUSD Into Core Banking Platform
RLUSD is Ripple’s dollar-pegged stablecoin, designed to facilitate institutional payment and settlement workflows.
Crypto Market Cap Rose 39% in Q3, Ending Losing Streak: Report
The global crypto market capitalization posted a 39% gain in Q3, snapping a three-consecutive-quarter losing streak, according to a CoinGecko industry report. T...
Ledger Implant Thieves Steal $4.8M Bitcoin From Task Scam Operator
Blockchain analytics firm Chainalysis has identified one of the largest victims of the Ledger hardware-wallet implant theft as a task scam operator, who lost mo...
Zcash NU7 Rules Would Block Sprout Pool Spending
Zcash’s proposed NU7 network upgrade would permanently block spending from the Sprout pool by invalidating version 4 transactions, the only transaction format t...
Aave Ethereum V3 Umbrella Stakes Fall 9.67% to $116.09M
Aave Umbrella is the protocol’s safety backstop mechanism on Ethereum V3, where participants stake assets to cover potential shortfalls. The tracked stake figur...
SEC Approves Cboe Binary Options Rules for Coinbase and MARA Metrics
The SEC has approved rule changes submitted by Cboe, clearing the regulatory path for a new class of binary options contracts linked to business metrics of Coin...
