Lightly technical walkthrough of Trust wallet extension supply-chain attack

The SlowMist Security Team reports that version 2.68 of the Trust Wallet browser extension contained malicious code that stole users' mnemonic phrases, after Trust Wallet's official X account confirmed a security risk and told users to disable it and upgrade to version 2.69. According to the analysis, the injected code iterated through wallets stored in the extension, retrieved encrypted mnemonic phrases, decrypted them with the user's password or passkeyPassword, and sent them to the domain api.metrics-trustwallet[.]com, which was registered on 2025-12-08. SlowMist estimates losses of about 33 BTC (roughly USD 3 million) on Bitcoin, and roughly USD 3 million on Ethereum mainnet and Layer-2 networks, with stolen funds moved through centralized exchanges and cross-chain bridges.