# Lightly technical walkthrough of Trust wallet extension supply-chain attack

Source: https://slowmist.medium.com/christmas-heist-analysis-of-trust-wallet-browser-extension-hack-bdb35c3cc6dd
Kiwi News: https://news.kiwistand.com/stories/Lightly-technical-walkthrough-of-Trust-wallet-extension-supply-chain-attack?index=0x6952ce9e913c59970b451a8803b228e82415f685eb83bad00107b39147e97a2401b33318
Submitted by thatalexpalmer.eth on 2025-12-29 UTC, 3 upvotes, 0 comments

## Summary

The SlowMist Security Team reports that version 2.68 of the Trust Wallet browser extension contained malicious code that stole users' mnemonic phrases, after Trust Wallet's official X account confirmed a security risk and told users to disable it and upgrade to version 2.69. According to the analysis, the injected code iterated through wallets stored in the extension, retrieved encrypted mnemonic phrases, decrypted them with the user's password or passkeyPassword, and sent them to the domain api.metrics-trustwallet[.]com, which was registered on 2025-12-08. SlowMist estimates losses of about 33 BTC (roughly USD 3 million) on Bitcoin, and roughly USD 3 million on Ethereum mainnet and Layer-2 networks, with stolen funds moved through centralized exchanges and cross-chain bridges.