Trust Wallet Hack: $7M Stolen, CZ Hints at Insider Role

The security incident was first flagged publicly by on-chain investigator ZachXBT, who issued a community alert after multiple Trust Wallet users reported unauthorized outflows from their addresses within hours. The reports coincided with a recent update to the Trust Wallet Chrome extension. Blockchain security firm SlowMist quickly confirmed the vulnerability was specific to Trust Wallet Browser Extension version 2.68, urging users to immediately disable it and upgrade to version 2.69 via the official Chrome Web Store.

According to SlowMist’s preliminary findings, the incident may involve a supply chain attack, where malicious code was potentially injected into the extension itself. This code is believed to have allowed attackers to exfiltrate users’ seed phrases—the master keys to their crypto holdings—when the wallet was unlocked, transmitting them to a malicious website. Trust Wallet later confirmed on X that only version 2.68 of its browser extension was impacted, assuring mobile-only users and those on other browser extension versions were not affected. The company advised users on the vulnerable version to avoid opening the extension until completing the update, warning that continued use exposed them to further risk.

Binance founder and Trust Wallet owner Changpeng ‘CZ’ Zhao addressed the situation publicly, confirming that Trust Wallet would cover the losses linked to the incident and stating that user funds remain secure. CZ estimated that approximately $7 million had been impacted and explicitly described the event as a hack. Significantly, he hinted at possible insider involvement, suggesting the breach may have leveraged internal access or knowledge. This acknowledgment from the platform’s owner adds a layer of complexity to the incident, pointing to potential internal security failures rather than just external exploitation.

Following CZ’s statement, ZachXBT provided an update indicating that affected users would be compensated. The commitment to cover losses is a critical move for user trust, but it does not mitigate the underlying security failure. The incident highlights the concentrated risk when a single point of failure—a compromised browser extension update—can lead to widespread financial damage. With early estimates suggesting hundreds of wallets were affected, the breach demonstrates how quickly vulnerabilities can be exploited at scale in the crypto ecosystem.

The Trust Wallet breach is not an isolated event but part of a disturbing trend in cryptocurrency theft. According to blockchain analytics firm Chainalysis, more than $3.4 billion in cryptocurrencies was stolen from January through early December 2024, slightly exceeding the $3.38 billion recorded in the same period last year. This consistent high level of theft underscores the persistent attractiveness of crypto assets to malicious actors.

More alarmingly, the nature of these thefts is shifting dramatically. Chainalysis data reveals that compromises related to personal wallets, like the one suffered by Trust Wallet users, have witnessed explosive growth. Such incidents constituted just 7.3% of total stolen value in 2022 but skyrocketed to 44% in 2024. This indicates attackers are increasingly targeting individual user endpoints—such as browser extensions and software wallets—rather than exclusively focusing on centralized exchanges or protocols. The Trust Wallet incident, involving a suspected supply chain attack on a browser extension, epitomizes this dangerous evolution in attack vectors.

The episode adds to growing concerns around browser-based wallet security, where supply chain attacks and malicious updates have become a common vector for theft. As the crypto industry grapples with these sophisticated threats, the burden of security increasingly falls on users to vigilantly manage updates and on wallet providers to ensure the integrity of their software distribution channels. The promise of compensation from Trust Wallet, while necessary, is a reactive measure. The proactive challenge remains: fortifying the very foundations of wallet technology against an ever-adapting threat landscape.