Trust Wallet: Will Voluntarily Compensate Users Affected by Wallet Security Incident

According to Odaily, between December 24 and 26, 2025, the Trust Wallet Browser Extension v2.68 was compromised by the upload of malicious code due to an API key leak. This incident affected 2,520 wallet addresses that logged into the extension during this period, resulting in the theft of approximately $8.5 million in assets. Investigations revealed that the attack was related to the industry-wide supply chain attack Sha1-Hulud that occurred in November, where attackers gained access to the Chrome Web Store API through leaked GitHub credentials.

Trust Wallet has decided to voluntarily compensate affected users and is currently finalizing the compensation workflow and ownership verification process, while also beginning to connect with victims who have contacted the official team. Trust Wallet reminds affected users to immediately transfer their funds to a new wallet and submit a claim application through the official form. Over 5,000 claim applications have been received so far, and the team is reviewing each case individually. In addition, Trust Wallet has released the fixed version 2.69 and has disabled the relevant publishing permissions and credentials.