User funds began disappearing from Trust Wallet accounts on Dec. 24, with losses exceeding $6 million across multiple blockchain networks. The wallet provider remained silent for more than 30 hours before acknowledging a browser extension vulnerability.
What Happened: Extension Compromise
User complaints first surfaced Dec. 24 indicating complete wallet drains following seed phrase entry into Trust Wallet's browser extension.
The vulnerability affected accounts across Ethereum Virtual Machine networks, Bitcoin (https://yellow.com/asset/btc) and Solana (https://yellow.com/asset/sol) blockchains.
Cryptocurrency detective ZachXBT traced stolen funds to multiple addresses. One newly created EVM wallet collected transactions ranging from fractional ETH amounts to 7 ETH (https://yellow.com/asset/eth), with a single address still holding over 255 ETH worth approximately $750,000.
Bitcoin network theft exceeded 12 BTC through 66 transactions to one address alone, totaling more than $1 million, while additional wallets received 1.5 BTC.
Total confirmed losses surpass $6 million. Fund transfers continued until late Dec. 25, spanning over 30 hours from initial reports.
Also Read: Bitcoin Slips Below $87,000 As Record Stablecoin Supply Signals Sidelined Capital
Why It Matters: Extended Silence
Trust Wallet representatives issued no public warning about the browser extension vulnerability until Dec. 26. The company posted promotional content about a $500 contest and holiday greetings while user accounts were actively compromised.
Security experts note two potential scenarios: intentional malicious code insertion during an update or accidental introduction of exploitable vulnerabilities. The platform has since stated the browser extension flaw was resolved, though fund transfers continued through Dec. 25.
Users are advised to avoid the browser extension pending official clarification and comprehensive security audit results.
Read Next: Crypto Liquidations Surpass $150 Billion in 2025, CoinGlass Reports
