A routine browser update has spiraled into a growing security scare for crypto users, after a cluster of wallets were emptied within minutes of being restored on a popular Chrome extension.
What initially appeared as isolated complaints quickly evolved into a broader on-chain pattern, pointing to a coordinated drain affecting users of Trust Wallet.
Key Takeaways
Trust Wallet users reported instant fund losses after importing seed phrases into the updated Chrome extension.
Wallets were drained rapidly across multiple assets with no staged withdrawals.
On-chain analysis points to a coordinated exploit affecting multiple wallets.
More than $4.3 million appears to have been siphoned based on public blockchain data.
The first red flags appeared on social media, where users reported that balances vanished almost instantly after importing their seed phrases into the newly updated Chrome extension. In multiple cases, funds were gone before users could interact with their wallets, suggesting the compromise occurred at the moment of wallet restoration rather than through delayed access.
Affected assets were not limited to a single chain. Reports showed Bitcoin, Ethereum, and BNB being transferred out almost simultaneously, with no evidence of staggered withdrawals or manual interaction.
On-chain investigator flags coordinated activity
Blockchain analyst ZachXBT later highlighted the activity, noting that several unrelated wallets were drained in a remarkably similar fashion over a short window of time. The transactions clustered tightly around the rollout of version 2.68.0 of the Trust Wallet Chrome extension.
Rather than funneling funds into one destination, the attacker(s) dispersed assets across multiple receiving addresses. Despite this, the transaction flows shared nearly identical structures, indicating automation rather than user-side compromise.
Millions traced through public blockchain data
Using publicly visible blockchain records, analysts estimate that more than $4.3 million in crypto has already been siphoned from affected wallets. The estimate is conservative, reflecting only the addresses that have been publicly linked to user reports.
Blockchain intelligence tools such as Arkham have been used to trace the flows, revealing several addresses that repeatedly received funds from different victims. The consistency across these transactions has strengthened the case for a single exploit mechanism rather than multiple independent incidents.
Silence from the wallet provider
Despite the growing body of on-chain evidence, Trust Wallet has yet to release an official explanation. The company has not confirmed a vulnerability, nor has it publicly acknowledged a connection between the Chrome update and the reported losses.
No guidance has been issued on whether users should avoid the extension, revoke permissions, or migrate funds. Likewise, no recovery or mitigation steps have been outlined for affected users.
Focus remains on the extension update
At this stage, the investigation relies almost entirely on blockchain forensics and user timelines. The Chrome extension update released on December 24 remains the central reference point, though it has not been definitively identified as the root cause.
Until further clarification emerges, the incident underscores the risks tied to browser-based wallets and the sensitivity of seed phrase handling. For now, the situation remains unresolved, with investigators continuing to piece together events block by block rather than through official disclosures.
This content is for informational purposes only and does not constitute investment or security advice.
