The Trust Wallet browser extension faces security concerns due to a suspected supply-chain compromise in its December 24 update, potentially allowing malicious code to exfiltrate seed phrases and drain wallets. Users report over $2 million in losses, with warnings to avoid importing seeds until resolved.
-
Supply-chain attack suspected in recent update
-
Code added on December 24 may transmit sensitive data to fake domains.
-
More than $2 million in potential losses from wallet drains, per unverified reports from blockchain analysts.
Trust Wallet browser extension security alert: Malicious code risks wallet drains. Avoid seed imports now—stay safe in crypto. Learn details and precautions. (142 characters)
What is the Trust Wallet browser extension security issue?
Trust Wallet browser extension security issue emerged on December 25 when blockchain investigator ZachXBT highlighted suspicious activity in a recent update. This potential supply-chain compromise involves code that could silently steal seed phrases during imports, leading to wallet drains. No official response from Trust Wallet has been issued as investigations continue.
How does the alleged malicious code work in Trust Wallet?
The alleged malicious code in the Trust Wallet browser extension was introduced via an update on December 24. According to reports from security researchers, a JavaScript file disguised as analytics activates upon seed phrase import. It transmits wallet data to a newly registered domain mimicking official infrastructure, which has since gone offline. Blockchain data shows patterns of funds routed through multiple addresses, indicating automated exploitation. Experts like those cited by ZachXBT emphasize that this setup points to a coordinated attack, not simple phishing. Historical supply-chain incidents, such as those affecting other crypto tools, have caused millions in losses, underscoring the need for vigilant updates. Users importing seeds post-update reported immediate drains, with estimates exceeding $2 million in unverified claims from on-chain analysis.
Frequently Asked Questions
Is the Trust Wallet browser extension safe to use for seed phrase imports?
The Trust Wallet browser extension is not recommended for seed phrase imports at this time due to the suspected malicious code in the December 24 update. Security experts advise avoiding it until Trust Wallet provides an official advisory or patch. Stick to mobile apps, which show no signs of compromise, to protect your assets.
What should I do if I used the Trust Wallet browser extension recently?
If you’ve recently used the Trust Wallet browser extension, especially for importing seed phrases, monitor your wallet closely and transfer funds to a new, secure wallet immediately. Enable two-factor authentication where possible and avoid further interactions with the extension. Consult on-chain tools for any unauthorized activity, and await updates from Trust Wallet for resolution steps.
Key Takeaways
- Supply-chain risks in extensions: Updates can introduce vulnerabilities if compromised, highlighting the importance of pausing new features during alerts.
- Limited to browser version: Mobile apps remain unaffected, allowing users to continue operations on verified platforms without interruption.
- Ongoing investigations: Independent reviews by researchers like ZachXBT are crucial; users should rely on factual updates rather than unconfirmed reports.
Conclusion
The Trust Wallet browser extension security issue raises critical questions about supply-chain integrity in crypto wallets, with the alleged malicious code potentially enabling widespread data exfiltration and losses over $2 million. As investigations by blockchain experts proceed without an official Trust Wallet response, prioritizing secure practices like using mobile apps is essential. Staying informed through reliable sources will help safeguard assets in the evolving crypto landscape—consider reviewing your wallet security today for peace of mind.
Source: https://en.coinotag.com/suspected-supply-chain-attack-hits-trust-wallet-browser-extension
