Trust Wallet Begins Compensation for Victims of $7 Million Browser Extension Hack
Trust Wallet has launched a formal compensation process after a malicious Chrome extension update exposed hundreds of users to fund theft.
Which topics should we dive deeper into?
Select what genuinely interests you. Your picks feed directly into our editorial planning.
Crypto news that's actually worth your time.
Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.
When a wallet provider says self custody, users expect the software layer to be airtight. That trust took a hit this week after Trust Wallet confirmed a malicious update to its Chrome browser extension led to the theft of roughly $7 million in digital assets. Now, the company says it is moving fast to make affected users whole.
Two days after discovering the breach, Trust Wallet announced it has launched a formal compensation process for victims impacted by the compromised version 2.68 of its Chrome extension.
How the Compensation Process Works
Trust Wallet has opened an official claims portal where affected users can submit details related to the attack. The form asks for basic identification information such as email address and country, along with technical evidence including compromised wallet addresses, attacker receiving addresses, and transaction hashes.
The company says every submission will be individually reviewed. According to Trust Wallet, this verification is essential to prevent errors, false claims, or further abuse of the situation.
In a public statement, the company said it is working around the clock to finalize compensation and ensure accuracy while maintaining security throughout the process.
What Was Stolen and Where the Funds Went
The breach resulted in losses across multiple blockchains, including Bitcoin, Ethereum, and Solana. Blockchain security firm PeckShield estimates that over $4 million of the stolen funds have already passed through centralized exchanges such as ChangeNOW, FixedFloat, and KuCoin.
As of the latest onchain data, roughly $2.8 million remains in wallets controlled by the attacker.
Binance Confirms Loss Coverage
Adding reassurance for users, Changpeng Zhao, founder of Binance, confirmed publicly that all verified losses will be covered.
In a post on X, Zhao stated that approximately $7 million was affected and that Trust Wallet will fully compensate users, emphasizing that user funds remain SAFU.
How the Attack Happened
The incident first surfaced after onchain investigator ZachXBT warned on Telegram that multiple Trust Wallet users were reporting drained balances shortly after installing the December 24 update.
Trust Wallet’s internal investigation revealed that a leaked Chrome Web Store API key was used to publish the malicious extension update at 12:32 p.m. UTC on December 24. This allowed the attackers to bypass the company’s internal release controls.
Security firm SlowMist later identified the malicious code, which leveraged a modified open source analytics library to harvest wallet seed phrases. Once compromised, attackers could quickly drain funds without further user interaction.
Who Was Affected and Who Was Not
Only users of the Chrome extension running version 2.68 were impacted. Trust Wallet pushed a patched release, version 2.69, on December 25. According to CEO Eowyn Chen, users who logged into the extension before December 26 at 11 a.m. UTC were potentially exposed.
Mobile app users and those using other browser versions of the extension were not affected. The Chrome extension alone has close to one million users, according to its Web Store listing.
Warning Against Fake Compensation Scams
Trust Wallet is also urging users to stay alert. In the aftermath of the breach, fake compensation forms and impersonation scams have already begun circulating. The company stressed that claims should only be submitted through its official support portal and warned users not to share recovery phrases or private keys under any circumstances.
What This Means Going Forward
This incident is a reminder that even well known wallet providers remain exposed to supply chain risks, especially through browser extensions. While Trust Wallet’s decision to fully compensate users helps restore confidence, the breach underscores how a single leaked credential can cascade into millions in losses.
For users, the lesson is simple but uncomfortable. Updates matter, verification matters, and browser extensions remain one of the softest targets in the crypto ecosystem.
Related articles
- Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised
- Trust Wallet Drops 25 Networks: What Users Should Know After September 15
- Three Mistakes When Setting Up Trust Wallet: The Twelve Words Never Belong on the Phone
- IoTeX on Coinbase: What IOTX Holders Should Know After the September 23 Trading Halt
- Bitcoin Wallet Bug: Why Speeding Up a Payment Could Drain Your Wallet
Which topics should we dive deeper into?
Select what genuinely interests you. Your picks feed directly into our editorial planning.
Crypto news that's actually worth your time.
Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.
October 12, 2026 1:42 AM
Bitget Wallet is not the exchange: one of two required key shares sits on Bitget's server
The attack on the Bitget exchange of September 24, 2026 hit the venue's hot and warm wallets, not the keys in users' wallets. What matters all the same is which variant you run: in the keyless wallet every signature needs a key share from the provider's server.
October 9, 2026 7:29 AM
Exodus Wallet: 71.5 percent of revenue comes from swaps, the spread vs the exchange fee
The Exodus Wallet is free to download, yet 71.5 percent of the provider's revenue in the second quarter of 2026 came from swaps inside the app. What the spread costs, how custody works and from what point a device of your own pays off.
September 23, 2026 4:12 AM
How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps
Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.
August 24, 2026 1:22 PM
Phantom Wallet Ends Sui and Monad Support: What to Do Before the Deadlines
Phantom Wallet removes Monad from its app on August 26 and Sui on September 24. The balances are not lost, but only one of the two ways out leaves your tax position untouched.
August 22, 2026 10:13 AM
BaFin Warns Against NC Wallet and ncwallet.net: What Users of the Wallet App Must Check Now
On August 19, 2026, BaFin issued a warning about the NC Wallet app and two websites: on the regulator's findings, the unknown operators offer financial services there without authorisation. Because the wallet is custodial, it is the provider and not you who holds the key to your balance.
August 21, 2026 4:27 PM
Wallet App Without BaFin Authorisation: When Holding Crypto-Assets Requires a Licence
On 19 August 2026 BaFin published two consumer notices on wallet offerings. Who controls the means of access decides whether an authorisation is needed.
August 20, 2026 4:24 PM
Bitcoin Across Multiple Wallets: How Austria Works Out the Acquisition Cost
Bitcoin spread across several wallets? How Austria works out the acquisition cost and the rolling average price for tax purposes.
October 28, 2026 12:51 PM
Keystone destroys 18,835 hardware wallets, shipping on hold
The break-in on Keystone's website leaked the key owners use to verify their hardware wallet. Because it sits in the chip from the factory, the maker is destroying 18,835 finished devices and has halted shipping.
October 21, 2026 4:31 PM
Polkadot reports a key leak at Fearless Wallet, 17,286 DOT are gone: how to check your extension
Context: on October 21 the Polkadot Community Foundation reported four versions of the Fearless Wallet extension as compromised. Anyone who has used it since February 2025 needs new keys, not a new password.
October 19, 2026 1:14 AM
Qubic halts its mainnet after 1,404 wallets are drained: the seed was the weak point
An attacker drained 1,404 Qubic wallets on the night of October 18, roughly $1.3 million. The protocol was not to blame: seed generation in the browser supplied too little randomness.
October 17, 2026 10:44 PM
Creating a Bitcoin wallet: the first ten minutes decide who has access
A Bitcoin wallet is set up in ten minutes, and that is precisely the danger. Which four steps every setup runs through, why the first transfer should be a test amount, and which five mistakes cost the most.
October 8, 2026 1:37 AM
MyNearWallet Closes on October 31: What It Means for Your NEAR Coins
MyNearWallet shuts down on October 31, 2026, and its feature set starts shrinking in October. Your NEAR stay onchain, but browser access falls away: what to know about migration, the staking unbonding period, phishing and the holding period.
October 5, 2026 4:16 PM
World Liberty Financial US Trust Bank: What the Abu Dhabi Report Leaves Open
The reported Abu Dhabi stake in World Liberty Financial raises questions. Here is what OCC filings show about the trust company, USD1 reserves and the authorisation to open.
October 5, 2026 1:36 PM
Paper Wallet with a Single Key: The Printed Storage Method Compared with the Seed Phrase
A paper wallet carries a single private key on paper, and that is exactly where its weaknesses lie: printers, change, misread characters. What the storage method achieves, where it fails and how to wind up an old sheet safely.
October 5, 2026 10:32 AM
Joint bitcoin wallet: who owns the coins for tax purposes?
Bitcoin on a joint marital wallet: for tax purposes it is not access to the wallet alone that decides, but who the coins are economically attributable to.
October 2, 2026 10:36 AM
Hot Wallet or Cold Wallet: the Private Key Decides How Safe Your Coins Are
Hot wallet or cold wallet: the difference rests solely on whether the private key is online. What separates the two forms, where the limits of hardware lie and why moving to your own device triggers no tax.
September 30, 2026 7:16 AM
Tangem Wallet: The Card Without a Seed Phrase vs the Classic Hardware Wallet
The Tangem Wallet secures crypto with two or three identical cards instead of 24 words. What the sets cost, what the EAL6+ chip delivers and why losing every card is final.
September 28, 2026 10:26 AM
Phantom Wallet and Solscan: What a Solana Transfer Really Costs and Where It Fails
A transfer on Solana costs 0.000005 SOL, a new token account ties up 0.00148844 SOL once — both values measured on-chain by us today. This practical guide shows how to set up Phantom, how to get there from the exchange, how to read Solscan and what applies for tax in Germany.
September 27, 2026 7:14 AM
Toncoin Is Now Gram: What the Telegram Wallet Changes for Holders
Since June 15, 2026 the token of the network The Open Network has carried its original name Gram again, and since late August a self-custodial wallet has been rolling out inside the messenger. What you have to do, what MiCA says about it, and how much is left of the ecosystem that began with tap-to-earn games in 2024.
September 17, 2026 4:14 PM
D'CENT App Wallet: How to Tell If Your Recovery Phrase Has to Move Now
Manufacturer IoTrust reports suspicious asset transfers in the D'CENT app wallet and asks users to move their holdings. One question decides the matter: has your recovery phrase ever been entered into the app?
September 16, 2026 4:12 AM
Wallet Drops a Network: How to Rescue Your Coins Before the Deadline
Phantom is ending Sui support on September 24, 2026, and Trust Wallet has already removed 25 networks: five shutdowns of this kind in four weeks alone. What really happens to your balance, which two routes you have before the deadline and where the move most often fails.
September 2, 2026 7:44 AM
MyDoge Ends Doginals and DRC-20 Support: What Holders Should Know After September 17
Recap as of September 27, 2026: infrastructure provider Maestro had announced it would discontinue its Dogecoin services on September 18, 2026, with MyDoge withdrawing support for Doginals and DRC-20 a day earlier. Our own survey of September 2 showed that nothing about the shutdown could be found on the public pages of those involved.
August 31, 2026 7:20 AM
Browser Extensions as Wallet Thieves: How a Sports App Became a Seed Phrase Collector
In August 2026 the security firm Socket disclosed two separate campaigns: 40 confirmed malicious Firefox extensions and 19 for Chrome and Edge, all of them from the official marketplaces. Nine of them were harmless sports apps that only turned into wallet thieves through an update.
November 26, 2025 11:00 PM
Bitget Wallet Introduces Zero-Fee Feature for Its Crypto Card in Over 50 Markets
The Bitget Wallet Card enables fee-free stablecoin spending and customized designs, expanding everyday crypto payments across Visa and Mastercard networks.
May 23, 2024 7:29 PM
Grayscale SEC Approval: Launching Two New Crypto Funds
Grayscale is committed to expanding its portfolio of single-asset cryptocurrency trusts and offering more opportunities for investors, as it announced today the latest trusts launch.
More from CryptoTicker