WARNING: Potential Trust Wallet attack/exploit

[TryNinja]

I'm seeing some reports of people losing their funds stored on Trust Wallet.

So far at least $6 million has been stolen.

https://intel.arkm.com/explorer/entity/b6c0b01f-d763-4148-ab61-b58ddd559ba1

I'll keep this updated.


Some of the unconfirmed rumors so far:

🚨 Security Alert

It appears that the  @TrustWallet browser extension may have been compromised via a supply-chain attack in the Dec 24 update.

Reports indicate that importing a seed phrase into the extension can result in immediate wallet draining.

⚠️ Do NOT use the Trust Wallet extension for now, and never import seed phrase until an official clarification and fix are released.

❗ As of now, there has been no official communication from the Trust Wallet team regarding this incident.

Exploiters are using multiple addresses and More than $2,000,000 appears to have been drained

Community alert: A number of Trust Wallet users have reported that funds were drained from wallet addresses within the past couple of hours.

While the exact root cause has not been determined coincidentally the Trust Wallet Chrome extension pushed a new update yesterday.

Send me a DM on X (Twitter) (https://x.com/zachxbt) if you were affected and I will update the list of theft addresses below as I verify more.

Theft addresses

EVM
0x3b09A3c9aDD7D0262e6E9724D7e823Cd767a0c74
0x463452C356322D463B84891eBDa33DAED274cB40
0xa42297ff42a3b65091967945131cd1db962afae4
0xe072358070506a4DDA5521B19260011A490a5aaA
0xe072358070506a4DDA5521B19260011A490a5aaA
0xc22b8126ca21616424a22bf012fd1b7cf48f02b1
0x463452c356322d463b84891ebda33daed274cb40
0x109252d00b2fa8c79a74caa96d9194eef6c99581
0x30cfa51ffb82727515708ce7dd8c69d121648445
0x4735fbecf1db342282ad5baef585ee301b1bce25
Bitcoin
bc1qjj7mj50s2e38m4nn7pt2j0ffddxmuxh2g8tyd8
bc1ql9r9a4uxmsdwkenjwx7t5clslsf62gxt8ru7e8
bc1q4g8u7kctk6f2x3f6nh43x76qm4fd0xyv3jugdy
bc1qw7s35umfzgcc7nmjdj9wsyuy9z3g6kqjr0vc7w
bc1qgccgl9d0wzxxnvklj4j55wqeqczgkn6qfcgjdg
bc1q3ykewj0xu0wrwxd2dy4g47yp75gxxm565kaw6m
Solana
HoQ6z1wW3LUnEGHnseC3ND3PoC6i6RghMCphHhK42FEH

So here’s what’s happening  :

In the Trust Wallet browser extension code 4482.js
a recent update added hidden code that silently sends wallet data outside
It pretends to be analytics, but it tracks wallet activity and triggers when a seed phrase is imported
The data was sent to metrics-trustwallet[.]com  a domain registered days ago and now down

[Ambatman]

This is one of my bias against extensions they can be exploited especially on individuals like me
That know little to nothing about code.
The fact that they have been silent since isn't helping their case and major victims would be users that use it for other things but HODL.

Came across this but hasn't really been proven.
https://x.com/0xakinator/status/2004297673067704651?t=FPEC2ZMHZ3pAgkFxuaxa4g&s=19

[suzanne5223]

I also read about the news some minutes ago, but i am not suprised thatthis happened because I created a thread in October to warn people about the algorithm Trust Wallet, Libbitcoin bx seed, Cake Wallet, and Lubian used to generate their cryptographic keys, which were vulnerable to brute force attacks.
A user even said it's a rumor and fake news. I just hope this forum member's wallet is not among the affected wallets.
Cryptohygenic, can you see what happened today ?

[Potato Chips]

Damn.

Speaking of their browser extension, it also had a vulnerability before and it has caused folks to lose $170,000. Fortunately, they were able to reimburse this, see: https://www.theblock.co/post/227730/trust-wallet-vulnerability-fix

This time the amount lost is so much bigger than last time, and maybe more than $6M even. If confirmed the fault is on their end, this makes me wonder how the whole thing would go.

Do you all think $6M is a small dent to the company or a big one?

[Charles-Tim]

One of the most vulnerable wallets that are used are wallets that are browser extensions, as mobile and desktop wallet can also be vulnerable, browser extension wallets are most vulnerable. I completely avoid them.

I am also surprised that some people are using Trust wallet so much. I have even deleted the wallet on my device when the app remain idle for months.

[TryNinja]

Damn.

Speaking of their browser extension, it also had a vulnerability before and it has caused folks to lose $170,000. Fortunately, they were able to reimburse this, see: https://www.theblock.co/post/227730/trust-wallet-vulnerability-fix

This time the amount lost is so much bigger than last time, and maybe more than $6M even. If confirmed the fault is on their end, this makes me wonder how the whole thing would go.

Do you all think $6M is a small dent to the company or a big one?

I'm not sure about who owns Trust Wallet nowadays. I might be wrong, but I think they were once owned by Binance? So it's probably fine for them to fully reimbuse the users.

The question is, how the heck was the wallet extension infected with such blatantly malicious code? Something is very wrong if this can slip in without them knowing.


Confirmed by Trust Wallet: https://x.com/TrustWallet/status/2004316503701958786

[8rch7]

DAMN, lack security of wallet extension of Trustwallet and can't believing if all wallet hack due user negligence because the amount hack raise up $2,324,841 and its large amount of hacking. I don't know why many people holding their assets in wallet extension and most of them holding many cryptocurrency assets there.
Trustwallet official already update about this hack cases and little funny not any responsibility yet from their tweet on twitter, just recommended for all user not opening awhile the trustwallet extension and ask to user upgrade new version to 2.69 from previously 2.68.

Here the update from trustwallet's twitter offcial

"We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69".
Source

[m2017]

DAMN, lack security of wallet extension of Trustwallet and can't believing if all wallet hack due user negligence because the amount hack raise up $2,324,841 and its large amount of hacking.

So what constitutes "user negligence"? Was it that there was hidden code in the browser extension's source code?

So here’s what’s happening  :

In the Trust Wallet browser extension code 4482.js
a recent update added hidden code that silently sends wallet data outside
It pretends to be analytics, but it tracks wallet activity and triggers when a seed phrase is imported
The data was sent to metrics-trustwallet[.]com  a domain registered days ago and now down

Users are only at fault for trusting the developer. The same thing happens with every app and every developer whose app you use. The average user has no way of knowing what's "inside" the source code.

I don't know why many people holding their assets in wallet extension and most of them holding many cryptocurrency assets there.

Well, here, users can already be accused of negligence and violation of the rules for the safe storage of their crypto assets.

Just imagine keeping $700k. in one wallet. Hasn't he heard of risk diversification? Hasn't he heard of hardware wallets, or at least storing them in a cold wallet on the desktop version, not in a browser extension.

Users are also "to blame" for their losses, because they didn't take care to secure their crypto assets, blindly trusting the app developer (shifting responsibility for storage to them). You can't "relax" with crypto; you must always think about the safety of your funds. Those who relax suffer losses.

Trustwallet official already update about this hack cases and little funny not any responsibility yet from their tweet on twitter,

What did you expect? For them to compensate for the losses?

Need to look at trust wallet's user agreement. I expect that the users themselves are fully responsible for the security of their wallet contents. I don't think trust wallet's lawyers left any room for filing a lawsuit against them and recovering the stolen funds.

[rat03gopoh]

I'm not sure about who owns Trust Wallet nowadays. I might be wrong, but I think they were once owned by Binance? So it's probably fine for them to fully reimbuse the users.

Yes, and here's CZ's recent tweet, https://x.com/i/status/2004397190819783013
it seems he still cares, which means TWT still belongs to Binance.

Recovery of some assets will likely be executed in their classic way like when Binance was hacked (unless the hacker voluntarily returns everything stolen).

[Botnake]

I'm not sure about who owns Trust Wallet nowadays. I might be wrong, but I think they were once owned by Binance? So it's probably fine for them to fully reimbuse the users.

Yes, and here's CZ's recent tweet, https://x.com/i/status/2004397190819783013
it seems he still cares, which means TWT still belongs to Binance.

Recovery of some assets will likely be executed in their classic way like when Binance was hacked (unless the hacker voluntarily returns everything stolen).

Looks like this isn’t a big problem after all, since once again it’s SAFU. The amount hacked is pretty small compared to what Binance lost before during their hack. Because of that, I think people will still trust Trust Wallet, especially knowing there’s some kind of insurance backing it.

I’m a Trust Wallet user myself. I checked my account and nothing looks unusual, balance is fine.
Maybe I’m just not a target since I don’t have millions anyway lol.

[rat03gopoh]

Looks like this isn’t a big problem after all, since once again it’s SAFU.

It's unclear whether Binance will utilize SAFU, given that its funding source is solely derived from Binance's customer activitym not TWT. Furthermore, TWT was developed separately, and this hack has no direct impact on Binance.

What I'm referring to is their recovery method, which involves blocking all centralized platforms, utilizing the features of a relatively centralized coin network, such as the PoS consensus.

[$crypto$]

Geez what a horror Trustwallet wallet was exploited, didn't expect many people to store assets in this wallet even before if I'm not mistaken Trustwallet experienced the same incident a few years ago.

I’m a Trust Wallet user myself. I checked my account and nothing looks unusual, balance is fine.
Maybe I’m just not a target since I don’t have millions anyway lol.

You must be careful using this wallet, because it is very vulnerable especially since there have been exploitation incidents.
You may not use version 2.68 because this version is affected by their asset drain.

[KiaKia]

I'm not sure about who owns Trust Wallet nowadays. I might be wrong, but I think they were once owned by Binance? So it's probably fine for them to fully reimbuse the users.

Yes, and here's CZ's recent tweet, https://x.com/i/status/2004397190819783013
it seems he still cares, which means TWT still belongs to Binance.

Recovery of some assets will likely be executed in their classic way like when Binance was hacked (unless the hacker voluntarily returns everything stolen).

So the hackers had to replace the real trust wallet extension with a new one and the team are not aware? This is very hard to believe, I will wait for a better explanation from CZ himself because I have my trust issues with hacks like this, funds are safu like they said and reimbursing all lost funds is what Binance is known for.

Yet the October 10th theft on liquidity was a different one, quarter of lost funds are reimbursed not all of it, there are still things that have no good explanation to why they happened in this space, this days I don't even trust anyone.

What if Trust wallet carried out this attack by themselves to look like a saviour? A perfect way to win the heart of people even more, many will swim to Binance and trust wallet, this is just a day.

[tvplus006]

...What if Trust wallet carried out this attack by themselves to look like a saviour? A perfect way to win the heart of people even more, many will swim to Binance and trust wallet, this is just a day.

Binance does not need to assert oneself in this way, as they have repeatedly proven their commitment to protecting their users. But in any case, such security problems will have negative consequences for the reputation of the wallet, which should indicate an insufficient level of qualification of specialists who have put into operation an insufficiently tested update.

[Lucius]

I no longer wonder what it is with people who keep such amounts in a wallet that also uses a browser extension - are they aware that they are inviting hackers to take everything they have? I've never had the slightest experience of using any wallet that would be connected to a browser, it's simply crazy and out of mind.

What else can I say except that some people have to learn from their mistakes - like this genius who lost $700k because he obviously didn't know that there is a hardware wallet that costs $50 and would probably save him. I say probably because nothing can save some people, they will type their seed in any stupid place that asks them to.

[julerz12]

The question is, how the heck was the wallet extension infected with such blatantly malicious code? Something is very wrong if this can slip in without them knowing.

Probably an inside job. Even CZ has similar suspicions 

Just imagine keeping $700k. in one wallet. Hasn't he heard of risk diversification? Hasn't he heard of hardware wallets, or at least storing them in a cold wallet on the desktop version, not in a browser extension.

I guess they prefer convenience over security.
I'm actually surprised this wallet still has a lot of users, even though there are plenty of good alternatives to it nowadays. I guess some people stuck to it from way back in the ICO days.

[tvplus006]

...What else can I say except that some people have to learn from their mistakes - like this genius who lost $700k because he obviously didn't know that there is a hardware wallet that costs $50 and would probably save him. ..

You need to learn from the mistakes of others. And this time, such training will cost him free of charge, as CZ has promised to compensate for losses for all users of the wallet. Therefore, if you are using a browser extension, then it must be an extension supported by SAFU.

[TryNinja]

FYI, if anyone has their wallet extension extension installed, make sure you are on the latest version (v2.69).

For affected users on Browser Extension v2.68, please follow these steps as soon as possible:

Step 1: Do NOT open the Trust Wallet Browser Extension v2.68 on your desktop device, to ensure the security of your wallet and prevent further issues.

Step 2: Go to Chrome Extensions panel in your Chrome browser by copying following to the address line (shortcut to the Official Trust Wallet Browser Extension): chrome://extensions/?id=egjidjbpglichdcondbcbdnbeeppgdph

Step 3: Switch the toggle to "Off" below the Trust Wallet if it's still "On".

Step 4: Click "Developer mode" in the upper right corner.

Step 5:  Press the "Update" on the left upper corner.

Step 6. Check the version number: 2.69. This is the latest and secure version.

Even though they removed the bad code, anyone on v2.68 can still have their wallet drained. So make sure you are not on that before thinking about using the wallet.

[DYING_S0UL]

I just had one question in my mind! How did this exactly happened, @TryNinja? Isn't there multiple tests, various phases, a lots of checks, before an update gets approval for deployment? I mean, as far as I understand, a team of people works for the total development of such thing, isn't it? So how come nobody noticed this, that someone sabotaged the update and slip through some malicious codes? I understand it may have been insider job but still...that's highly suspicious, some top level person/persons may be involved. I really hope whomever they are, gets identified and put to jail forever.  

[TryNinja]

I just had one question in my mind! How did this exactly happened, @TryNinja? Isn't there multiple tests, various phases, a lots of checks, before an update gets approval for deployment? I mean, as far as I understand, a team of people works for the total development of such thing, isn't it? So how come nobody noticed this, that someone sabotaged the update and slip through some malicious codes? I understand it may have been insider job but still...that's highly suspicious, some top level person/persons may be involved. I really hope whomever they are, gets identified and put to jail forever.  

CZ has said they are investigating, and he has not ruled out this being an inside job.

"The team is still investigating how hackers were able to submit a new version."
https://x.com/cz_binance/status/2004397190819783013

Random guy: "surely is insider working in the team"
CZ: "Most likely."
https://x.com/cz_binance/status/2004398433285894432

So it looks like someone managed to push the infected "update" rather than the code sliping through a legit new version. Maybe the developer account password/token got leaked.