ZachXBT warns of a Trust Wallet attack tied to the Chrome extension

Onchain analytics account Lookonchain also posted a summary. Based on its tracking, the incident may involve hundreds of victims, with total losses estimated at at least $6 million at the time of the update.

One detail keeps showing up in the reports. The suspicious transactions appeared to line up with an update to the Trust Wallet browser extension for Google Chrome. At the same time, crypto detective ZachXBT stressed that the root cause has not been confirmed yet and that he is still collecting victim addresses.

On Dec. 26, as concern spread across social media, Trust Wallet published an official security alert. The team said it identified a vulnerability in extension version 2.68. Users were urged to disable that version immediately and upgrade to version 2.69 by installing the update via the official Chrome Web Store. Trust Wallet also noted that, according to its current assessment, the mobile app and other versions of the extension were not affected.

The timing matters for another reason. Trust Wallet has been trying to pull some of the MetaMask audience and grow specifically on desktop, betting on users who prefer managing assets through a browser extension rather than a phone app.

Now that bet creates a reputational headache. Browser extensions are often a prime target for attacks involving tampered updates, fake builds, or supply-chain tricks. Until the investigation is clearer, many users are likely to treat any unexpected extension update as a reason to pause, verify sources, and double-check wallet security settings.