Trust Wallet flags false claims in $7M browser hack review

Trust Wallet has begun verifying reimbursement claims after a Christmas Day exploit of its browser extension for desktop users. The company identified 2,596 affected wallet addresses but has received nearly 5,000 submissions, indicating many claims are incorrect or duplicates.

In a Monday update, CEO Eowyn Chen wrote: “Accurate verification of wallet ownership is critical to ensure funds are returned to the right people.” She added that the team is using multiple data points to separate legitimate victims from malicious actors.

Chen indicated the company is prioritizing accuracy over speed and is preparing further updates as work continues. The response has shifted from estimating losses to the operational task of compensating users while preventing abuse.

Trust Wallet disclosed on Dec. 26 that its browser extension was compromised in a targeted attack affecting desktop users, leading to about $7 million in losses. Binance co-founder Changpeng Zhao has pledged to fully cover those losses as Binance owns Trust Wallet.

Cybersecurity firm SlowMist reported that the malicious extension exported users’ personal information. Co-founder Yu Xiam assessed that the attacker prepared weeks in advance and showed deep familiarity with the source code. Trust Wallet has not confirmed whether insiders were involved.

Onchain investigator ZachXBT previously estimated that hundreds of users were affected. The company is conducting a broader forensic review to map the attack and validate claims tied to the incident. “This process is ongoing today and is being carried out alongside the broader forensic investigation,” Chen wrote. “While some data is still being finalized, we already have strong working hypotheses for a portion of the cases.”