Nikolas Sargeant
Trust Wallet has launched a formal compensation program for users affected by a security breach involving its Chrome browser extension, after malicious code embedded in a recent update exposed wallet seed phrases and resulted in the theft of approximately $7 million in cryptocurrency assets.
The company announced Friday that affected users can submit claims through an official support form hosted on Trust Wallet's portal. The claims process requires users to provide identifying details including email addresses, country of residence, compromised wallet addresses, suspected attacker addresses, and relevant transaction hashes.
Trust Wallet stated it is prioritizing reviews of all submissions and has committed to compensating every verified victim of the incident. The breach, traced to version 2.68 of the Chrome extension, allowed attackers to harvest recovery phrases and drain funds from hundreds of wallets across multiple blockchain networks.
In a statement posted on X on December 26, Trust Wallet acknowledged the disruption caused by the breach and confirmed its support team had begun contacting impacted users. "Each case requires careful verification to ensure accuracy and security," the company stated, promising ongoing updates as the compensation process advances.
Trust Wallet simultaneously warned users to remain vigilant against scams, noting an increase in fake compensation forms, impersonated support accounts, and unsolicited direct messages circulating on Telegram and other platforms attempting to exploit victims of the original breach.
The compensation announcement followed confirmation of the security incident on December 25, when Trust Wallet disclosed that only version 2.68 of its Chrome browser extension was compromised. Blockchain investigator ZachXBT first drew attention to the incident after multiple users reported unauthorized fund outflows shortly after installing the update.
Trust Wallet urged users running the compromised version to disable it immediately and upgrade to version 2.69. According to ZachXBT, the number of victims climbed into the hundreds within hours, with more than $6 million siphoned across several blockchains including Bitcoin, Solana, and Ethereum Virtual Machine-compatible networks.
Several users reported their wallets were drained within minutes of updating the extension. One account on X claimed losses exceeding $300,000, though ZachXBT later flagged that specific account as suspicious. Investigators and users reported the malicious extension appeared legitimate when installed through Chrome's normal update process.
However, embedded code allowed attackers to extract users' recovery phrases, enabling immediate access to funds. One user warned that simply importing a seed phrase into the compromised extension triggered instant wallet draining, demonstrating the sophistication of the malicious code.
Browser extensions typically operate with elevated permissions, granting access to web pages, storage, and browsing data, which makes them powerful targets for attackers when compromised. The architecture allows extensions to intercept sensitive information entered by users, including passwords and recovery phrases.
Trust Wallet confirmed mobile app users and those running other versions of its browser extension were not impacted. The Chrome extension has approximately one million users according to its Web Store listing, though only a fraction updated to the compromised version before it was identified and removed.
Changpeng Zhao, founder of Binance which acquired Trust Wallet in 2018, confirmed that all verified losses would be covered. Zhao estimated the total affected amount at around $7 million and stated user funds would be fully reimbursed, demonstrating Binance's commitment to supporting the wallet product despite the security failure.
The incident occurs amid a broader rise in wallet-related exploits across the cryptocurrency industry. According to Chainalysis, more than $3.4 billion was stolen from January through early December 2025, with a single February compromise at exchange Bybit accounting for nearly half of that total.
Personal wallet compromises have grown steadily in recent years, rising from just over 7% of stolen value in 2022 to more than one-third in 2025 when excluding the Bybit attack. The trend reflects attackers increasingly targeting individual users rather than centralized platforms, exploiting vulnerabilities in wallet software and browser extensions.
Centralized platforms, while less frequently compromised than individual wallets, have seen increasingly large losses tied to private key breaches when attacks do occur. The shift toward personal wallet targeting suggests attackers view individual users as softer targets with less sophisticated security infrastructure than major exchanges.
