Trust Wallet Chrome Extension Compromised: $7 Million in Digital Assets Stolen
On December 25, 2025, cybersecurity researcher and blockchain analyst ZachXBT reported a compromise of the Trust Wallet Chrome extension. According to Changpeng Zhao, CEO of Binance and owner of Trust Wallet, approximately 7 million dollars in digital assets were stolen from users. The incident exclusively affects the browser extension, with no reported impact on standalone mobile or desktop versions. The source article does not specify the attack vector or the vulnerabilities exploited. Additionally, no indicators of compromise (IoCs) or references to Common Vulnerabilities and Exposures (CVEs) are provided. This lack of technical details makes it challenging to assess the exact nature of the compromise and to offer specific mitigations. From a cybersecurity perspective, this incident highlights the risks associated with browser extensions, which can be targeted by attackers to gain access to sensitive information such as cryptocurrency wallets. The fact that only the browser extension was affected indicates that the attack was limited to this specific component. For cybersecurity professionals, this incident underscores the importance of regularly auditing and updating browser extensions, as well as educating users about the potential risks. Users of the Trust Wallet Chrome extension should be advised to refrain from using the extension until further notice and to monitor their accounts for any suspicious activity. In general, browser extensions can be vulnerable to attacks such as cross-site scripting (XSS) or man-in-the-middle (MITM) attacks. Therefore, it is recommended that users only install extensions from trusted sources, keep them updated, and use additional security measures such as hardware wallets for cryptocurrency transactions. However, without more detailed technical information from the source article, it is difficult to provide a more comprehensive analysis or specific recommendations. It is crucial for the cybersecurity community to obtain and share more details about the attack vector and vulnerabilities to better understand and mitigate such incidents in the future.