Trust Wallet has opened a formal reimbursement process for users who lost funds after malicious code was discovered in a recent version of its Chrome browser extension, marking one of the company’s most significant security responses to date.
The wallet provider said affected users can now file claims through an official portal, where they must submit basic identity details along with the compromised wallet addresses, attacker addresses, and transaction hashes linked to the theft.
Trust Wallet said it would cover all verified losses and emphasized that each submission will undergo detailed review to prevent further risk.
The company confirmed that roughly $7 million in digital assets were siphoned from users across several blockchains, including Bitcoin, Ether, and Solana.
Blockchain security firm PeckShield reported that more than $4 million had already been routed through centralized exchanges such as ChangeNOW, FixedFloat, and KuCoin, while nearly $3 million remained in wallets controlled by the attacker as of Thursday.
Binance founder Changpeng Zhao, whose company acquired Trust Wallet in 2018, said the losses would be made whole. “TrustWallet will cover,” he wrote on X, adding that user funds “are SAFU.”
Also Read: Why JPMorgan Is Cutting Off Stablecoin Neobanks In Latin America Despite Crypto-Friendly Messaging
How The Breach Occurred
The issue surfaced on Christmas Day, when onchain analyst ZachXBT warned that users were reporting sudden fund drains after updating to the extension’s December 24 release.
Trust Wallet issued a patched version on December 25.
According to CEO Eowyn Chen, the attack stemmed from a leaked Chrome Web Store API key, which allowed a malicious build of the extension to be published outside of the company’s internal release pipeline.
Security researchers at SlowMist found that the rogue version used a modified analytics library to steal seed phrases.
Users who accessed the compromised extension before December 26 at 11 a.m. UTC were potentially exposed, Trust Wallet said.
Impact And User Scope
The incident affected only the Chrome extension version 2.68; mobile app users and those running other extension builds were not impacted.
Trust Wallet’s extension has around one million users, according to its Chrome Web Store listing.
Read Next: Bitcoin Breaks Downtrend, Rare Market Signals Hint At Multi-Week Rally