Trust Wallet Chrome Extension Hack — Emergency Update and What to Do
Short version: a recent update to Trust Wallet’s Chrome extension went sideways and apparently included code that could swipe seed phrases. If you had the extension installed, especially version 2.68, treat anything you typed in as potentially compromised. The vendor pushed a hotfix shortly after and told people to disable the bad version, but this is one of those messes where updating is only half the battle.
What happened (in plain English)
In a nutshell, a Chrome extension update rolled out with sneaky client-side code that researchers say could siphon off wallet secrets. The company quickly released a follow-up build and told people to stop using the old version. Early reports put losses from the incident in the low millions, and the extension has a big user base — on the order of a million installs — so the potential reach was huge.
The highest-risk move was importing or typing your seed phrase while the compromised extension was active. That single action can hand an attacker the keys to all addresses derived from that phrase. Security folks who dug into the update flagged obfuscated JavaScript that looked like it could send secrets to an outside server, and analysts warned of copycat “fix” sites popping up to phish people during the chaos.
The vendor says the issue was limited to the browser extension release and that mobile apps and other versions weren’t affected. A patch was posted quickly, but an upgrade only boots the suspect code out going forward — it doesn’t magically undo a seed phrase that’s already been handed over.
What you should do right now (before you panic or click a sketchy link)
If you never entered a seed phrase on that extension while the bad version was installed: update to the patched version and call it a day. Disable old versions and make sure your browser actually updated the extension.
If you did enter or import a seed phrase while the malicious version was installed, assume compromise. The checklist looks like this:
– Treat the seed as exposed. Create a brand-new wallet with a fresh seed and move funds there. Don’t be cute — fast is usually better than perfect when attackers are involved, but balance that with gas costs and bridge risks.
– Revoke token approvals from the old addresses where possible. That can stop automated drains in some cases.
– Check every device and app that touched the phrase and treat them as suspect until you can reinstall or rebuild them cleanly.
– Beware of fake “fix” sites and impersonators. Scammers love chaos and will send fake support pages or DMs pretending to help — don’t fall for it.
The company has said it will refund affected users and is working on remediation instructions. Keep an eye on the official vendor channels for the refund process and any verified indicators they publish (bad domains, hashes, etc.). Only follow guidance from those official sources — not random posts or DMs.
Why this matters beyond the immediate panic
This incident is a reminder that browser extensions are powerful and fragile. They run on general-purpose machines and can be updated remotely, which is convenient — and risky. Malicious or compromised updates can hide their behavior in obfuscated code and slip past automated checks, especially as attackers change tactics.
The practical takeaway for users: be extremely cautious about entering seed phrases into browser software. Extensions should have stronger supply-chain protections like reproducible builds and stricter signing and rollback controls. Until those things are widespread, the blunt tool for most people is caution: assume secrets typed in during a sketchy window are gone and move assets if needed.
Final note: if you think you were hit, act quickly but don’t panic. Follow the checklist above, wait for the vendor’s official remediation steps, and watch out for scammers pretending to help. Losing a seed phrase is awful, but a calm, methodical response is the best shot at minimizing damage.