Blockchain investigator ZachXBT issued a community alert on Telegram on Dec. 25 after “a number of Trust Wallet users” reported funds being drained from their wallet addresses “within the past couple of hours.”
He said the root cause is still unclear, but noted it happened “coincidentally” after the Trust Wallet Chrome extension “pushed a new update yesterday.”
ZachXBT also published a list of alleged theft addresses and asked affected users to contact him directly:
“Send me a DM on X (Twitter) … if you were affected and I will update the list of theft addresses as I verify more.”
ZachXBT later said the incident appears to be significantly larger than initially reported, claiming that hundreds of Trust Wallet users may have been affected and that more than $6 million has been stolen so far from the initial set of theft addresses.
Trust Wallet is a self-custodial cryptocurrency wallet that allows users to store, send and receive digital assets like Bitcoin and Ethereum without relying on a centralized exchange.
Owned by Binance, the wallet supports multiple blockchains and is available as a mobile app and a browser extension, with users retaining control of their private keys and recovery phrases.
More News:
Users point to possible extension compromise
On X, multiple users and commentators claimed the issue may be linked to importing a recovery phrase into the browser extension.
One post from Akinator (@0xakinator) said: “Reports indicate that importing a seed phrase into the extension can result in immediate wallet draining,” adding: “Do NOT use the Trust Wallet extension for now… until an official clarification and fix are released.”
Another user, ZET (@0xKharon), warned : “Do not launch the extension if this turns out to be true,” and urged people not to enter their password or seed phrase.
The reported incidents follow a recent update to Trust Wallet’s browser extension and mobile apps. According to release information, the Trust Wallet Chrome browser extension was updated to version 2.68.0 on Dec. 24, 2025.
Pseudonymous on-chain investigator Oster told TheStreet Roundtable that users should move funds to another wallet immediately, uninstall the latest Trust Wallet Chrome extension, and delete the extension entirely if it hasn’t been updated.
For safety, he recommends switching to a different crypto wallet until clarity emerges.
Alleged theft addresses shared by ZachXBT (list may expand)
EVM addresses:
-
0x3b09A3c9aDD7D0262e6E9724D7e823Cd767a0c74
-
0x463452C356322D463B84891eBDa33DAED274cB40
-
0xa42297ff42a3b65091967945131cd1db962afae4
-
0xe072358070506a4DDA5521B19260011A490a5aaA
-
0xc22b8126ca21616424a22bf012fd1b7cf48f02b1
Bitcoin addresses:
-
bc1qjj7mj50s2e38m4nn7pt2j0ffddxmuxh2g8tyd8
-
bc1ql9r9a4uxmsdwkenjwx7t5clslsf62gxt8ru7e8
-
bc1q4g8u7kctk6f2x3f6nh43x76qm4fd0xyv3jugdy
-
bc1qw7s35umfzgcc7nmjdj9wsyuy9z3g6kqjr0vc7w
Trust Wallet confirms browser extension security incident
Trust Wallet later acknowledged the issue, confirming a security incident affecting its browser extension.
In a post shared on X, Trust Wallet said it had identified a security incident impacting Trust Wallet Browser Extension version 2.68 only , urging users to disable the affected version and upgrade immediately.
“We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69,” the company said.
Trust Wallet added that mobile-only users and users on other browser extension versions are not affected, and directed users to update via the official Chrome Web Store. They said their team is actively working on the issue and will continue to share updates.
This story was originally published by TheStreet on Dec 25, 2025, where it first appeared in the MARKETS section. Add TheStreet as a Preferred Source by clicking here.
