After years of crawling and fighting in the industry, I’ve seen many storms, but this time, a hacker incident involving a popular wallet browser extension still sends chills down my spine—an official version turned into an intrusion tool. This blow has awakened many to their reliance on the “security illusion.”

**Timeline: Carefully Crafted Christmas Hijacking**

The story begins on December 8. The hacker registered a spoofed domain api.metrics-trustwallet[.]com and lay in wait for two weeks without action. On December 22, a tampered version v2.68.0 was pushed out through official channels.

By Christmas Day, the fund transfers began. On-chain tracking expert ZachXBT’s monitoring data shows that within just a few days, at least $6 million to $7 million in crypto assets vanished, affecting hundreds of users.

**The Hacker’s True Cleverness**

This isn’t a brute-force server intrusion. The hacker inserted a seemingly harmless PostHog data analytics tool into the code—something wallet companies commonly use in their daily operations. But this tool left a backdoor: when users recharge and reopen the wallet, it quietly steals their mnemonic phrases.

This is a textbook case of supply chain attack. Instead of hacking the server, the attacker poisoned the official distribution channels—tricking users into handing over their private keys to thieves.