TrustWallet Hack Explained: From Update to Wallet Drains worth $16M in $TWT, BTC, ETH

TWT5,92%
BTC2,57%
ETH2,65%

What Exactly Happened in the Trust Wallet Incident


Step 1: A New Browser Extension Update Was Released

A new update for the Trust Wallet browser extension was released on December 24.

  • The update seemed routine.

  • No major security warnings came with it.

  • Users installed it through the usual update process.

At this point, nothing seemed suspicious.


Step 2: New Code Was Added to the Extension

After the update, researchers looking into the extension’s files noticed changes in a JavaScript file known as 4482.js.

Key observation:

  • The new code was not in earlier versions.

  • It introduced network requests linked to user actions.

This matters because browser wallets are very sensitive environments; any new outgoing logic poses a high risk.


Step 3: Code Masqueraded as “Analytics”

The added logic appeared as analytics or telemetry code.

Specifically:

  • It looked like tracking logic used by common analytics SDKs.

  • It did not trigger all the time.

  • It activated only under certain conditions.

This design made it harder to detect during casual testing.


Step 4: Trigger Condition — Importing a Seed Phrase

Community reverse-engineering suggests the logic was triggered when a user imported a seed phrase into the extension.

Why this is critical:

  • Importing a seed phrase gives the wallet full control.

  • This is a one-time, high-value moment.

  • Any malicious code only needs to act once.

Users who only used existing wallets may not have triggered this path.


Step 5: Wallet Data Was Sent Externally

When the trigger condition occurred, the code allegedly sent data to an external endpoint:

metrics-trustwallet[.]com

What raised alarms:

  • The domain looked a lot like a legitimate Trust Wallet subdomain.

  • It was registered only days earlier.

  • It was not publicly documented.

  • It later went offline.

At least, this confirms unexpected outgoing communication from the wallet extension.


Step 6: Attackers Acted Immediately

Shortly after seed phrase imports, users reported:

  • Wallets drained within minutes.

  • Multiple assets moved quickly.

  • No further user interaction was needed.

On-chain behavior showed:

  • Automated transaction patterns.

  • Multiple destination addresses.

  • No obvious phishing approval flow.

This suggests attackers already had enough access to sign transactions.


Step 7: Funds Were Consolidated Across Addresses

Stolen assets were routed through several attacker-controlled wallets.

Why this matters:

  • It suggests coordination or scripting.

  • It reduces reliance on a single address.

  • It matches behavior seen in organized exploits.

Estimates based on tracked addresses suggest millions of dollars moved, although totals vary.


Step 8: The Domain Went Dark

After attention increased:

  • The suspicious domain stopped responding.

  • No public explanation followed immediately.

  • Screenshots and cached evidence became crucial.

This is consistent with attackers destroying infrastructure once exposed.


Step 9: Official Acknowledgment Came Later

Trust Wallet later confirmed:

  • A security incident affected a specific version of the browser extension.

  • Mobile users were not affected.

  • Users should upgrade or disable the extension.

However, no full technical breakdown was given right away to explain:

  • Why the domain existed.

  • Whether seed phrases were exposed.

  • Whether this was an internal, third-party, or external issue.

This gap fueled ongoing speculation.


What Is Confirmed

  • A browser extension update introduced new outgoing behavior.

  • Users lost funds shortly after importing seed phrases.

  • The incident was limited to a specific version.

  • Trust Wallet acknowledged a security issue.


What Is Strongly Suspected

  • A supply-chain issue or malicious code injection.

  • Seed phrases or signing ability being exposed.

  • The analytics logic being misused or weaponized.


What Is Still Unknown

  • Whether the code was intentionally malicious or compromised upstream.

  • How many users were affected.

  • Whether any other data was taken.

  • Exact attribution of the attackers.


Why This Incident Matters

This was not typical phishing.

It highlights:

  • The danger of browser extensions.

  • The risk of blindly trusting updates.

  • How analytics code can be misused.

  • Why handling seed phrases is the most critical moment in wallet security.

Even a short-lived vulnerability can have serious consequences.

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.

Related Articles

BTC rises 0.64% in 15 minutes: long-position amplification combined with spot fund inflows drives the move

2026-04-17 12:45 to 2026-04-17 13:00 (UTC), the BTC price fluctuated within the 75720.6 to 76256.6 USDT range, and the return rate within 15 minutes reached +0.64%, with a range of 0.71%. During this period, market attention stayed high, trading activity increased, short-term volatility intensified, reflecting a rapid market move driven by concentrated capital. The main driving force behind this anomaly is that the long-position structure has been significantly amplified on coin-margined perpetual contracts, along with rapid inflows of funds into the long direction. Data shows that in the 12:45–13:00 window, the long contract positions for BTC surged from 8M to 11.4M, accounting for 57% to 77%. Short-term long funds concentrated into the market, and buy-side strength rose markedly, forming a direct impetus for price upside. At the same time, net inflows of ETF funds in the spot market increased, with holdings in major ETF products rising; institutional buying became more active, and the coordination strengthened spot price support. In addition, on-chain active addresses remained at a high level, trading volume expanded significantly, and BTC net inflows on mainstream trading platforms on April 17 also rose—together indicating increased market participation. Meanwhile, BTC broke through a key historical price range ($75,000), and technical buying as well as momentum-chasing funds entered in line with the move. Besides structural factors, global macro environmental risks remain elevated. Some capital is inclined toward BTC as a safe haven, and in the short term, multiple factors have converged, jointly pushing up the market’s volatility. In the near term, with the share of long positions and trading volume rising, if there is an unexpected news event or a reversal in sentiment, it is likely to trigger a rapid pullback. Key risk focus points include: changes in capital flows on mainstream trading platforms, the strength of support in the $75,000 range, and how macro events evolve. Users should be alert to short-term risks during periods of high volatility, monitor key on-chain and macro indicators in real time, and stay on top of more market updates.

GateNews33m ago

American Bitcoin (ABTC) to Release Q1 2026 Earnings on May 6

American Bitcoin (ABTC) will release its Q1 2026 earnings report on May 6, 2026, after U.S. market close, followed by a live earnings call and webcast at 4:30 PM ET.

GateNews49m ago

Solv Protocol and Utexo Launch Bitcoin-Native Yield Infrastructure

Solv Protocol has integrated with Utexo to launch a bitcoin-native yield infrastructure that uses the RGB protocol and Lightning Network to enable direct, atomic swaps between bitcoin and USDT. Key Takeaways: Solv Protocol and Utexo integrated to launch native BTC yield with atomic swaps for $2 b

Coinpedia1h ago

Zonda Exchange CEO Blames Missing Founder for $336M in Lost Bitcoin

Zonda CEO Przemysław Kral has attributed the exchange's loss of access to 4,500 BTC, valued at $336 million, to missing founder Sylwester Suszek's failure to transfer private keys. Amid allegations of bankruptcy and intensified withdrawal requests, Kral insists Zonda remains solvent and will pursue legal action while searching for Suszek, who disappeared in 2022.

GateNews2h ago

BTC drops 0.52% in 15 minutes: Whale inflows to exchanges combined with insufficient liquidity amplify sell pressure

From 2026-04-17 10:15 to 2026-04-17 10:30 (UTC), the BTC price rapidly fell within the 75214.3 – 75725.9 USDT range. The cumulative return over 15 minutes was -0.52%, and the amplitude reached 0.68%. During this period, market sentiment shifted from cautious to bearish, volatility on the board increased, mainstream trading pairs saw an increase in主动 sell-side volume, buy-side acceptance became constrained, and overall trading activity declined significantly. The primary driver behind this unusual move is that large holders (whales) concentrated their short-term inflows into exchanges. On-chain data shows that net inflows to addresses holding more than 1000 BTC per address changed from a steady state to a positive value, directly boosting exchange balances over the short term. Historical data indicates that whale inflows to exchanges are highly correlated with sell pressure in the medium to short term. In the same period, order book snapshots reflected a significant increase in the volume of主动 sell orders, and the成交价梯度 shifted downward, highlighting that weak market absorption capacity caused a short-term drop in price. In addition, in the derivatives market, the long/short positioning structure tilted toward shorts. The number of主动 sell contracts exceeded that of buys in a short time, and rising pressure to close long positions further intensified the downtrend. Market liquidity overall was relatively weak; the number of active addresses over the past 10 minutes was only about 42k, and both fees and the mempool were near their lowest levels of the recent month. Against a backdrop of insufficient capital absorption, the marginal impact of large sell orders was amplified. On the macro front, the Federal Reserve’s monetary policy tightening and industry media repeatedly downgraded BTC’s near-term expectations led investors’ risk appetite to generally decline, creating a resonance at the level of market sentiment. In the short term, it is still necessary to stay alert to liquidity risk and the price impact of one-way large transactions in specific trading pairs. Going forward, focus on key developments such as changes in whales’ on-chain holdings, exchange balances, and rebounds in activity metrics, as well as the potential impact of macro policy direction on risk assets. Relevant users should primarily guard against the risk of sharply amplified short-term price volatility and promptly track more market information.

GateNews3h ago

Bitcoin Developers Propose Freezing Coins That Skip Quantum-Safe Migration Under BIP-361

A draft proposal circulating among Bitcoin developers would give holders roughly five years to move their coins to quantum-resistant addresses or watch them become permanently unspendable on the network. Key Takeaways: BIP-361, co-authored by Casa CTO Jameson Lopp, proposes freezing Bitcoin in le

Coinpedia3h ago
Comment
0/400
No comments