Christmas gifts turned into a nightmare. While the Western world is immersed in holiday cheer, the crypto community is experiencing a major blow.

Around December 25th, hundreds of users found their wallets being emptied automatically. Bitcoin, Ethereum, SOL… these assets vanished within minutes. One victim’s experience is particularly shocking—less than 10 minutes after importing a seed phrase, $300,000 was gone. Ultimately, it was estimated that approximately $7 million worth of assets were stolen in this attack.

**The Beginning of the Incident**

On December 24th, a seemingly routine browser extension update triggered everything. Users received a new version push, and most didn’t think twice before clicking update. But version 2.68 concealed a time bomb.

The attacker’s method was quite sophisticated. They registered a domain name very similar to the official one in advance and successfully embedded malicious code into the update package. This code disguised itself as a legitimate data analysis tool, but its real purpose was to steal information.

**The Devil is in the Details**

When users input their seed phrase into the plugin, the hacker’s code quietly activates—sending this highly sensitive information to the hacker’s server. No pop-ups, no warnings; everything happens in the dark. Even more terrifying, this malicious code only triggers under specific conditions, making detection extremely difficult.

This is not just a simple technical vulnerability but a carefully planned su