Binance Trust Wallet Chrome Extension Hack Results in $7 Million Loss

• Trust Wallet’s Chrome browser extension was compromised through a malicious update.
• Roughly $7 million in cryptocurrency was drained from affected wallets.
• Binance and Trust Wallet say verified users will be reimbursed.

A Browser Extension Compromise Hits Trust Wallet Users

Binance-linked Trust Wallet has confirmed that its Chrome browser extension was compromised in a software supply-chain attack, leading to the theft of approximately $7 million in cryptocurrency. The incident affected thousands of users who installed or updated the extension during a narrow time window in late December, raising fresh concerns about browser-based wallet security and software distribution risks in crypto.

The breach did not involve Binance’s centralized exchange or Trust Wallet’s mobile applications. Instead, attackers exploited the extension update mechanism, distributing a malicious version through the Chrome Web Store that allowed them to extract users’ wallet recovery phrases and drain funds.

How the Attack Unfolded

According to Trust Wallet, the attackers published a compromised version of the Chrome extension after gaining unauthorized access to credentials used for releasing updates. The malicious version appeared legitimate and was automatically delivered to users through the Chrome Web Store’s standard update process.

Once installed, the extension silently collected sensitive wallet data when users accessed or imported their wallets. This information enabled attackers to recreate wallets externally and transfer assets out without further interaction from victims.

Trust Wallet said the malicious release was live for a limited period before being identified and removed. A clean version of the extension was subsequently issued, and users were instructed to update immediately and assume that any wallet accessed through the compromised version was unsafe.

Scope of the Losses

Trust Wallet estimates that approximately $7 million worth of digital assets were stolen, impacting around 2,600 wallet addresses. The losses varied by user, depending on the assets held at the time the compromised extension was used.

The company emphasized that only users of the Chrome browser extension were affected. Mobile wallet users and those using other browser versions were not exposed to the exploit, based on the company’s investigation to date.

Binance and Trust Wallet Response

Binance executives publicly acknowledged the incident shortly after it was disclosed, stating that Trust Wallet would reimburse verified victims. Trust Wallet has since opened a claims process, asking affected users to submit wallet addresses, transaction details, and supporting evidence for review.

The company said it is working to filter out fraudulent or duplicate claims, noting that high-profile incidents often attract false submissions. Trust Wallet has not provided a firm timeline for completing reimbursements, but said valid claims will be covered once verification is complete.

From a technical standpoint, Trust Wallet said it has revoked compromised credentials, strengthened internal release controls, and worked with platform partners to prevent further unauthorized updates. The infrastructure used by the attackers to receive stolen data has also been taken offline.

Why This Incident Matters

While $7 million is relatively small compared with some large exchange or decentralized finance exploits, the Trust Wallet incident is notable because it targeted end users directly through a trusted software distribution channel. Browser extensions are widely used in crypto for convenience, and automatic updates are generally assumed to be safe.

This attack highlights how software supply-chain vulnerabilities can bypass traditional security assumptions. Users who follow best practices, avoid phishing, and protect private keys can still be exposed if trusted software itself is compromised.

The incident also underscores the ongoing tension between usability and security in crypto wallet design. Browser extensions lower friction for interacting with Web3 applications but remain dependent on centralized platforms for distribution and updates.

Market and Industry Impact

There was no immediate, measurable impact on broader crypto markets following the disclosure. Binance operations were unaffected, and no customer funds on the exchange were involved.

Within the industry, however, the incident has prompted renewed scrutiny of browser-based wallets and calls for stronger safeguards around extension updates, including additional verification steps and clearer warnings for users when critical components change.

Security researchers have pointed out that similar attack vectors could be used against other widely installed extensions, both inside and outside the crypto sector, if release credentials are compromised.

What Happens Next

Trust Wallet says its investigation is ongoing, including efforts to determine how the release credentials were exposed and whether additional safeguards are needed. Attribution for the attack has not been publicly confirmed.

For users, the company continues to recommend moving funds to new wallets generated on uncompromised devices and treating any wallet accessed through the affected extension version as permanently unsafe.