Trust Wallet Chrome extension hack tied to millions in losses

A compromised Trust Wallet Chrome extension update (v2.68.0) released on December 24 contained packed JavaScript that exfiltrated wallet recovery seed phrases to a newly registered domain (metrics-trustwallet.com), enabling attackers to steal at least $7 million; attackers also promoted a phishing site (fix-trustwallet.com) that solicited seed phrases. Trust Wallet advised users to disable the extension and update to v2.69, and researchers identified indicators including the malicious domains and the affected extension version.