Trust Wallet links $8.5 million crypto theft to Shai-Hulud NPM attack

Trust Wallet's Chrome extension (v2.68.0) was trojanized after attackers obtained developer GitHub secrets and a Chrome Web Store API key, allowing them to upload a malicious build that stole wallet data and triggered unauthorized transactions, resulting in roughly $7–8.5M stolen from about 2,500 wallets; malicious code was hosted on metrics-trustwallet[.]com. The incident is attributed to and contextualized with the Sha1-Hulud supply-chain campaign against npm, which exposed ~400,000 secrets and hundreds of compromised packages, indicating widespread credential-harvesting and ongoing risk to developer ecosystems and end users.