Shai-Hulud Supply Chain Attack Drained $8.5 Million from Trust Wallet Users

Trust Wallet's browser extension v2.68 was compromised through the Shai-Hulud npm supply-chain attack and exposed developer GitHub secrets, enabling an attacker to publish a tampered extension via a leaked Chrome Web Store API key; the malicious build contained a backdoor that collected wallet credentials and executed unauthorized transactions, draining about $8.5 million across identified addresses. Trust Wallet reverted to a clean release, advised affected users to move funds and submit reimbursement claims, and reported white-hat researchers attempted DDoS mitigation against the attacker's domain.