Trust Wallet Hack Incident Hacking 101: Compensation Guide Victims Need to Know

Incident Overview: $7 Million Security Breach

Trust Wallet experienced a serious security incident from December 24 to 26, when its Google Chrome extension was injected with malicious code. According to official statistics, this attack resulted in approximately $7 million in user funds being lost. Affected users’ mnemonic phrases were intercepted during login, leading to wallet theft.

CEO Eowyn Chen has publicly announced an official response plan on X platform, including a complete compensation roadmap and user protection measures. This hacking incident serves as a reminder for all crypto users to stay vigilant.

Detailed Compensation Application Process

How to Submit a Compensation Claim

All users who used the Chrome extension during the incident period (December 24-26) can submit a compensation claim through the official dedicated domain. Trust Wallet emphasizes that the application process is simple and requires minimal information.

Information Required

According to the compensation plan, users need to provide the following details:

• Registered email address
• Specific address of the compromised wallet
• Attacker’s wallet address
• Hash of the theft transaction
• Actual amount lost
• New wallet address for receiving compensation

The official recommends victims create a new wallet specifically for the compensation process to avoid using compromised accounts. Additionally, the platform will collect information such as the victim’s location to support subsequent criminal proceedings against malicious actors.

Important Reminder to Prevent Impersonation Scams

Official Warning

The Trust Wallet team explicitly warns users to be cautious of fake compensation schemes impersonating the official. Such hacking-related scams may falsely claim to represent the official and ask for sensitive information.

Features of Legitimate Compensation Plans

Official compensation procedures will never ask for the following:

• Wallet password or private key
• Personal identity data
• Seed phrase (mnemonic)

Users should only submit applications through the official dashboard and avoid interacting via third-party channels.

Technical Vulnerability Details

This incident originated from a leak of API keys during the update process in the Google Chrome extension marketplace. Attackers exploited this vulnerability to inject malicious JavaScript code into version v2.68 of the Trust Wallet extension. Before the code was detected and removed, within 48 hours (December 24-26), all logged-in users’ mnemonic phrases were at risk of being intercepted.

Although the official has not fully disclosed the specific intrusion path of the attackers, this incident once again highlights the importance of user awareness and self-protection.