Suspected mnemonic phrase eavesdropping: Trust Wallet browser extension targeted by malware attack

On December 26th, security researchers @im23pds and @0xakinator discovered a critical vulnerability in the Trust Wallet browser extension. Malicious code embedded in version 2.68 (file 4482.js) has been identified as capable of stealing users’ mnemonic phrases. This discovery was reported by PANews and has caused significant shock among cryptocurrency users.

Mechanism of Malicious Code Injection and Mnemonic Theft

Analysis by security researchers revealed that file 4482.js disguises itself as an analysis tool but actually operates for malicious purposes. When users import their wallets, this code automatically extracts the mnemonic phrase and sends it to a newly registered phishing domain “metrics-trustwallet[.]com”. Currently, this domain is inaccessible, but during this time, many users’ information may have been leaked.

Threat of Supply Chain Attacks and Scope of Damage

This incident is a typical example of a supply chain malware attack. Malicious code hidden within the legitimate wallet application directly steals users’ most sensitive secret information—the mnemonic phrase. Victims may remain unaware that their wallets have been hacked and risk losing their assets.

Technical Findings by Security Researchers

Detailed analysis by @im23pds and @0xakinator has revealed the full scope of this attack. Users running version 2.68 should immediately take measures such as migrating their wallets and enhancing security, as their mnemonic phrases may have been compromised.