Trust Wallet, the Binance-owned crypto wallet serving over 220 million users, has pledged to reimburse $7 million lost in a Christmas Day exploit. The breach targeted desktop users through a compromised browser extension, raising alarms across the industry. Binance co-founder Changpeng Zhao (CZ) confirmed the losses will be covered. At the same time, cybersecurity experts warned the attack bore hallmarks of insider involvement.
The incident unfolded on December 25 when attackers exploited Trust Wallet’s browser extension version 2.68. According to blockchain security firm SlowMist, preparations began as early as December 8, with a backdoor implanted by December 22. Funds were siphoned on Christmas Day, affecting hundreds of users. Trust Wallet advised users to upgrade to version 2.89 to mitigate risks.
CZ announced that Binance would ensure affected users are reimbursed for the $7 million stolen. His statement underscored Binance’s commitment to user protection amid rising wallet-targeted hacks. While the amount pales compared to larger breaches such as the $9.7 million loss suffered by Axie Infinity co-founder Jeff Zirlin in 2024, the Trust Wallet case highlights vulnerabilities in widely used extensions.
Industry voices, including intergovernmental blockchain adviser Anndy Lian, suggested the exploit was “most likely” an insider job. SlowMist noted the attacker’s deep familiarity with Trust Wallet’s source code, enabling them to embed malicious functions that exported sensitive user data. The ability to submit a new extension version to the official site further fueled suspicions of insider access.
Chainalysis data shows personal wallet compromises accounted for 37% of stolen value in 2025, excluding the $1.4 billion Bybit hack. This trend underscores the growing risks individual investors face compared to centralized exchange breaches. The Trust Wallet exploit, though smaller in scale, reinforces the urgency of stronger supply chain protections and vigilant user practices in safeguarding digital assets.
