Top Tweets for #UnTrustWallet

Web3 Dividends @Web3Dividends

10 months ago

#UntrustWallet, better try @oisy & $ICP (security built in)

MASTR

@MastrXYZ

10 months ago

Everything we know about the #TrustWallet exploit summarized: As of 26.12.2025, this looks like a straight supply chain compromise of the Trust Wallet Chrome extension, not a user approval mistake. 🔺What happened: Trust Wallet shipped Chrome extension v2.68.0 on 24.12.2025. Shortly after, users who imported or accessed their seed in that version got drained, often within minutes. 🔺What the code allegedly did: Researchers and trackers describe a malicious JavaScript payload in the extension, commonly referenced as a file like 4482.js, disguised as analytics or a PostHog style integration. The goal was simple: exfiltrate mnemonics to attacker infrastructure such as domains like metrics- trustwallet. com or api. metrics- trustwallet. com, then sweep funds. 🔺Why the drains were so brutal: If the attacker has your seed, there is no need for approvals, signatures, or phishing popups. They just restore your wallet elsewhere and empty everything across chains that share that seed. That matches the reports: BTC, EVM, SOL, BNB Chain, fast multi hop routing. 🔺On chain money flow highlights: Tracking reports show a large chunk pushed into services and exchanges. One widely shared breakdown says about 4.25M USD was routed to ChangeNOW, FixedFloat, KuCoin, and HTX. Another tracker post says the attacker drained about 2.8M in crypto across multiple chains. These numbers can overlap depending on snapshot timing and which addresses are included. 🔺Who sounded the alarm: The first big public warning came from on chain investigator ZachBNB, who connected the drains to the v2.68 update and shared theft addresses while funds were still moving. 🔺Trust Wallet and CZ statements: Trust Wallet says only browser extension v2.68 was affected, mobile users are not affected, and users should disable v2.68 and upgrade to v2.69. CZ says about 7m USD was affected and Trust Wallet will cover losses, while they investigate how the bad version got submitted. Let's see... 🔺The part that should worry everyone: The biggest question is not the malware itself. It is how it shipped. If a malicious build can reach the Chrome Web Store under an official wallet brand, then the weakest link is the release pipeline: developer account, build system, CI, signing, third party dependencies, or internal access. CZ explicitly points at the submission path as the open problem. Delayed warning while users were actively getting wiped No real root cause yet, only scope statements Holiday timing amplified damage and rage Reimbursement helps, but it does not repair trust in the extension model. @cz_binance acquired the wallet in 2018 through Binance, where he is a majority stakeholder, but did not disclose the purchase price.

132

15K

256

Amp Blessike @thagreen707

almost 5 years ago

@TrustWallet We are now a week into my issue with ZERO movement. Is anybody elses balance of ALL of their tokens dropped to 0? #UnTrust #UnTrustWallet