
According to Trust Wallet, $8.5 million was stolen via leaked API keys in a v2.68 extension breach linked to a prior supply-chain attack, with compensation and security updates underway.
Trust Wallet announced that its browser extension version v2.68 was compromised between December 24 and 26, resulting in $8.5 million stolen from 2,520 wallets. The breach used leaked API keys tied to November’s ‘Sha1-Hulud’ supply-chain incident, involving stolen GitHub and Chrome Web Store API access. Trust Wallet released v2.69 to fix the issue, initiated compensation for verified victims, and is reviewing over 5,000 claims. Users are urged to move funds from potentially compromised wallets and submit claims via the official form.