Trust Wallet wallet compromise: How to claim compensation?

The Trust Wallet Chrome extension was targeted by a cyberattack over the last weekend of December. Attackers injected malicious code into the Chrome extension, resulting in estimated losses of around $7 million. Below, we detail how victims can recover their funds through the official recovery program.

Details of the Chrome Extension Attack

Between December 24 and 26, hackers carried out an advanced attack on version v2.68 of the Trust Wallet extension available in the Chrome Web Store. The scammers injected a fragment of malicious JavaScript code directly into the Chrome extension, allowing them to capture the seed phrase of any user who logged in during this time window.

Security experts suggest that the attack was possible due to a credential leak. The attackers likely gained access to API keys used in the process of publishing updates to the extension in the official extension store. This security flaw enabled them to modify the code before distribution.

Compensation Program – How to Submit a Claim

Trust Wallet management has launched a specialized claims handling system for affected users. According to the announcement made by project leaders, each victim can apply for a full refund of their losses.

Required steps for the procedure:

Interested users must register exclusively through the dedicated portal, avoiding any alternative channels. The procedure requires providing the following information:

• Email address used in the wallet
• Public address of the compromised wallet
• Public address of the thief
• Transaction hash through which the funds were transferred
• New wallet address for the refund

Security recommendation: Before using the refund program, create a completely new wallet to avoid potential security threats.

Warnings Against Scams and Fake Initiatives

The project’s security team explicitly warns against fake compensation programs appearing on social media. Legitimate claims will never require users to disclose passwords, sensitive personal data, or seed phrases.

Victims of the attack should be especially cautious of:

• Private messages impersonating official channels
• Links to counterfeit application sites
• Requests for quick identity verification outside the official portal

Collecting Evidence and Legal Actions

Along with the compensation process, geographic data of affected third parties is being collected. This information is intended to be used in future criminal proceedings against the cyberattack perpetrators.

The current state of the investigation indicates that the incident was likely caused by a compromise in the distribution system of the Chrome extension. Security analysis is ongoing to prevent similar incidents from happening again.