Trust Wallet's mnemonic leak crisis, security researchers warn of new supply chain attack

On December 26, 2024, the security community reported a shocking discovery. According to reports from PANews, the browser extension of the famous wallet “Trust Wallet” was suspected of being infected with malicious code that steals users’ mnemonic (a 12- to 24-word recovery phrase used to restore private keys). This finding was revealed through detailed analysis by security researchers @im23pds and @0xakinator.

The Nature of the Embedded Malicious Code

In version 2.68 of the Trust Wallet browser extension, a file named “4482.js” was illegally embedded. At first glance, this malicious code appeared to be a normal analysis tool, but in reality, it contained extremely dangerous functions. During the wallet import process, this code automatically extracted the mnemonic phrase in the background and transmitted it to an external domain set up by the attacker.

The Flow of Mnemonic Theft and Damage Mechanism

The attacker exploited a phishing domain called “metrics-trustwallet[.]com,” which closely resembled the official domain. Unbeknownst to users, their most critical secret information—the mnemonic phrase—was transmitted to this server. Currently, access to this domain is unavailable, but it remains unclear how long and to what extent the leaked mnemonic data was exploited. Such supply chain attacks are highly malicious threats that cannot be prevented by individual user measures alone.

Urgent Measures Users Should Take

This incident suggests that even trusted wallet vendors cannot guarantee complete safety. Trust Wallet users are strongly advised to immediately generate a new recovery phrase for their wallet and disable the current mnemonic. Additionally, using multiple wallet management tools and implementing cold wallets for large assets are effective defensive strategies. Thanks to the swift discovery and reporting by security researchers, further damage was prevented, but user vigilance and prompt response are key to overcoming such incidents.