Binance Covers $7M Trust Wallet Hack via SAFU Fund After Chrome Extension Breach

Trust Wallet users lost approximately $7 million in a Christmas Day exploit linked to a compromised browser extension update, according to cybersecurity firm SlowMist. The malicious update, version 2.68 of the Chrome extension, allowed attackers to access users' private data and siphon funds. The breach affected desktop users and was addressed with a new version, 2.69.

Binance founder Changpeng Zhao confirmed that the losses would be covered by Trust Wallet using the platform's Secure Asset Fund for Users (SAFU). He emphasized that the stolen funds would be reimbursed and called the incident a potential insider threat, noting that the malicious update was submitted through the official extension channel.

Blockchain investigators, including ZachXBT, traced more than $6 million in stolen assets across multiple blockchain networks, including Bitcoin, Ethereum, and Solana. The funds were quickly moved through several addresses, making recovery complex. Trust Wallet urged affected users to upgrade to the latest version to prevent further losses.

How the Breach Occurred

The exploit originated from Trust Wallet's Chrome extension version 2.68, which was compromised with malicious code. According to analysis by SlowMist, the attackers began planning the breach as early as December 8 and executed it around Christmas Day. The code collected users' personal information and transmitted it to an attacker-controlled server before initiating the fund withdrawals.

Users who imported their seed phrases into the compromised extension saw their wallets drained within minutes. The attack bypassed standard security measures, as the malicious update was submitted through the official extension distribution channel. Trust Wallet confirmed that the vulnerability was limited to the browser extension and did not affect its mobile apps or the blockchains themselves.

Industry and Analyst Responses

The breach has reignited concerns about the security of browser-based crypto wallets and the risks associated with software supply chains. Cryptocurrency security firm Chainalysis reported that personal wallet compromises accounted for 37% of the $1.4 billion in digital asset theft in 2025, excluding the Bybit hack. Analysts have warned that as adoption of crypto wallets grows, so does the incentive for attackers to exploit vulnerabilities in widely used platforms.

Experts advised users who interacted with the compromised extension to transfer their funds to new wallets and avoid reusing exposed seed phrases. They also recommended revoking permissions tied to affected addresses and considering hardware wallets for larger balances. The incident highlights the importance of multi-layered security practices in the crypto space.

What This Means for Investors

Trust Wallet, which claims to serve 220 million users, has pledged to reimburse all affected accounts. The company has prioritized user support and streamlined refund processes, promising full restitution once verification is complete. The incident could also lead to increased scrutiny of how wallet providers manage their update processes and ensure third-party code integrity.

The breach underscores the broader trend of rising crypto theft, with supply chain attacks and insider threats becoming more prevalent. As Binance and Trust Wallet work to resolve the issue, users are reminded to remain vigilant and prioritize security across all digital asset interactions. Investors are also advised to stay informed about platform updates and follow best practices for wallet management.