Source: Coindoo Original Title: Trust Wallet Warns Users as Chrome Extension Remains Unavailable Original Link: https://coindoo.com/trust-wallet-warns-users-as-chrome-extension-remains-unavailable/

Background

The rollout of an updated Trust Wallet browser extension has been put on hold after an unexpected issue with the Google Chrome Web Store, complicating efforts to assist users affected by a recent security breach.

According to Trust Wallet’s chief executive, Eowyn Chen, the extension is currently unavailable while the team works through what she described as a platform-side bug.

Key Takeaways

• Trust Wallet’s Chrome extension update is delayed due to a Google Chrome Web Store issue.
• The postponed release includes tools for hack victims to verify wallets and submit reimbursement claims.
• More claims have been submitted than confirmed affected wallets, raising concerns over duplicates and fraud.
• Users are warned to watch out for fake Trust Wallet extensions during the downtime.

Current Status

Chen explained that the delayed release was intended to include new functionality specifically designed to help victims of the Christmas Day attack verify their wallets and submit reimbursement claims. The delay has added urgency to the situation, as Trust Wallet continues to process claims tied to the incident.

So far, the company has identified 2,596 wallet addresses that were directly impacted by the hack. However, the claims process has proven challenging. Chen noted that roughly 5,000 claims have already been submitted, suggesting a high volume of duplicate or false requests from users attempting to access compensation fraudulently.

Until the updated extension goes live, Chen urged users to exercise caution, warning that fake Trust Wallet browser extensions may appear on the Chrome Web Store as attackers attempt to exploit confusion during the downtime.

The disruption follows a Christmas Day breach in which attackers drained more than $7 million from Trust Wallet users. The company has since committed to reimbursing affected users in full. The incident has once again drawn attention to the risks associated with browser-based crypto wallets and always-online hot wallets.

Supply Chain Exploit at the Center of the Attack

In a post-mortem report, Trust Wallet said the compromise was likely linked to the “Sha1-Hulud” supply chain exploit — a broader industry incident that targeted npm packages widely used by blockchain developers. According to the report, sensitive development credentials stored on Trust Wallet’s GitHub repository were exposed during the exploit.

This breach allegedly gave the attacker access to the source code of Trust Wallet’s browser extension, along with an application programming interface key tied to its Chrome Web Store listing. Using that key, the attacker was able to upload a malicious version of the extension through an official distribution channel.

The nature of the attack has fueled speculation about insider involvement. Blockchain advisers publicly stated that the level of access required made the incident highly unusual and raised the likelihood of an internal actor. That assessment was echoed by industry observers, who suggested the attacker’s familiarity with Trust Wallet’s codebase pointed to someone with privileged access.

As Trust Wallet works to restore its Chrome extension and complete reimbursements, the episode underscores how supply chain vulnerabilities and compromised credentials can undermine even established crypto infrastructure — and why users are repeatedly urged to verify software sources and remain cautious when using browser-based wallets.