Shai-Hulud NPM Attack Leads to $8.5 Million Crypto Theft in Trust Wallet

Trust Wallet Security Breach: A Closer Look

Trust Wallet recently experienced a significant security breach, resulting in the theft of approximately $8.5 million from over 2,500 crypto wallets. The incident, which occurred on December 24th, is believed to be linked to a Sha1-Hulud attack that targeted the crypto industry in November.

As a popular crypto wallet used by more than 200 million individuals, Trust Wallet allows users to securely store, send, and receive various cryptocurrencies such as Bitcoin, Ethereum, and Solana. This is facilitated through its web browser extension and mobile apps.

The breach involved malicious actors adding a harmful JavaScript file to version 2.68.0 of Trust Wallet’s Chrome extension. This file enabled the theft of sensitive wallet data, leading to unauthorized transactions.

During the attack, the perpetrators exploited Trust Wallet’s exposed Developer GitHub secrets, gaining access to the browser extension source code and the Chrome Web Store API key. This access allowed them to upload builds directly without undergoing the standard release process.

Subsequently, the attackers registered malicious domains to host code referenced in a trojanized version of the Trust Wallet extension. This modified extension collected sensitive wallet data without the need for traditional code injection.

In response to the breach, Trust Wallet took immediate action by revoking all release APIs to prevent further unauthorized releases. They also reported the malicious domains to the registrar, leading to their suspension.

Furthermore, Trust Wallet initiated reimbursements for affected users and cautioned them about ongoing scams involving impersonation of Trust Wallet support accounts.

The Rise of Sha1-Hulud Malware Campaign

Sha1-Hulud, also known as Shai-Hulud 2.0, is a supply chain attack that targeted the npm software registry. This attack compromised over 800 packages and exposed around 400,000 raw secrets, highlighting the vulnerability of the npm ecosystem.

Security researchers have warned about the increasing sophistication of attackers in harvesting credentials through npm and GitHub, emphasizing the need for enhanced security measures within the development community.