Wallet

At the start of the new year, Toncoin moved above a December resistance area around $1.70 and was changing hands near $1.72 after rising 2% over 24 hours and 12.5% week-on-week. Despite the momentum and attention from Anthony Scaramucci, on-chain and activity metrics remained uneven, with the analysis noting a possible short-term bounce toward $1.89 and $2.01.

Trust Wallet has restored its browser extension to the Chrome Web Store after a December exploit involving about $8.5 million in stolen digital assets from thousands of users. The team released version 2.71.0 with a verification code feature to support a tightened reimbursement process, following reports of more than 5,000 compensation claims against roughly 2,600 identified affected wallet addresses. Trust Wallet and parent company Binance have committed to fully reimbursing verified victims while warning users to avoid fake browser extensions.

An on-chain alert shared by ZachXBT has highlighted a coordinated wallet-draining campaign across several EVM-compatible blockchains, with cumulative losses already exceeding $107,000 and most affected wallets losing under $2,000 each. Investigators report that the stolen funds are being routed through related addresses, but no specific wallet provider, dApp, or exploit vector has yet been identified. The pattern raises broader concerns about stealthy attacks on self-custody users interacting with multiple chains and protocols.

Blockchain investigator ZachXBT warned on January 2, 2026 of an active cross-chain exploit draining hundreds of wallets across EVM-compatible networks. Reported losses exceed $107,000, with most affected addresses losing under $2,000 each while the root cause remains unknown. Researchers are mapping victim addresses, including a suspicious wallet (0xAc2***9bFB) potentially linked to the thefts.

Crypto losses slowed in December 2025, totaling roughly ~$76M, more than 60% below November's $194.27M. The largest hits were an address-poisoning mis-send of about $50M and compromised multisig keys exceeding $27 million, while browser wallets remained frequent targets. Additional cases included a Trust Wallet extension issue near $7 million and a Flow ecosystem breach close to $4 million.

In late December 2025, on-chain investigator ZachXBT reported that hundreds of EVM-compatible wallets on networks like Ethereum and BNB were being drained in small thefts of under $2,000 per victim, with over $107,000 stolen so far. Funds from nearly 20 blockchains have been traced to a single address, which analytics firms link to the Trust Wallet Chrome extension "Shai-Hulud" supply chain attack that began on Christmas Eve. The incident comes amid a record year for crypto-related cybercrime, with billions in digital assets reportedly stolen across major hacks and phishing campaigns.

South Korean exchange Bithumb identified about 291.6 billion Korean won (roughly $201.8 million) in idle customer crypto spread across around 2.6 million accounts, according to Finance Feeds. The review flagged balances untouched for up to 4,380 days, including a single dormant account worth approximately $2.84 million. Some holdings logged gains exceeding 61,000%.

PeckShield said total crypto losses from hacks fell to about $76 million in December, a 60% drop from November's $194.2 million across 26 major incidents. The month included a $50 million address‑poisoning scam and around $27.3 million lost to a multisig key leak, while Trust Wallet and Flow added $7 million and $3.9 million, respectively.

Blockchain security firm PeckShield reported around $76 million in crypto losses from hacks and exploits in December, a 60% drop from November's $194.2 million. The month included 26 major incidents, with one user losing $50 million to an address-poisoning scam and another losing $27.3 million due to a multisig private key leak.

On December 31, 2025, Trust Wallet said its Chrome extension was temporarily removed after a Chrome Web Store bug blocked a new release, slowing a verification tool for reimbursement claims. The company earlier confirmed a malicious v2.68 was distributed on December 25, identifying 2,520 drained addresses and roughly $8.5 million tied to 17 attacker wallets.