Wallet

An on-chain alert shared by ZachXBT has highlighted a coordinated wallet-draining campaign across several EVM-compatible blockchains, with cumulative losses already exceeding $107,000 and most affected wallets losing under $2,000 each. Investigators report that the stolen funds are being routed through related addresses, but no specific wallet provider, dApp, or exploit vector has yet been identified. The pattern raises broader concerns about stealthy attacks on self-custody users interacting with multiple chains and protocols.

Blockchain investigator ZachXBT warned on January 2, 2026 of an active cross-chain exploit draining hundreds of wallets across EVM-compatible networks. Reported losses exceed $107,000, with most affected addresses losing under $2,000 each while the root cause remains unknown. Researchers are mapping victim addresses, including a suspicious wallet (0xAc2***9bFB) potentially linked to the thefts.

Crypto losses slowed in December 2025, totaling roughly ~$76M, more than 60% below November's $194.27M. The largest hits were an address-poisoning mis-send of about $50M and compromised multisig keys exceeding $27 million, while browser wallets remained frequent targets. Additional cases included a Trust Wallet extension issue near $7 million and a Flow ecosystem breach close to $4 million.

In late December 2025, on-chain investigator ZachXBT reported that hundreds of EVM-compatible wallets on networks like Ethereum and BNB were being drained in small thefts of under $2,000 per victim, with over $107,000 stolen so far. Funds from nearly 20 blockchains have been traced to a single address, which analytics firms link to the Trust Wallet Chrome extension "Shai-Hulud" supply chain attack that began on Christmas Eve. The incident comes amid a record year for crypto-related cybercrime, with billions in digital assets reportedly stolen across major hacks and phishing campaigns.

South Korean exchange Bithumb identified about 291.6 billion Korean won (roughly $201.8 million) in idle customer crypto spread across around 2.6 million accounts, according to Finance Feeds. The review flagged balances untouched for up to 4,380 days, including a single dormant account worth approximately $2.84 million. Some holdings logged gains exceeding 61,000%.

PeckShield said total crypto losses from hacks fell to about $76 million in December, a 60% drop from November's $194.2 million across 26 major incidents. The month included a $50 million address‑poisoning scam and around $27.3 million lost to a multisig key leak, while Trust Wallet and Flow added $7 million and $3.9 million, respectively.

Blockchain security firm PeckShield reported around $76 million in crypto losses from hacks and exploits in December, a 60% drop from November's $194.2 million. The month included 26 major incidents, with one user losing $50 million to an address-poisoning scam and another losing $27.3 million due to a multisig private key leak.

On December 31, 2025, Trust Wallet said its Chrome extension was temporarily removed after a Chrome Web Store bug blocked a new release, slowing a verification tool for reimbursement claims. The company earlier confirmed a malicious v2.68 was distributed on December 25, identifying 2,520 drained addresses and roughly $8.5 million tied to 17 attacker wallets.

Toncoin climbed nearly 10% over the past week as buyers returned after a mid-month dip, with RSI strengthening and MACD turning bullish. The move aligned with Telegram launching a self-custodial wallet for U.S. users, enabling in-app send, swap, and storage. DeFi TVL sat around $85 million and stablecoin supply near $960 million, signaling active usage but lagging liquidity.

Bank of China stated it will begin paying interest on digital renminbi (e‑CNY) wallet balances from January 1, 2026, at rates aligned with current deposit policies. The move fits within the digital currency framework overseen by the People's Bank of China, and similar steps have been taken by other state‑owned banks.