A software supply chain attack involving the self-replicating Shai-Hulud 2.0 worm has been linked to a $8.5 million theft from cryptocurrency wallet Trust Wallet, the company confirmed in a post-mortem report.
The attack exploited version 2.68 of Trust Wallet’s Chrome browser extension, which hackers published on December 24, 2025. Customers who logged in between December 24 and 26 were affected. According to Trust Wallet, 2,520 wallet addresses were drained, funneling assets into 17 attacker-controlled addresses. The company has pledged to reimburse all impacted users.
Investigators traced the breach to a software supply chain compromise in the NPM ecosystem. Shai-Hulud 2.0 allowed attackers to access Trust Wallet’s developer GitHub secrets, source code, and Chrome Web Store API key. This enabled the attackers to publish a malicious version of the extension outside standard release procedures. The malware retrieved additional malicious code from a remote domain, capturing sensitive wallet data and enabling fraudulent transactions.
Trust Wallet has advised all users to immediately update to version 2.69 of the Chrome extension to prevent further exploitation.
Shai-Hulud Worm: Timeline and Impact
Shai-Hulud is a self-replicating worm first observed targeting NPM packages in September 2025. The second outbreak, Shai-Hulud 2.0, occurred in late November, infecting over 640 NPM packages and creating more than 25,000 repositories that exposed victims’ sensitive data.
Industry responses helped slow the worm’s spread, reducing new repository creation to 100–200 per day between November 25 and December 24, 2025. However, incomplete updates and cached infected packages allowed the worm to continue propagating. By late December, cybersecurity firm Wiz identified over 12,000 compromised machines and more than 29,000 repositories exposing sensitive credentials and tokens.
Shai-Hulud 3.0 Emerges
Despite containment efforts, a new variant, Shai-Hulud 3.0, was detected on December 28 in the @vietmoney/react-big-calendar package. This iteration maintains the worm’s core mechanisms, scanning for API keys and credentials at install time and exfiltrating them to attacker-controlled servers. Unlike earlier versions, the “dead man switch” that previously wiped systems if no tokens were found has been removed, making this version purely data-stealing.
Developers and users of affected NPM packages are strongly advised to remove infected dependencies immediately and rotate all credentials and API keys to prevent ongoing exposure.
The incident underscores the risks of software supply chain attacks, which have increasingly targeted open-source ecosystems, cryptocurrency platforms, and critical infrastructure.
