Crypto security in 2025: Trust Wallet hacked, Ledger exposed again – What solutions to protect your assets?

Two major cybersecurity incidents have shaken user confidence: $7 million stolen via a compromised Chrome extension on Trust Wallet, and a new personal data leak at Ledger. As attacks increase, the industry is exploring radically different approaches to securing the ecosystem.

Trust Wallet: $7 million stolen via malicious extension

On December 24, 2025, an update to the Trust Wallet Chrome extension (version 2.68) allowed attackers to suck up almost $7 million on several blockchains. The incident, initially revealed by on-chain investigator ZachXBT, impacted hundreds of users who imported their recovery phrases into the compromised extension.

According to analyzes by PeckShield and SlowMist, the malicious code silently transmitted wallet data to a phishing domain (metrics-trustwallet.com), recorded a few days before the attack. The stolen funds — approximately $3 million in Bitcoin and more than $3 million in Ethereum — were laundered through centralized platforms (ChangeNOW, FixedFloat, KuCoin).

Eowyn Chen, CEO of Trust Wallet, confirmed that the malicious extension was released thanks to a Compromised Chrome Web Store API keybypassing internal validation processes. Changpeng Zhao, co-founder of Binance (owner of Trust Wallet), announced a full refund for victims, suggesting possible involvement of a “state actor” or insider.

Ledger: A new data leak via a third-party partner

In early January 2026, Ledger informed its customers of a new exposure of personal data following a breach at Global-e, its payment provider and e-commerce partner. The compromised information includes the names, email and postal addresses of some buyers on ledger.com.

Ledger said its internal systems, hardware and software were not affected. Global-e does not have access to recovery phrases (24 words), private keys or user balances. However, this leak renews concerns: in 2020, a similar breach exposed the data of more than 270,000 customers, fueling persistent phishing campaigns and “monkey attacks” (targeted physical extortion).

According to an internal Ledger study, social engineering attacks increased by 40% in 2025 compared to 2024, attackers now exploit stolen personal data to bypass traditional security measures.

The fundamental problem: A vulnerable centralized architecture

These two incidents, although different, share a common denominator: dependence on single points of failure. At Trust Wallet, a single compromised API key was enough to inject malicious code. At Ledger, reliance on an external vendor exposed customer data.

According to the Chainalysis 2025 report, more than $3.4 billion stolen this year in the crypto ecosystem, with a sharp increase in attacks targeting individual users rather than protocols. CertiK confirms this trend: hackers are moving away from the vulnerabilities of smart contracts to exploit human weaknesses and peripheral entry points.

Faced with this reality, the blockchain cybersecurity industry is exploring new approaches to overcome the limits of the traditional model.

Overview of blockchain cybersecurity solutions

Several major players offer complementary approaches to secure the Web3 ecosystem:

CertiK: Auditing as an industrial standard

World leader in smart contract auditing, CertiK raised $296 million and protects over $300 billion in assets for 3,200 clients. Its Skynet platform provides real-time monitoring, while its formal verification tools identify vulnerabilities before deployment. Limit : the audit remains a snapshot that does not cover post-deployment threats or infrastructure attacks.

Hacken and Quantstamp: Audit and certification

Hacken And Quantstamp offer recognized audits, including proof of reserves for exchanges. Bybit EU, for example, uses Hacken audits for transparency. Limit : Like CertiK, these audits do not protect against evolving threats or real-time infrastructure compromises.

Naoris Protocol: Towards decentralized and post-quantum cybersecurity

A radically different approach emerges with Naoris Protocolwhich turns every connected device into a security validation node. Founded in 2018 by David Carvalho, the protocol deploys a “ Trust Mesh » decentralized where devices audit each other in real time, eliminating single points of failure.

Unlike point audit solutions, Naoris works through an innovative consensus mechanism called dPoSec (Decentralized Proof of Security)in which each node continually validates the integrity of the others. The platform also integrates SWARM AIa distributed artificial intelligence that coordinates responses to threats and instantly distributes defensive updates.

What particularly distinguishes Naoris is its post-quantum infrastructure. While current cryptographic algorithms (RSA, ECC) are vulnerable to future quantum computers, Naoris uses standards aligned with NIST, NATO NCIA and ETSI (including Dilithium-5) to ensure long-term resilience. In September 2025, the protocol was cited in a filing with the US SEC as a reference model for quantum-resistant blockchain infrastructure.

The testnet, launched in January 2025, displays impressive metrics: more than 100 million post-quantum transactions processed, 3.3 million wallets, 1 million validator nodes and 600 million threats neutralized. The project has raised $31 million from investors including Tim Draper and benefits from advisors from IBM, NATO and the White House.

What this means for users

In the case of Trust Wallet, a Trust Mesh architecture could have detected the anomalous behavior of the compromised extension (transmitting data to an external domain) before funds were drained. Every device on the network could have collectively alerted the anomaly.

For Ledger, dependence on a single supplier (Global-e) illustrates the limits of the centralized model. Decentralized validation of the integrity of third-party systems would have reduced the attack surface and limited data exposure.

The distributed philosophy zero-trust » does not just secure a single point: it makes the entire ecosystem resilient. This approach could apply not only to wallets but also to DeFi platforms, DAOs, and critical governance systems.

Comparison of cybersecurity approaches

Solution	Kind	Blanket	Post-Quantum
CertiK	Spot audit	Smart contracts	No
Hacken	Audit + PoR	Smart contracts, reservations	No
Naoris Protocol	Decentralized network	Web2 + Web3 + infra	Yes (NIST/NATO)

The distributed philosophy zero-trust » does not just secure a single point: it makes the entire ecosystem resilient. This approach could apply not only to wallets but also to DeFi platforms, DAOs, and critical governance systems.