BlockThreat - Week 52, 2025

Peter Kacherginsky

31 Dec 2025 • 4 min read

Greetings!

We are closing out the year with nearly $13M stolen across five incidents. The most severe was the complete compromise of the Trust Wallet browser extension.

According to the recently published post mortem, Trust Wallet’s GitHub repository had been compromised since November(!) by the infamous Shai Hulud worm. After sitting on stolen GitHub secrets and Chrome Web Store API key the attackers finally struck, uploading a malicious extension that exfiltrated users’ private keys. More than $8.5M has already been stolen from thousands of victims. Supply chain attacks of this nature are likely to become a recurring theme in 2026. As I have warned before, it is long past time to lock down repositories and, critically, to rotate compromised credentials immediately rather than weeks later.

Another particularly rare exploit happened this week involving Flow blockchain. An attacker waited until the very end of the year to exploit an infinite mint vulnerability in chain’s execution layer, draining $3.9M. Flow operators later chose to roll the chain back to a pre-hack checkpoint. This is a blunt and largely ineffective mitigation, as it negatively impacts every legitimate user who transacted after the attack while the attacker had already bridged the stolen funds out of the ecosystem. A far more effective response would have been to isolate or filter attacker’s transactions, as demonstrated in the recent Balancer incident, where chains such as Polygon, Gnosis, Berachain, and others assisted in recovery without disrupting normal network activity. This incident highlights the need for Flow to develop a comprehensive and well rehearsed incident response plan.

In the premium section of the newsletter, you will find detailed coverage of the Polymarket compromise, Trust Wallet post mortems and backdoor analysis, the Flow blockchain infinite mint vulnerability, and more.

As we are quickly approaching the end of the year with about $2.8B stolen across 363 incidents from various DeFi protocols, blockchains, and centralized exchanges it’s easy to call 2025 one of the more challenging years that I’ve seen in about 8 years of following this industry. And yet, we must continue fighting the good fight and make this industry succeed for every family out there that can’t afford basic needs because their savings were devalued by failed economies, assets stolen by corrupt institutions with no chance of lifting themselves out of poverty without access to global financial markets. Crypto has a chance of solving this and many more hardships by enveloping the world in an unstoppable global financial network where people can safely transact with anyone anywhere. As a blockchain security industry we can pave the road for this future to arrive sooner by creating a safe and trustworthy environment for billions of users that will be coming onchain soon.

Have a safe new year and many more adventures together. Let’s dive into the news!