Wallet

On December 28, 2025, OKX CEO Star Xu called for decentralized exchanges and trading bots to meet exchange-level security standards after weekend exploits exposed risks. He warned that many bot products store users' private keys on centralized servers, and highlighted OKX's planned smart accounts using TEE and the conceptual OKX Pay. The Flow team said about $3.9M was moved off-network in a recent attack.

In late 2025, crypto breaches escalated as Chainalysis tallied $3.4 billion in losses for the year. During Christmas week, Trust Wallet disclosed a $7 million Chrome-extension breach, while DeBot confirmed a $255,000 theft traced to a server in Japan; OKX's Star Xu cautioned that DEX bots and custodial wallets heighten risk.

On December 28, 2025, Kaspersky's SecureList reported that stolen crypto accounts listed on dark-web markets fetch an average of $105, with individual prices ranging from $60 to $400. The data is harvested by phishing kits, exfiltrated via email, Telegram bots, or admin panels, and then monetized immediately or routed into broader resale pipelines.

On December 28, DeBot disclosed a wallet security breach involving compromised private keys and about $255,000 in unauthorized transfers. The team says it will fully compensate affected users, is monitoring impacted accounts, and warns against fake claim forms. Community responses urged moving funds to secure addresses as the attacker consolidates stolen assets.

On December 28, Trust Wallet CEO Eowyn Chen said the browser extension investigation is ongoing and Google has escalated the support ticket, while a new alert now warns users to migrate if a wallet is compromised. The company reports more than 2,630 claims and losses of $1.05M–$3.5M, prioritizing ownership verification to deter fraud.

According to WazirX CEO Nischal Shetty, the exchange’s ownership dispute with Binance has moved into formal litigation. The conflict stems from Binance’s denial of a 2019 acquisition, while a 2024 multi-signature wallet hack that compromised over $230 million adds complexity. Shetty indicated user operations will remain unaffected during the legal process.

On December 27, 2025, DeBot said it would fully reimburse users after a security incident that impacted wallets generated or imported before December 10. On-chain data indicates about $255,000 was moved, with funds routed to BSC addresses and partially through Tornado Cash. The team said secure wallet addresses created after December 10 were unaffected.

Hong Kong plans to fold crypto assets into the OECD’s Crypto Asset Reporting Framework starting in 2028. A public consultation on CARF runs until early 2026, while the OECD and G20 target a global rollout between 2027 and 2028. Experts say enforcement and coverage beyond centralized exchanges will determine its effectiveness.

Attackers have exploited a vulnerability tied to Trust Wallet's Chrome browser extension, affecting hundreds of users and draining about $6.77 million to $7 million in assets. Trust Wallet has urged users of Browser Extension 2.68 to upgrade to 2.69 and pledged to fully reimburse all impacted accounts, while on-chain analysts track roughly $5.5 million already routed through swap services and exchanges.

Crypto exploit losses tied to TVL in 2025 have exceeded $2.53 billion, with social engineering responsible for 55.3% ($1.39 billion), according to Sentora. Chainalysis estimates $2.7–$3.4 billion was stolen across all theft categories this year, including $2.02 billion linked to DPRK-affiliated groups and an estimated $1.4 billion taken from Bybit.