On Christmas Day, a coordinated exploit against Trust Wallet's browser extension version 2.68 led to around $7 million in user losses, with the company urging an urgent upgrade to version 2.89. Security researchers said the backdoor was prepared from early December, while Binance co-founder Changpeng Zhao pledged that affected users would be fully compensated. The incident has intensified debate over wallet security and potential insider involvement across the crypto industry.

On Dec. 24, 2025, TrustWallet’s Chrome extension v2.68.0 was released with a hidden JavaScript payload, according to cybersecurity researchers. On Dec. 26, 2025, the team confirmed about $7M was impacted, rolled out v2.69.0, and pledged refunds, after funds across BTC, SOL, BSC and EVM L2s were drained without authorization.

The People’s Bank of China announced updated regulations for the Cross-Border Renminbi Payment System, effective February 1, 2026. The framework supports mixed settlement methods, including real-time gross and net settlements, with digital RMB integration. According to PBOC data, cross-border RMB payments reached 35 trillion RMB in the first half of 2025.

Trust Wallet's browser extension version 2.68 was compromised, impacting desktop users, and the team urged an upgrade to version 2.89 in a Thursday X post. CZ said in a Friday X post the roughly $7 million lost on Christmas Day will be reimbursed; SlowMist reported the backdoor was prepared Dec. 8 and implanted Dec. 22, and data were exfiltrated.

Aave token holders have rejected a governance proposal that sought to move control of the protocol's domains, social accounts, naming rights and other intellectual property into a DAO-controlled entity. The snapshot vote closed with 55.29% voting against, 3.5% in favor and 41.21% abstaining, exposing broader disputes over token value capture, governance influence and token-equity structures within the protocol.

After the Trust Wallet Chrome extension updated to version 2.68.0 on December 24, users reported that balances disappeared almost immediately after importing seed phrases. On-chain sleuth ZachXBT flagged clustered drains across multiple wallets, and analysts tracking public blockchain flows estimate losses above $4.3 million, while the provider has not yet issued an explanation.

Trust Wallet confirmed a security breach affecting its browser extension version 2.68 between December 24 and 25, 2025, resulting in roughly $7 million in user losses. Changpeng Zhao said impacted users will be fully reimbursed, and a mandatory upgrade to version 2.69 has been deployed.

Caroline Ellison, former Alameda Research co‑CEO, is slated to leave federal custody on Jan. 21, 2026. She was sentenced in September 2024, began a two‑year term in November 2024, and moved to community confinement in October 2025. Earlier this month she accepted a 10‑year ban from serving as an officer or director of public companies or crypto exchanges.