EVM Cross-Chain Wallet-Drain Campaign (June 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·DW5U1o…htEnSummary
Beginning approximately January 2, 2026, blockchain investigator ZachXBT flagged an active, automated campaign draining hundreds of wallets across at least a dozen EVM-compatible chains, with over $107,000 stolen in mostly sub-$2,000 increments consolidated into a single aggregation address (0xAc2e5153170278e24667a580baEa056ad8Bf9bFB). The root cause was not confirmed at the time of ZachXBT's initial disclosure; suspected vectors included token-approval abuse, malicious signature exploits, a fake-MetaMask phishing email campaign, and possible spillover from the Trust Wallet browser-extension supply-chain compromise of December 2025. This entry serves as a consumer-protection warning and on-chain address flag.
Connected Entities
10 entities · 60 linked investigations- wallet drainers→mentioned with→Ethereum(70%)
- Optimism→mentioned with→Arbitrum(65%)
- ZachXBT→mentioned with→Ethereum(70%)
- Optimism→mentioned with→Ethereum(80%)
- ZachXBT→mentioned with→Binance(60%)
- Trust Wallet→mentioned with→Arbitrum(70%)
- Binance→mentioned with→Ethereum(65%)
- Trust Wallet→mentioned with→Binance(70%)
- Trust Wallet→mentioned with→Optimism(60%)
- Trust Wallet→mentioned with→ZachXBT(70%)
- + 18 more
Connected Through
9 shared actors · 575 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- □Binanceorganization
- □Arbitrumorganization
Timeline(7 events)
November 2025
Industry-wide 'Shai-Hulud' supply-chain attack exposed Trust Wallet developer GitHub secrets, including the Chrome Web Store API key, enabling a subsequent malicious extension upload.
Trust Wallet official blog24 December 2025
Malicious Trust Wallet browser extension version 2.68 published to Chrome Web Store using stolen credentials; active exfiltration of seed phrases and private keys began for users who opened the extension.
Trust Wallet official blog / The Hacker News25 December 2025
Security researchers flagged wallet draining from Trust Wallet v2.68 users; white-hat researchers reportedly disrupted attacker infrastructure. Approximately 2,520 addresses were affected, with losses of $7–8.5 million.
The Hacker News26 December 2025
Trust Wallet pulled v2.68 from the Chrome Web Store, released v2.69 as a rollback, and announced a voluntary reimbursement program for affected users.
Trust Wallet official blog2 January 2026
ZachXBT publicly disclosed an active, automated cross-chain wallet-drain campaign affecting hundreds of wallets across at least 12 EVM chains, with over $107,000 consolidated into aggregation address 0xAc2e5153170278e24667a580baEa056ad8Bf9bFB. Root cause listed as unidentified.
The Block / CCN / CryptoPotato2 January 2026
Multiple crypto news outlets reported on the campaign based on ZachXBT's findings, identifying Ethereum ($54,655), BNB Chain ($25,545), Base ($8,688), Arbitrum ($6,273), and Polygon ($3,498) as the most heavily affected chains.
The Crypto Basic28 May 2026
ZachXBT flagged a separate but related fake-MetaMask phishing campaign — distinct from the January 2026 drains — alleging over $9 million stolen from 400+ addresses via malicious 'mandatory upgrade' emails tricking users into signing setApprovalForAll transactions.
Phemex blogDecision Log
- slot 445504367 · hash EvW3bPAAJwyGQRZajqegK7NP7KHwBUtMFUha98QFRQFo
- slot 426288380 · hash 5vtXuueNp9sP5RJ7qqxG28aJY6gmrMpidbbV8Q6YfqaS
- slot 426288377 · hash F6uwf86qDn5RhRqMPw56iJrXmMxjqAc7TCdLQ7t7htQF
- slot 425395312 · hash 8Jk9vSJt7CYbA6DjNo24k7j7ky4hZvut3GWWHXAR44as
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 18 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/9/2026, 7:55:56 PM
last updated: 6/9/2026, 7:55:56 PM
4 viewsavoid.net — verified advice for a post-truth world