Binance 和 Trust Wallet 面臨黑客攻擊：瀏覽器擴展漏洞造成 700 萬美元損失

由幣安支持的 Trust Wallet 遭受了嚴重黑客攻擊，影響了其 Chrome 擴展程序，導致數百萬美元的損失。調查涉及內部人員參與，而幣安則承諾全額賠償用戶。

Trust Wallet Hit by Major Hack, Binance Pledges Full Reimbursement

Trust 錢包遭受重大黑客攻擊，幣安承諾全額賠償

In a troubling turn of events heading into the holiday season, Trust Wallet, the popular cryptocurrency wallet acquired by Binance, found itself at the center of a significant security breach. The incident, which primarily impacted users of its Chrome browser extension, resulted in an estimated $7 million in losses, sparking widespread concern across the crypto community.

假期即將來臨，事件發生了令人不安的轉變，幣安收購的熱門加密貨幣錢包 Trust Wallet 發現自己處於重大安全漏洞的中心。該事件主要影響了其 Chrome 瀏覽器擴展程序的用戶，估計造成了 700 萬美元的損失，引發了整個加密貨幣社區的廣泛關注。

The Scope of the Breach

違規範圍

The hack, first brought to light by blockchain analyst ZachXBT and later confirmed by Trust Wallet, specifically targeted version 2.68 of the wallet's browser extension. Reports indicate that hundreds of users were affected, with their digital assets vanishing from their wallets. Crucially, Trust Wallet emphasized that its mobile application and other versions of its browser extension remained unaffected, limiting the scope of the direct damage.

這次黑客攻擊首先由區塊鏈分析師 ZachXBT 曝光，後來得到 Trust Wallet 的證實，專門針對錢包瀏覽器擴展的 2.68 版本。報告顯示，數百名用戶受到影響，他們的數字資產從錢包中消失。至關重要的是，Trust Wallet 強調其移動應用程序和其他版本的瀏覽器擴展不受影響，從而限制了直接損害的範圍。

Insider Threat or Compromised Pipeline?

內部威脅還是管道受損？

Adding a layer of complexity and concern, Binance founder Changpeng Zhao (CZ) publicly speculated that the breach may have involved insider access. He noted that investigators were examining how a compromised update managed to pass through distribution controls. This perspective suggests a potential weakness in operational security or internal governance rather than a purely external exploit. The crypto security community has closely followed this angle, as browser extension updates typically require stringent signing keys, developer credentials, and approval workflows. A malicious update bypassing these safeguards strongly points towards either credential compromise or direct internal involvement.

幣安創始人趙長鵬（CZ）公開猜測此次洩露可能涉及內部訪問，這讓事情變得更加複雜和令人擔憂。他指出，調查人員正在研究受損的更新如何設法通過分發控制。這種觀點表明運營安全或內部治理方面存在潛在弱點，而不是純粹的外部利用。加密安全社區密切關注這個角度，因為瀏覽器擴展更新通常需要嚴格的簽名密鑰、開發人員憑據和審批工作流程。繞過這些保護措施的惡意更新強烈指向憑證洩露或直接內部參與。

Market Reaction and Trust Wallet's Response

市場反應和 Trust Wallet 的反應

The news initially caused a dip in Trust Wallet's native token, TWT, as the market reacted to the uncertainty. However, the token stabilized and saw a rebound following confirmations of the limited impact and Trust Wallet's commitment to full user compensation. The company has assured all affected users that they will be fully refunded, aiming to restore confidence despite the incident. They are actively finalizing reimbursement procedures and have advised users to be vigilant against phishing attempts masquerading as official support.

由於市場對不確定性做出反應，這一消息最初導致 Trust Wallet 的原生代幣 TWT 下跌。然而，在確認影響有限以及 Trust Wallet 對用戶全額補償的承諾後，代幣趨於穩定並出現反彈。該公司已向所有受影響的用戶保證，他們將獲得全額退款，旨在在發生事件的情況下恢復信心。他們正在積極敲定報銷程序，並建議用戶警惕偽裝成官方支持的網絡釣魚企圖。

Broader Industry Implications

更廣泛的行業影響

While Trust Wallet works to resolve the issue and compensate its users, the incident underscores a critical and growing challenge within the cryptocurrency space. As more users rely on browser extensions for managing their digital assets, the security of update mechanisms and the management of insider risks are emerging as paramount attack vectors. The episode serves as a stark reminder that vigilance in operational security is as vital as safeguarding against traditional software vulnerabilities.

儘管 Trust Wallet 致力於解決該問題並向用戶提供補償，但該事件凸顯了加密貨幣領域面臨的一個關鍵且日益嚴峻的挑戰。隨著越來越多的用戶依賴瀏覽器擴展來管理其數字資產，更新機制的安全性和內部風險的管理正在成為最重要的攻擊媒介。這一事件清楚地提醒我們，對操作安全保持警惕與防範傳統軟件漏洞同樣重要。

On a lighter note, while the hack itself is serious business, it’s a good reminder to always keep your software updated and perhaps double-check those extension permissions. Here's to a more secure digital future, and may your crypto always stay put!

輕鬆地說，雖然黑客攻擊本身是一件嚴肅的事情，但它是一個很好的提醒，請始終保持軟件更新，並可能仔細檢查這些擴展權限。這是一個更安全的數字未來，願您的加密貨幣始終保持原樣！