The Trust Wallet Chrome extension was compromised in an apparent supply chain attack. People who used the non-custodial wallet extension after it updated to version 2.68 lost funds after malicious code was introduced to exfiltrate wallet seed phrases so that the attackers could then drain the wallets. Victims have lost a combined $7&nbsp;million due to the compromise.<p>Binance founder Changpeng Zhao — who supposedly has no managerial role at Binance after he and the company were criminally charged in the US — announced that Binance would reimburse users who lost funds.</p>

Trust Wallet hack

Binance's Trust Wallet extension hacked; users lose $7&nbsp;million

The Flow blockchain suffered an exploit in which an attacker was able to <button class="define-target" id="mint">mint</button> a large number of <button class="define-target" id="wrapped-token">wrapped</button> FLOW tokens, which they then swapped to tokens on other blockchains. Ultimately around $3.9&nbsp;million was stolen, and the FLOW token dramatically plunged in price.<p>Some crypto exchanges, such as Upbit and Bithumb, halted withdrawals and deposits for FLOW after the exploit was discovered. Flow later confirmed the exploit, and said that <button class="define-target" id="miner">validators</button> "executed a coordinated halt" of the network to shut down the attack.</p>

"Flow blockchain probes security incident as FLOW token plunges over 40%"

Flow infinite mint exploit

Flow blockchain exploited for $3.9&nbsp;million

Ribbon Finance, which has partially rebranded to Aevo, has lost $2.7&nbsp;million after attackers exploited a vulnerability in the <button class="define-target" id="smart-contract">smart contract</button> for legacy Ribbon vaults that enabled them to manipulate <button class="define-target" id="oracle">oracle</button> prices and withdraw a large amount of ETH and USDC.<p>Ribbon has announced it will cover $400,000 of the lost funds with its own assets. However, Ribbon is also offering users a lower-than-expected haircut on their assets by assuming that some of the largest affected accounts will not withdraw their assets, having been dormant for several years. While this plan may benefit active users, it seems like it could get very messy if those dormant users do wish to withdraw their assets and discover they've been used to pay others.</p>

Ribbon Finance exploit

Ribbon Finance suffers $2.7&nbsp;million exploit, plans to use "dormant" users' funds to repay active users

Ethereum <button class="define-target" id="miner">validators</button> running the Prysm consensus client lost around 382&nbsp;ETH ($1.18&nbsp;million) after a bug resulted in delays that caused validators to miss blocks and attestations. Though the bug had been introduced around a month prior, it did not affect validators until Ethereum completed its "Fusaka" network update on December 3. Around 19% of Ethereum validators use the Prysm consensus client, which is developed by Offchain Labs.

Prysm consensus client bug

Prysm consensus client bug causes Ethereum validators to lose over $1&nbsp;million

Only weeks after <a href="https://www.web3isgoinggreat.com/?id=yearn-finance-hack-3" target="_blank">losing $6.6&nbsp;million to an infinite mint exploit</a>, a Yearn Finance <button class="define-target" id="smart-contract">smart contract</button> has again been exploited, allowing an attacker to make off with around 103&nbsp;ETH (~$300,000). The affected contract is a legacy contract that was part of the Yearn v1 project (once known as iearn). The attacker used a <button class="define-target" id="flash-loan">flash loan</button> to manipulate the price of tokens in the vault, allowing them to withdraw the iearn assets, which they then swapped for ETH.<p>This is Yearn's fourth hack, following the $6.6&nbsp;million theft in November, an <a href="https://www.web3isgoinggreat.com/?id=yearn-finance-hack-2023" target="_blank">$11&nbsp;million exploit in 2023</a>, and an <a href="https://www.web3isgoinggreat.com/?id=yearn-finance-loses-11-million" target="_blank">$11&nbsp;million exploit in 2021</a>. Yearn also lost around $1.4&nbsp;million in 2023 in connection to the <a href="https://www.web3isgoinggreat.com/?id=euler-finance-exploited-for-almost-200-million" target="_blank">Euler Finance attack</a>.</p>

Event	Date	Amount More info
Trust Wallet hack	December 25, 2025	$7,000,000
Flow infinite mint exploit	December 27, 2025	$3,900,000
Ribbon Finance exploit	December 12, 2025	$2,700,000
Prysm consensus client bug	December 4, 2025	$1,180,000
Yearn Finance exploit #4	December 16, 2025	$304,400