Ongoing EVM Wallet Exploit Drains Over $107,000: ZachXBT

Highlights:

• Attackers are draining wallets across EVM chains, with losses already exceeding $107,000.
• Fake MetaMask emails and a Trust Wallet flaw are suspected entry points for thieves.
• Wallet breaches surged this year and affected about 158,000 wallets despite smaller average losses per victim.

Onchain researcher ZachXBT says attackers are draining hundreds of cryptocurrency wallets on several EVM chains. The attack is still happening, and losses keep growing. Most victims report small repeated thefts, usually under $2,000 per wallet.

Attackers have stolen about $107,000 so far, and the total may rise. They have not shared how they access the wallets, leaving more users at risk.ZachXBT pointed to a suspicious wallet address linked to the theft: 0xAc2e5153170278e24667a580baEa056ad8Bf9bFB. Investigators are watching the address and tracking any stolen funds. The attacker’s identity is still unknown.

Organized EVM Wallet Drains and Phishing Suspicions

The attacks appear planned and organized, not random. By stealing small amounts from many wallets, the attackers likely avoid alerts. At the same time, this approach helps them increase total profits without drawing quick attention. ZachXBT said the exact reason behind the wallet drains is still unclear. However, some users on X, formerly Twitter, said they received a fake email. The email looked like it came from MetaMask and asked users to complete a required upgrade.

Vladimir, a threat researcher, shared that @Mecha_Kong noticed a spoofed MetaMask email sent earlier that day. He suggested this fake message could explain why wallets are being drained. Others also believe the activity may be connected to Trust Wallet’s recent browser extension issue, though no direct link has been confirmed yet.

According to @Mecha_Kong , there was a spoof mm email sent out today about upgrading… could be the reason behind drains… pic.twitter.com/leeuu2Cpyy

— Vladimir S. | Officer's Notes (@officer_secret) January 2, 2026

December 2025 saw a rise in major crypto exploits, with about 26 incidents causing total losses of $76 million, according to blockchain security firm PeckShield. This is a large amount, but 60% lower than November’s $194.27 million. Trust Wallet had one of the biggest incidents last month. A browser extension flaw during Christmas led to $7 million in losses. The platform has started compensating affected users. 

#PeckShieldAlert December 2025 witnessed ~26 major crypto exploits, resulting in total losses of ~$76M.

This figure represents a decrease of over 60% from November's total of $194.27M, marking a significant reduction in monthly losses.

Notably:
🔺Wallet 0xcB80…819 lost $50M… pic.twitter.com/CNW3R6646j

— PeckShieldAlert (@PeckShieldAlert) January 1, 2026

According to the CEO of Trust Wallet, Eowyn Chen, the removal of the extension by the Chrome Web Store was caused by an issue related to the platform during the course of an update to the version of the extension. The updated version of the extension allows the submission of verification codes for the ownership of the wallet through the extension.

Some may have noticed that the @trustwallet Browser Extension is temporarily unavailable on the Chrome Web Store. We hit a Chrome Web Store bug 😢 while releasing a new version that includes a feature to help reimbursement claimants submit verification codes from their extension…

— Eowync.eth (@EowynChen) December 31, 2025

Rising Crypto Exploits and Ongoing Security Risks

Data from Chainalysis shows that individual crypto wallets remain at high risk. In 2025, attacks on personal wallets made up about 20% of all stolen cryptocurrency. Last year, attackers compromised roughly 158,000 wallets, affecting around 80,000 unique users. This is a big jump from 2022, when 54,000 breaches impacted 40,000 users. Even with more attacks, total losses dropped from $1.5 billion in 2024 to $713 million in 2025. “This suggests that attackers are targeting more users, but stealing smaller amounts per victim,” Chainalysis said.

This recent case illustrates the problem of vulnerabilities being a pressing issue even in the year 2026. Researchers continue to monitor the malicious address as well as the pattern of the attack. Meanwhile, the crypto community is considering how to balance decentralization with stronger security. In the coming days, more victims may appear, or progress may be made in tracking the stolen funds.