Trust Wallet confirmed a Christmas supply-chain hack that drained $7M after a malicious browser extension update exposed user seed phrases.