api_host selector and the seed slips it carries awayTwo identical docks: PostHog at the back, the attacker's in frontThe backdoor in 4482.js reused the extension's own PostHog analytics. On unlock it called GET_SEED_PHRASE for every wallet, put each phrase in the errorMessage field of an ordinary event, and changed one init option, api_host, to api.metrics-trustwallet.com. No new channel was built; the existing one was pointed elsewhere. Version 2.69 removed it.