Nineteen Browser Extensions Caught Emptying Crypto Wallets
Researchers found 18 Chrome add-ons and one Edge add-on that quietly stole wallet keys and drained funds, in a campaign that may have run for months.
Key points
- Security firm Socket found 19 browser extensions, 18 for Google Chrome and one for Microsoft Edge, that stole cryptocurrency wallet secrets.
- All 19 were published in the last six months, though the wider campaign may go back further.
- Researcher Karlo Zanki says the extensions share code and techniques, pointing to a single coordinated operation.
- Anyone who installed them should treat their wallet keys as exposed and move funds to a fresh wallet.
A cluster of browser add-ons sitting in the official Chrome and Edge stores has been quietly rifling through people's cryptocurrency wallets. Socket security researcher Karlo Zanki identified 19 of them: 18 for Google Chrome, one for Microsoft Edge, all published in the last six months.
Socket also found the 40-extension Firefox campaign we covered on 20 August, which it called the Offside Wallet Theft Factory. This latest batch suggests the same economic logic is running across every major browser.
What actually happened here?
Criminals uploaded 19 booby-trapped extensions to the official stores. Browser extensions are small programs that plug into Chrome or Edge to add features like ad blockers or price checkers. Because they run inside the browser, they can often see what you see, including the contents of a crypto wallet app open in another tab.
These ones watched for wallet activity, grabbed the private keys and seed phrases (the secret codes that control funds), and sent them to the attackers. With those, the criminals can log in as you and empty the wallet.
Who is behind it?
Zanki says the 19 extensions share too much code and too many habits to be coincidence. He believes one group built and published all of them, possibly running the operation longer than six months by rotating in fresh add-ons as older ones got pulled.
Socket hasn't publicly named the group. The pattern, cheap utility add-ons with crypto-flavoured names and staggered upload dates, matches other wallet-draining campaigns across browser stores in the last two years.
None of the tradecraft is exotic. It's the browser-extension equivalent of a rogue mobile app: get into a trusted store, wait for installs, harvest secrets. Scale and persistence are what distinguish this operation, not the technique.
Should ordinary users be worried?
Only if you installed one of them, but the practical advice is simple. Open your browser, check your extensions list, and remove anything you don't recognise or no longer use. Pay attention to anything crypto-related added in the last six months.
If you had one of the flagged add-ons installed and use a crypto wallet in the same browser, treat your keys as compromised. Move remaining funds to a brand-new wallet with a brand-new seed phrase. Don't reuse the old one.
Both the Chrome Web Store and Microsoft Edge Add-ons store remove malicious extensions once reported, but pre-publication checks aren't thorough enough to catch this kind of hidden behaviour on their own.
The bigger picture
Browser extensions remain one of the last soft spots on a well-patched machine. Your operating system is locked down, your antivirus is watching, and then you grant a random utility permission to read every page you visit. For a crypto user, that's a serious problem.
Our coverage of 85 browser crypto wallets leaking user data in July and session-hijacking via Chrome's own debugger in August shows the browser has become the primary battlefield for credential theft. Wallet-draining extensions are the logical next step: skip the session cookie, go straight for the keys.
Expect more of these campaigns. The economics are too good for criminals to stop.
