Nineteen Browser Extensions Caught Emptying Crypto Wallets
Researchers found 18 Chrome add-ons and one Edge add-on that quietly stole wallet keys and drained funds, in a campaign that may have run for months.
Key points
- Security firm Socket found 19 browser extensions, 18 for Google Chrome and 1 for Microsoft Edge, that stole cryptocurrency wallet secrets.
- The add-ons were all published in the last six months, but the wider campaign may go back further.
- Researcher Karlo Zanki said the extensions share code and techniques, pointing to one coordinated operation.
- Anyone who installed the extensions should assume their wallet keys are exposed and move funds to a fresh wallet.
A group of browser add-ons sitting in the official Chrome and Edge stores has been quietly rifling through people's cryptocurrency wallets. Researchers at security firm Socket say they found 19 of them: 18 for Google Chrome, 1 for Microsoft Edge. All were published in the last six months.
The add-ons looked like normal little helpers, the kind of tool you click "add to browser" without thinking about. Underneath, according to Socket researcher Karlo Zanki, they carried code to swipe wallet secrets and drain the crypto inside.
The original write-up came from Socket, and was picked up by The Hacker News.
What actually happened here?
Criminals uploaded 19 booby-trapped browser extensions to the official Chrome and Edge stores. Once installed, the extensions could read the private keys that unlock a user's cryptocurrency wallet, and then move the money out.
Browser extensions are small programs that plug into Chrome or Edge to add features, things like ad blockers, price checkers, or note-takers. Because they run inside your browser, they can often see what you see, including the contents of a crypto wallet app running in another tab.
That is what these ones did. They watched for wallet activity, grabbed the secret keys, or "seed phrases", that control the funds, and sent them back to the attackers. With those keys, the criminals can log in as you and empty the wallet.
Who is behind it?
Zanki says the 19 extensions share too much code and too many habits to be a coincidence. He believes one group built and published all of them, possibly running the operation for longer than six months by rotating in fresh add-ons as older ones got taken down.
Socket has not publicly named the group. The pattern, cheap-looking utility add-ons, crypto-flavoured names, staggered upload dates, matches other wallet-draining campaigns that have hit browser stores in the last two years.
If you have followed this beat, none of the tradecraft is exotic. It is the browser-extension equivalent of a rogue mobile app: get into a trusted store, wait for installs, harvest secrets. The novelty is scale and persistence, not technique.
Should ordinary users be worried?
Only if you installed one of them, but the practical advice is simple. Open your browser, look at your list of extensions, and remove anything you do not recognise or no longer use. Pay special attention to anything crypto-related that you added in the last six months.
If you did have one of the flagged add-ons installed and you use a crypto wallet in the same browser, treat your keys as exposed. Move any remaining funds to a brand-new wallet with a brand-new seed phrase. Do not reuse the old one.
The Chrome Web Store and Microsoft Edge Add-ons store both take down malicious extensions once they are reported, but the checks that happen before an add-on goes live are not thorough enough to catch this kind of hidden behaviour on their own.
The bigger picture
Browser extensions are one of the last soft spots on a well-patched machine. Your operating system is locked down, your antivirus is watching, and then you grant a random utility permission to read every page you visit. For a crypto user, that is game over.
Expect more of these campaigns. The economics are too good for the criminals to stop.
