Browser Extensions as Wallet Thieves: How a Sports App Became a Seed Phrase Collector

If you run a crypto wallet as a browser extension, today is the day to open your extension list. In August 2026 the security firm Socket disclosed two separate campaigns in which extensions for Firefox, Chrome and Edge harvested recovery phrases, private keys and login credentials for crypto exchanges. The second of those reports was written up on August 30 and is therefore one day old. What is affected is precisely the place where many investors handle their wallet every day.

A browser extension is a small add-on program that runs inside the browser and holds permission to read and change the content of the pages you visit. That same permission is what makes it useful to wallet providers and valuable to attackers.

Browser Extensions as Wallet Thieves: What Socket Found in August 2026

Socket is a security firm specialising in software supply chains that examines packages and extensions for malicious code. Its researchers published two findings within ten days that show the same pattern and yet do not belong together.

The first report is dated August 20, 2026 and concerns the Firefox marketplace: 77 extension identities are connected according to Socket's analysis, 40 of them confirmed malicious. The second report circulated between August 28 and 30 and concerns Chrome and Edge: 19 extensions, 18 of them for Chrome and one for Edge, carried a wallet drainer. A wallet drainer is malicious code that empties a balance to an outside address in a single operation instead of siphoning off individual amounts.

Both cases share one thing that matters more to you than any number: the extensions sat in the official marketplaces of the browser makers. Anyone who installed them did nothing wrong, downloaded no dubious file and clicked no link in an email.

Offside Wallet Theft Factory: How 77 Firefox Extensions Are Connected

Socket calls the Firefox campaign Offside Wallet Theft Factory and explicitly does not attribute it to any known actor. The researchers also do not write that the same operator stands behind every single extension; what links them is shared code and shared infrastructure.

The 40 confirmed extensions fall into four groups. Seven posed as crypto products and served as remotely controlled phishing loaders, among them an entry called 0KX WEB3, which used a zero in place of the letter O and so imitated the name of the exchange OKX. Fifteen carried the theft code directly inside them. Thirteen of those fifteen were altered rebuilds of the Rabby wallet software. Five more collected access credentials and the contents of the clipboard. The remaining 37 of the 77 identities appeared as VPN tools, password generators or sports apps and did in fact display match scores.

According to Socket, the interfaces of OKX, Rabby Wallet and TronLink were imitated. In this affair those three providers are the injured parties, not the cause: their name and their appearance were used as bait without any involvement on their part.

The technical basis was provided by projects on the database service Supabase, which acted as remote switches, together with Cloudflare Workers and Pages for the forged interfaces as well as control servers written directly into the code. Such control servers are known in the field as C2 servers, short for command and control; they receive the stolen data and send new instructions back. The signature data of the extensions covers the period from March 9 to August 3, 2026, with clusters in April and at the end of July. Mozilla removed the reported add-ons from the marketplace after the report.

What a Browser Extension Is Actually Allowed to Do

An extension with permission to read and change data on all websites sits technically on the same level as the page itself. It sees what you type, it sees what the page shows you, and it can alter both before either reaches the other. For a wallet extension that is normal and unavoidable. For an extension that unlocks right-clicks or displays football scores, it is not.

From Match Score to Seed Phrase Collector: Why the Update Is More Dangerous Than the Installation

The most instructive part of the Firefox finding has nothing to do with crypto at first. Nine of the confirmed malicious extensions began life as harmless sports applications and displayed results from football, basketball and American football. Only later updates replaced that function with wallet theft code, and did so under the same identifier. The malicious version thereby inherited the entire installed base and the accumulated positive reviews of its harmless predecessor. The campaign owes its name to that trick.

For your own practice this means that the check you carried out at installation does not hold indefinitely. Reviews, user numbers and the age of an extension describe its past. An update can replace the code completely, and by default extension updates run through automatically without your being asked.

With five of the 19 Chrome and Edge extensions it went much the same way, only one step earlier: according to Socket's analysis they were genuine, already published extensions by other developers that were taken over and then rebuilt. The remaining 14 the attackers had built themselves from scratch.

Altered Rabby Rebuilds: How the Keyring Leaks Before Encryption

The thirteen altered Rabby rebuilds are the technically most delicate part of the Firefox finding. Rabby is open-source wallet software; its code may legally be copied and changed. The attackers rewrote exactly one function, namely the one that stores the keyring permanently. A keyring is the data record in which a wallet holds its private keys and the recovery phrase together.

In the original, this keyring is converted into text and then encrypted with your password before it lands on the hard drive. In the altered versions it is, as Socket describes it, sent off at precisely the moment when it exists in text form, that is, before encryption. Your wallet password protects nothing at this point, because it would only come into play afterwards. The same versions also intercept the recovery phrase when a wallet is created and when one is imported.

19 Chrome and Edge Extensions: The Drainer That Rebuilds Ledger and Trezor Pages

The second finding is the more recent one and concerns two further marketplaces in Chrome and Edge. According to Socket's analysis the 19 extensions contained a drainer that serves several chains at once: wallets on Ethereum and all networks compatible with it, wallets on Solana and wallets on Tron.

Added to this were rebuilt recovery and update pages that looked like the official interfaces of the hardware wallet makers Ledger and Trezor. Their sole purpose was to collect the recovery phrase. Here too, the two manufacturers are victims of imitation. Anyone who uses a hardware wallet and wonders which models exist at all and how they differ will find the overview in our comparison of crypto hardware wallets.

On reach there is one solid individual figure and one estimate. Solid is the extension named Enable Right Click & Copy, Smart Unlock + OCR: it had more than 70,000 users on Chrome and more than 10,000 on Edge when it turned malicious. For the campaign as a whole, one trade report cites around 80,000 affected users. The starting point is also disputed: BleepingComputer writes that the operation may have been running since the beginning of 2024, while another assessment of the same Socket analysis speaks of roughly six months of active operation and names February 2024 as the likely beginning. Both readings stand side by side, and neither of them is confirmed.

At the time of publication, according to BleepingComputer, none of the extensions was still available in the Chrome Web Store. The Edge version still was.

CSP Header Removed: What an Extension Can Do on Every Page You Visit

The sequence in the Chrome and Edge case is worth going through calmly, because it explains why a single bad extension reaches so far. After installation it opens an encrypted permanent connection to a control server, a so-called WebSocket connection. Over that line it loads individual JavaScript building blocks that were not contained in the marketplace package at all. A reviewer who looks only at the submitted package therefore finds little there.

It then removes the CSP header from every page you call up. The Content Security Policy is a protective instruction with which a website tells the browser which sources scripts may be executed from at all. If it falls away, the browser accepts outside code as well. That code is then injected into the page through hidden HTML elements.

The result is uncomfortably concrete. The bank, the exchange and the wallet interface you open in the same browser are, from that moment on, no longer the pages the provider delivers. They are what the extension makes of them. That is exactly why an approval that looks harmless on screen can mean something quite different in the background. How to read such an approval in detail is set out in our article on what you really approve when you confirm.

Session Tokens Instead of Passwords: Why Two-Factor Authentication Does Not Protect Here

According to Socket, the drainer attacks not only wallets but also accounts at trading venues. Coinbase, Binance, Kraken, OKX, MEXC, KuCoin and Bybit are named, along with the MetaMask wallet. What it collects are access credentials, session tokens, browser history, account information from Facebook and LinkedIn, and form entries across a range of websites.

The term session token deserves an explanation of its own, because it is what sets this apart from ordinary password theft. A session token is the pass that a website issues to your browser after a successful login so that you do not have to enter your password and second factor again with every click. Whoever holds that token is already logged in as far as the website is concerned. Two-factor authentication has happened by then and is not requested a second time.

That is why changing your password is not enough when you suspect something. You have to end all active sessions as well. Most trading venues offer this function in their security settings under labels such as active devices, sessions or logged-in devices. Which providers come into question for customers in Germany at all, and which security features they bring with them, is shown in the overview of crypto exchanges.

Checking Installed Extensions: How to Reach the List in Firefox, Chrome and Edge

The check takes a few minutes and costs nothing. In Firefox you open the address about:addons and select Extensions on the left. In Chrome it is chrome://extensions, in Edge edge://extensions. In all three browsers the detail view can be opened for each entry, showing permissions, publisher and installation source.

Go through the list from top to bottom and ask yourself two questions about every entry: do you still remember why you installed this extension? And have you actually used it in recent weeks? Anything that stumbles on either question goes. An extension you do not need is still an open door that nobody is guarding.

How to Recognise a Hijacked Extension

There is unfortunately no clean identifying mark for the update trick, and that belongs to the truth of the matter. There are, however, indications that are worth something taken together. It is striking when an extension with a banal function suddenly demands far-reaching permissions, or when the publisher name has changed. It is striking too when a review column shows older enthusiastic voices and more recent complaints about altered behaviour side by side. And any extension whose name matches a well-known product but for a single character is striking, as with the zero in the entry 0KX WEB3.

Reading Permissions: Which Access Rights Are Normal for a Wallet Extension

A genuine wallet extension needs far-reaching rights, otherwise it could not do its job. Access to data on all websites is therefore no alarm signal in its case. The real question is a different one: why does a screenshot tool, a translator or a right-click unlocker need the same permission?

In practice this means you sort your extensions by purpose and not by provider. Every extension that may read and change all pages although its function is needed only on a single page or at the push of a button is a candidate for deletion. Chrome and Edge additionally allow you to limit an extension's access to individual pages or to grant it only after a click. That setting costs you two days of getting used to it and takes most of its reach away from a hijacked extension.

Hardware Wallet or Browser Wallet: What the Difference Means When It Counts

The two Socket findings lead to a distinction that often blurs in everyday use. With a wallet as a browser extension the private key lies encrypted on the computer, and the software in the browser decrypts it in order to sign. With a hardware wallet the key never leaves the device; the computer sends the transaction over and gets the finished signature back.

This difference decides how an attack of the kind described turns out for you. Against harvested key material the hardware wallet helps, because there is simply nothing there to harvest. Against a manipulated interface that shows you a false recipient address it helps only if you read the details on the display of the device and not on the screen. And against a rebuilt recovery page that asks you to enter your recovery phrase, no technology helps at all. There, only one rule carries: never type that phrase anywhere. Which software wallets exist for everyday use and where their limits lie is set out in the comparison of software wallets.

After a Suspicion: Why Uninstalling Alone Saves Nothing

For the Firefox case Socket makes a clear recommendation: anyone who has entered a recovery phrase or a private key into one of these extensions should treat the data as permanently compromised and move the balance to a newly created wallet. The reason is simple and readily overlooked. Deleting the extension takes back nothing that has already been transmitted. A recovery phrase cannot be revoked, only replaced.

The order matters when you suspect something. Create the new wallet on a device that is not affected, and only transfer afterwards. Anyone who sets up the new wallet in the same infected browser merely repeats the exercise with fresh keys. Then come the accounts at the trading venues: new password, end all sessions, set up the second factor again and check the withdrawal addresses on file.

A word on handling the agitation such reports set off. In precisely the days after an incident becomes public, messages multiply that promise help to those affected and ask for the recovery phrase in the process. That scam now runs on paper as well, as the case of wallet phishing by letter shows. No reputable provider and no authority ever asks for that phrase.

Tax and Evidence: What to Document After a Crypto Theft

If something has in fact flowed out, secure the evidence before you tidy up. That includes the time of the outflow, the addresses affected, the transaction identifiers from the relevant block explorer, the name and identifier of the extension together with a screenshot of the marketplace page if the entry is still reachable, and the file number of a police report.

How such a loss works out for tax purposes depends on the individual case and belongs in the hands of a tax adviser. Without complete evidence that question cannot be settled at all, and the evidence is considerably harder to obtain weeks later than on the day after. A portfolio tool that records your movements anyway spares you the reconstruction by hand when it counts.

Checking Browser Extensions: What to Take Away

1. Clear out your extension list today. Open about:addons, chrome://extensions or edge://extensions and delete everything you do not actively use or can no longer place. Pay particular attention to entries with a banal function and far-reaching permissions. If you keep your wallet in the browser, check in the comparison of software wallets whether your setup still fits your holdings.
2. Separate the amounts you do not move from the browser. The part of your holdings you do not touch weekly belongs on a device whose key never sees the browser. The models and their differences are set out in the comparison of crypto hardware wallets.
3. End your open sessions at the trading venues. A new password alone is not enough as long as an old session token is still valid. Go into the security settings of every account, throw out all devices and log in again. Which providers offer which security features is shown in the overview of crypto exchanges.

The month's two findings arose independently of each other and affect all three major browsers. They say the same thing: a browser maker's marketplace is a pre-selection and not a guarantee, and the check made at installation ages faster than the extension itself.

The original reports are available at Socket on the Firefox campaign and in the write-up by BleepingComputer on the Chrome and Edge case.

(As of August 31, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)