GoKawiilSocket uncovers 19 Chrome/Edge extensions stealing crypto from 80,000 users
Security firm Socket Inc. identified 19 malicious browser extensions for Chrome and Edge that operated for years before being caught. The most popular, a right-click/OCR utility, was installed by 80,000 combined users and secretly harvested cryptocurrency wallet data after receiving malicious updates roughly six months ago.
GoKawiil's interpretation of the reporting above, not reported fact.
This case shows how attackers can patiently build trust with legitimate-seeming tools before flipping them into malware, evading store review processes that only check initial versions. Even after removal from official stores, victims remain exposed unless they manually reset browser settings, since the extensions tied into a remote command-and-control network.
- 19 extensions across Chrome and Edge were weaponized to steal crypto data.
- Attackers bought some extensions from real developers, then added malicious code later.
- Users must manually check and reset browser settings even after the extensions were delisted.
Trezor Safe 3 Hardware Wallet — When browser extensions can be quietly turned into crypto-stealing malware, keeping your keys off the computer entirely is the safest move. The Trezor Safe 3 stores private keys on a dedicated offline device and requires you to physically confirm every transaction on its screen, so a compromised browser can't sign anything on your behalf.
See Trezor Safe 3 Hardware Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techspot.com — Alfonso Maruccia, 2026-09-02
Published there as: “Popular Chrome extensions were quietly weaponized to steal crypto from 80,000 users”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.