Last week, Socket’s research team published a post warning Firefox users about extensions that can steal your crypto.
According to Socket, 77 Firefox extensions may pilfer your identity and abscond with your wallet and credential information.
These extensions may impersonate legitimate platforms like OKX, TronLink, or other digital asset products.
To quote the post:
“Seven use threat actor-controlled Supabase projects as remote switches for phishing content. 15 capture recovery phrases, private keys, or other wallet secrets and exfiltrate them through Cloudflare Workers. 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption, while five additional extensions steal credentials and clipboard data through hardcoded command and control (C2) infrastructure.”
Socket has labeled this: Offside Wallet Theft Factory.
Socket also announced it has created an extension designed to stop the Firefox-based intrusions.
These nefarious extensions have been reported to Mozilla.
Ashna Vaghela, Chief Customer Officer at Mercuryo, says these bogus Firefox extensions, which are veiled malware, show that crypto users must remain constantly vigilant as criminals create new tools and strategies.
“These rogue apps impersonate trusted platforms such as Rabby Wallet and TronLink, capturing recovery phrases through fake wallet interfaces or modified versions of real wallet code. This forms part of a worrying pattern where criminals mimic trusted brands to dupe victims into revealing seed phrases and sensitive personal data. Users should take a few simple but critical precautions: only install wallet extensions from official sources and verify the publisher and extension details before downloading; never enter a seed phrase or recovery phrase into a website or extension unless the legitimacy of the platform is beyond doubt. Any unexpected prompts to re-enter recovery credentials should always be viewed as a major red flag. Keeping wallet software and browsers updated, using hardware wallets for significant holdings, and checking transaction details carefully before signing can also reduce the risk of falling victim to these increasingly sophisticated types of impersonation attacks.”
Vagela says that crypto users, particularly those with self-custody, need to be diligent when holding their own digital assets.
“When you hold your own digital tokens, the security of those assets ultimately rests with you, making good security practices of paramount importance. In an increasingly digital world, where we are often asked to trust what we see on a screen, maintaining a healthy degree of skepticism towards digital interactions can be invaluable in identifying and avoiding potential threats.”
It is estimated that crypto theft and fraud topped $17 billion in 2025, with around $713 million coming from self-hosted/personal wallets.