77 Firefox Wallet Extensions Were Stealing Seed Phrases

A browser extension that captures your seed phrase hands an attacker full control of the wallet, and no setting, revoke, or uninstall gets that control back.

An extension that passed five months of official store review was still stealing seed phrases on day one. Security researchers at Socket spent that window tracking a cluster of Firefox add-ons built to look like ordinary wallet and sports-score tools. Most wallet-security guides skip this attack surface entirely. A clean store listing today says nothing about the code an update ships tomorrow.

How did 77 wallet extensions end up stealing seed phrases?

Socket's research team named the cluster the "Offside Wallet Theft Factory." Mozilla's own signing records place the campaign between March 9 and August 3, 2026, and several of the extensions were still live when Socket published its report. Of 77 linked Firefox add-ons, researchers confirmed 40 as outright malicious. Roughly half threw up a convincing wallet-import screen and simply asked for a recovery phrase or private key.

Thirteen were modified builds of Rabby Wallet that behaved normally on the surface while quietly sending stored account data to an outside server every time it saved. Five more just grabbed saved credentials and clipboard contents. Nine of the extensions launched first as harmless, working sports-score add-ons, built up install counts and reviews, then swapped in the theft code in a later update. One fake, "0KX WEB3," used a zero in place of the letter O to pass a glance as the real OKX exchange. None of this required a single bad review to slip through. It required patience.

The Trust Wallet extension hack is the preview, not the outlier

Trust Wallet's own Chrome extension got hit the same way through a supply-chain compromise, not a lookalike clone. Version 2.68.0 shipped on December 24, 2025, carrying a file researchers tagged 4482.js that walked through a user's stored wallets and prompted for the mnemonic recovery phrase. The phrase was decrypted locally with the user's own password, then sent straight to a server the attackers controlled.

PeckShield put the damage above $6 million; other trackers cited closer to $7 million. SlowMist's analysis found the malicious code triggered on every unlock, not only during a fresh import, which means anyone running version 2.68.0 was exposed regardless of what they clicked. Trust Wallet shipped version 2.69 as the fix and said every affected user would be made whole. Changpeng Zhao backed that promise publicly. Most victims of a browser-extension compromise get no such reimbursement.

What do you do if you already typed in your seed phrase?

Treat that wallet as permanently compromised the moment the phrase left your screen. A password change doesn't fix this. Create a new wallet with a freshly generated seed phrase on a device you trust, then move every asset out of the old one, including NFTs and any LP positions. Revoke outstanding token approvals from the old address before you abandon it.

Don't reuse the compromised seed anywhere, not even on a different chain. If funds already moved before you could react, the destination-tracing steps are close to what works after a SIM swap drains a wallet: follow the first hop, note which chain it lands on, and expect the trail to run through a swap or a bridge within hours.

Checking whether the stolen funds already moved

Once a thief has the phrase, the first destination address usually tells you how organized the operation is. You can look up that address by hand on Etherscan, Solscan, or the matching chain explorer and scroll through its incoming and outgoing transfers one by one. Screen it instead through Plastron, free, which checks the address against a corpus of 3,902 labeled wallets, 780 of them on OFAC's current sanctions list, across seven EVM chains, and returns a verdict in seconds instead of an afternoon of manual tracing.

Run the same stolen crypto wallet check on any address a "recovery service" hands you before sending it a cent. Plenty of those services are the second scam, not the rescue. A clean result buys you nothing. A flagged one means stop.

How do you vet a wallet extension before installing it?

Check the publisher's history before the star rating. A six-month-old developer account with one wallet extension and thousands of suspiciously fast five-star reviews is the exact profile Socket flagged in the sports-score decoys. Compare the extension's requested permissions against what a wallet actually needs; one that asks for clipboard access or your browsing history on every site is asking for more than a wallet requires.

Install from the vendor's own download page when one exists, not from a search result, since fake listings have outranked the real MetaMask and OKX entries before. Keep a dedicated browser profile for anything that touches a seed phrase, separate from daily browsing, and move meaningful balances to a hardware wallet that never exposes the phrase to a browser at all. None of this is overkill. It's the floor.

FAQ

Does antivirus catch these malicious wallet extensions?

Not reliably. Socket, not an antivirus vendor, found the Offside Wallet Theft Factory cluster by auditing extension code and network calls, and several of the 77 extensions were still live in official stores after the report went public. Endpoint antivirus scans files on disk; a browser extension runs inside the browser's own sandbox, a layer most consumer antivirus products never inspect.

Is a hardware wallet still safe if a browser extension on the same machine is compromised?

Mostly, as long as you never typed the seed phrase into the extension and the extension can't trigger a signature without a physical confirmation on the device itself. A malicious extension can still try to swap the destination address or the transaction data shown on screen, so check the amount and address on the hardware wallet's own display, not the browser tab, before approving anything.

Will Trust Wallet's reimbursement happen again for a different wallet brand?

No guarantee of that exists. Trust Wallet's founder made that call publicly for this specific incident, and plenty of comparable extension compromises before it closed with victims absorbing the loss. Treat reimbursement as the exception, not the plan.

Can revoking token approvals undo a stolen seed phrase?

No. Revoking approvals limits what a connected contract can pull from a wallet going forward, but it does nothing once an attacker holds the seed phrase itself, since that phrase recreates every private key the wallet ever had. The only fix is moving funds to a wallet generated from a new, unexposed phrase.