16 Firefox Extensions Were Stealing Crypto Wallets
In short: Researchers at Socket found 16 malicious Firefox extensions posing as the popular Rabby and OKX crypto wallets. Disguised as official tools, the extensions asked users to enter their recovery seed phrase or private key — then quietly exfiltrated the data through Cloudflare Workers to attacker-controlled servers. Mozilla pulled the extensions from its catalog by October 5, 2026, but similar campaigns keep reappearing under new names.
What happened
Socket Threat Research identified 16 extensions in the official Firefox Add-ons store targeting users of the DeFi wallets Rabby (Ethereum) and OKX. Four extensions were built directly from Rabby Wallet's source code, while twelve others copied the OKX interface. They looked like ordinary utilities — portfolio managers, swap tools, desktop clients — and initially worked as advertised to avoid raising suspicion.
Researchers say the campaign is part of something bigger: the same actors were earlier linked to a network of 77 Firefox extensions, some serving phishing pages and others directly intercepting clipboard data and seed-phrase input fields. Activity has been tracked since at least March 2026, continuing through August.
How the theft worked
The trap triggered during wallet "import": the extension showed a familiar seed-phrase or private-key entry screen, nearly identical to the real app's. The entered data was sent unencrypted — before any local encryption step — to Cloudflare Workers nodes controlled by the attackers. Once an attacker has the seed phrase, they get full, irreversible access to the wallet and can drain funds instantly, with no way to undo the transaction.
This is a fundamentally different threat model from a site breach or database leak: here the user voluntarily hands the key to their money to a fake interface. We cover similar credential-theft patterns in our other privacy news coverage.
What it means for everyday users
An official extension store is not a safety guarantee — malicious add-ons pass Mozilla's review and stay installable for weeks. Crypto holders are the immediate target, but the underlying trick — a fake extension mimicking a trusted interface — applies just as well to banking apps, mail clients, and password managers. If you ever entered a seed phrase into an extension downloaded somewhere other than the wallet's official site, treat it as compromised.
How to protect yourself
Install extensions only via a direct link from the project's official site, not through the browser store's search — fake copies often rank higher thanks to inflated reviews. Check the publisher, the last update date, and whether ratings look like genuine users rather than bots. A recovery seed phrase should never be typed anywhere except the wallet app itself during initial setup — no legitimate service asks for it again through a web interface.
If you suspect you already entered your phrase into a shady extension, create a new wallet in a clean environment and move your funds — a compromised key can't be "fixed," only replaced. A separate layer of protection is controlling your own network traffic: the LiMP VPN app encrypts your connection and hides which services you reach from your provider and network owner, cutting the odds of landing on a spoofed page via DNS hijacking on unsecured Wi-Fi. A VPN doesn't replace caution when installing extensions, but it closes a different attack channel — at the network level, not the browser. See the LiMP VPN features page for more on what a VPN actually protects.