A reader lost funds this month to a browser extension that had been harmless for years. It wasn't a fake — it was the real extension, after its developer sold it. The new owner shipped an update, the browser installed it silently, and the next time a wallet was unlocked in that browser, the extension was watching.
This is not a rare pattern. Extensions are bought and sold constantly, and the permission you granted in 2023 belongs to whoever owns the extension today.
Why extensions are a wallet's weakest neighbour
An extension with "read and change all your data on websites you visit" can see what you see and type what you type — on every site, including your exchange and your browser wallet. It doesn't need a vulnerability. You already gave it permission.
Three things make this worse than most people assume:
- Updates are silent. The code you audited (or trusted) is not the code running now.
- Ownership transfers are invisible. There's no notification when a developer sells.
- Wallet activity is the target. Malicious buyers specifically seek extensions with large installed bases to monetise exactly this way.
The checklist
Work through this in ten minutes:
- Inventory what's installed. Open your browser's extension page. If you don't recognise it or haven't used it in months, remove it. Dormant extensions are pure risk.
- Check the permissions. Anything with access to all sites deserves a reason to exist. "Nice to have" doesn't clear that bar.
- Separate your money browser. Use a dedicated browser (or browser profile) for wallets and exchanges, with zero extensions apart from the wallet itself. Everyday browsing, with all its conveniences, happens elsewhere.
- Prefer hardware confirmation. A hardware wallet that shows the full address and amount on its own screen takes the browser out of the trust equation for the moment that matters.
- Treat the clipboard as hostile. Clipboard-watching malware swaps addresses as you paste. Verify the pasted address character-by-character on the device screen — the middle, not just the ends.
If a wallet in your browser has already been drained
Stop using that browser profile entirely. Move whatever remains using a clean device, record transaction IDs and timestamps, and report it to ReportCyber before anyone offering "recovery" finds you — our Recover page explains what real help looks like and what a recovery scam looks like.
General information only. Orange Brick Road Pty Ltd (ABN 92 655 540 480) does not hold an Australian Financial Services Licence and nothing here is financial product advice.