Firefox Extensions Exposed in Massive Crypto Wallet Theft Scheme
Security researchers at Socket have discovered a large-scale crypto wallet theft scheme linked to 77 Firefox browser extensions. The group, which has been active since at least March 2026, was still running in August.
The majority of the extensions, 40, directly steal crypto wallet secrets or login credentials, while others use fake sports score apps as cover for the wider network. Some extensions even copy Rabby Wallet code to intercept recovery phrases and private keys.
According to the researchers, several extensions pretend to be well-known wallet tools like OKX or Rabby Wallet. One extension, 0KX WEB3, used a zero instead of the letter O to look like the real OKX brand. This extension had no actual wallet features but loaded a webpage stored on Supabase that asked users to enter their recovery phrase or private key.
Researchers found that some extensions used Cloudflare Workers and Supabase to send stolen data to hacker-controlled servers. The shared code EQOx7EIPZSNi was discovered across several different extensions, suggesting the same group or tools were behind them.