Last updated: October 27, 2026
Fake crypto browser extensions impersonate popular wallets or tools in extension stores and search ads; once installed, they steal seed phrases you type, swap copied addresses, or push malicious transaction signatures — and sometimes a legitimate extension turns malicious after an ownership change or a compromised update. Install wallet extensions only via the official website's link, keep as few extensions as possible, use a separate browser profile for crypto, and keep savings on a hardware wallet. For swaps, no-connection exchanges like ETH → XMR don't need any extension at all.
- 1 malicious extension can read every page
- Official link only, never search ads
- Separate browser profile for crypto
- 0 extensions needed for instant swaps
How malicious extensions steal crypto
| Trick | What happens |
|---|---|
| Fake wallet clone | Asks you to "import" your wallet and sends the seed to attackers |
| Clipboard hijacking | Replaces addresses you copy with the attacker's |
| Page injection | Changes deposit addresses or adds fake pop-ups on real sites |
| Malicious update | A trusted extension is sold or hacked and ships stealing code |
| Fake "helper" tools | Price trackers, airdrop checkers or "AI assistants" with broad permissions |
How to install and use extensions safely (step by step)
- Go to the wallet's official website (bookmarked) and use its link to the store — not search results or ads.
- Check the publisher, user count and reviews; clones often have few users and recent creation.
- Review permissions: "read and change all your data on all websites" is a lot to grant.
- Keep a separate browser or profile just for crypto, with only the wallet installed.
- Use a hardware wallet and confirm every address on its screen — hot vs cold.
- Never type a seed phrase into an extension unless you are deliberately restoring a wallet you installed yourself — if a seed leaked.
Signs an extension is malicious
- It asks for your existing seed right after install "to sync".
- Addresses change after you paste them — address safety.
- Unexpected signature requests or pop-ups on familiar sites — wallet drainers.
- The extension changed owner or gained new permissions in an update.
- Fake extensions are often promoted through phishing emails and ads — phishing emails and SMS.
Swapping without extensions
DEXs and bridges require a wallet extension and signatures. A no-KYC instant exchange doesn't: you just send a deposit from any wallet — including a hardware wallet's own app — and receive to an address you paste. Fewer moving parts in the browser means fewer places for malware to interfere. Compare exchanges in the swap table.
Frequently asked questions
How do I know a wallet extension is real?
Install it only through the link on the wallet's official website, and check the publisher name and user count in the store.
Can a browser extension steal my crypto?
Yes. Extensions with broad permissions can read pages, change addresses and capture typed seeds. Keep extensions minimal.
What if I installed a fake wallet extension?
Remove it, and if you entered a seed, move all funds to a new wallet with a new seed immediately.
Is a mobile wallet safer than an extension?
Mobile apps are more isolated from other software, but they can be faked too. A hardware wallet is safest for savings.
Do I need an extension to swap crypto?
No. Instant exchanges need only a deposit from your wallet and a receiving address.
Swap without any extension: ETH → XMR, BTC → XMR or all pairs. No account, no ID, no logs.