19 Chrome and Edge extensions that stole wallets and passwords

Reported August 2026. Socket researchers found 18 Chrome extensions and one Edge extension that delivered a crypto wallet drainer and credential stealer. The attackers built 14 of them and bought the other 5 from their original developers, then pushed the malware in an update.

Why the bought ones matter

An extension that changes hands keeps its name, icon, reviews and users. Chrome installs the new owner's update quietly, and nothing tells you that someone else is now behind it. People who had trusted these extensions for months got the malware without doing anything.

What to do if you have one

  1. Open chrome://extensions (or edge://extensions) and remove any extension from the lists below.
  2. If you used a crypto wallet in that browser, move your funds to a new wallet created on a clean device. Don't reuse the old recovery phrase.
  3. Change passwords you typed or saved in that browser, starting with email and banking, and turn on two-factor sign-in.
  4. Remove extensions you no longer use. Fewer extensions means fewer chances for this to happen again.

Bought from their original developers (5)

Built by the attackers (14)

Each Chrome link opens the extension's checker page, which shows whether it is still in the store.

Sources

What this page can't see

A store listing doesn't show what an extension can access on your computer, and it can't warn you later. Extensions get sold, and the next silent update can change everything.

Extension Guardian watches the extensions you have installed and warns you when one changes owner, gains new permissions or disappears from the store. Free, open source, no account.

Add to Chrome, it's free