# 19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

> **Open Intelligence Dossier** · First detected: 2026-08-29 10:07 UTC · Category: Technology

## Executive Summary
Security researchers have uncovered a wave of malicious browser extensions across Chrome, Edge, and Firefox designed to steal cryptocurrency wallet data.

## Intelligence Brief
A series of cybersecurity discoveries have revealed that multiple browser extensions are embedded with code specifically designed to drain cryptocurrency wallets and steal user credentials. According to reports from The Hacker News and Coin Gabbar, a malware campaign has targeted 19 extensions across the Google Chrome and Microsoft Edge browsers. Simultaneously, separate findings detailed in coverage from Yahoo Tech and CryptoSlate indicate that 40 fake add-ons for the Firefox browser were exposed for stealing secrets and credentials. Bitdefender further specifies that these Firefox add-ons were caught stealing browser credentials and cryptowallet seed phrases from unsuspecting users. The coverage emphasizes the deceptive nature of these tools and the specific platforms being exploited. The Hacker News and Coin Gabbar focus on the scale of the Chrome and Edge campaign, which affected 19 add-ons.


Meanwhile, Yahoo Tech and CryptoSlate highlight the Firefox threat, noting that 40 extensions were involved. A particular detail provided by CryptoSlate is that 9 of these malicious Firefox add-ons initially presented themselves as sports-score tools to deceive users into installing them. Bitdefender's reporting centers on the technical theft of seed phrases, which are critical for wallet access. This trend matters because it demonstrates a coordinated effort to target cryptocurrency users through common web browsers. The use of fake tools, such as the sports-score utilities mentioned by CryptoSlate, shows a strategy of using non-financial lures to gain access to sensitive data. Bitcoin World emphasizes the importance of user awareness regarding these malicious extensions.


The ability of these extensions to capture seed phrases and credentials means that attackers can potentially gain full control over a user's digital assets without needing their physical device. Future developments to monitor include the removal of these extensions from the respective browser web stores. Coverage from the named outlets suggests a need for users to review their installed add-ons for any of the identified malicious tools. While the current reports identify 19 extensions for Chrome and Edge and 40 for Firefox, the total number of compromised tools may shift as more are exposed. Users are encouraged to follow the guidance provided by Bitcoin World to understand how to protect their wallet data from such browser-based threats.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| CryptoSlate | 40 malicious Firefox add-ons targeted crypto wallets, and 9 began as sports-score tools | [Source Link](https://news.google.com/rss/articles/CBMizwFBVV95cUxORDY1Q05zOGdKWWFvZWJiYl9vU2piLU41NEQtTlRXNU9RQ3ZyN0VkZklDS3JkdGFYazBoTTR1QmtVeXZVUnJUeHBPVVlNdzhnSVZxMzQ4bXRibWl4cnM5OVQ2SDhTX1ViU2NkRGU2N0JGYjlLQ1VjNTJ0OEZ1M2FvbXQ1UnI0VGRxbWVNRUlwR0pmUmtlQ2JDemhCSHJvOEpmeWhQVjZPNUVRX3BLbUJkU1RMV1hKSjNIREQ5YjVGYTRYcGx1a0RXTmt2TGFpYlU?oc=5) |
| Bitcoin World | Malicious Browser Extensions Stealing Crypto Wallet Data: What Users Need To Know | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxPNmZtQktBSzFXdTdpeHBaWWdjRUZmb1BJVXl0SXlTTWZyeUZUcVRHeFJENFlWbHd1ODZPbGtTaGdVNFJiZ0F5d0Jzd2kwTmIwdDlsbHpBNEZKNDFZcHRnR0U1WWNOdjZnamZkUUw0VzE1Z3VZdnkxR1pFZHZ1T05LWQ?oc=5) |
| Yahoo Tech | 40 Fake Firefox Crypto Wallet Extensions Exposed Stealing Users’ Secrets and Credentials | [Source Link](https://news.google.com/rss/articles/CBMilAFBVV95cUxOdV9zTUJ0ckVyLTRub2JyMF9MUi1TNHRJbTBVcE45U09EWUQ1WlpDY3NvVWt2SVBHem9Xc3ZXems0U2gxRExpekJVSFJLNXVpc1hyeDBMNlhTdmZEMGZHT2Joa2k2S2lqUFB6dWIwMFVEQjhoXzFGMm9mYkpyaWZ3Slh5bi01ckNxeVo3M29VZFpGTjJW?oc=5) |
| Coin Gabbar | Chrome Extension Malware Campaign Hits 19 Browser Add-Ons | [Source Link](https://news.google.com/rss/articles/CBMiqwFBVV95cUxQUlN4ZUJ3Y0g1QWxfX0xYZUlLSG82SDZpQlFkcnBmM3VHN3ZwT1g2QWw3dDgwWlp6Tkl6cTI5a3MzRVVIRF92aUxFeU1WM1dxWllmS0NHSTEwbFA3T05SdWVTblg1VVBWd1UwVWpxV3h2NWI3amV0alNRelU2NzlxQjhZX0Z1UEdTM3lQS2hPV0g2dlU0ckp3cWZ0bUhNNjhaOHMwYi12TUs1b2c?oc=5) |
| Bitdefender | Malicious Firefox add-ons caught stealing cryptowallet seed phrases and browser credentials | [Source Link](https://news.google.com/rss/articles/CBMizwFBVV95cUxQM2F3SWczaVdLakhoU2drOUZMRG5ZelRweGVkRG0xRThzemJGVHY1OGprRTFkcG4yT2ZNX2VzbVVHMUlhNW5iQy1nWUpDamhhMzY3LXRUdlFyWmVkZklCcEFOTTI4RjZOVFVTV3drZEM2YkQ0LWhRd3BremgxVFZFOFBPRmNlRThYbzNvZ21OS2QxbjRNTTdVbUh2dnpzT2h2M1JmOHVNenNFeER2NlZrZWhuc2pmQU1PTUZSWDVsV2Q4eUQ0aFlBTEFqc2tYZ00?oc=5) |
| The Hacker News | 19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTE1OQTlIaHA0TzQwUEVmME9iQTl5NWw5UHRtM1dhOTdOdWloWG01aXIydmNVXzZIOGdpV20yMkk3TGtiWFA0YTJ1Ym5xLXVrSmxraHIzcVNfenlVek0zYlE4OEYwUjV0ZjBTcEVkMkowMnk0b29OMXhnUGRhcUpTUzQ?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-08-29/19-chrome-and-edge-extensions-found-with-wallet-stealing-and-crypto-draining*