19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code

Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active

The article reports that researchers identified 19 browser extensions (18 for Chrome and one for Edge) containing code to steal wallet secrets and drain cryptocurrency, all published over six months and sharing common code and tradecraft indicative of a coordinated campaign. These extensions compromise users’ financial assets by exfiltrating sensitive wallet information once installed. From a RealGround perspective, this highlights AI-adjacent supply chain risk: any organization integrating browser-based or third-party plugins into AI workflows (e.g., for data access, automation, or agent tooling) must treat extensions and integrations as part of their AI supply chain and subject them to security review. Practically, security teams should maintain an extension SBOM, vet and monitor plugins used by AI agents or analysts, and perform continuous red teaming to detect malicious or tampered components before they reach production AI environments.