Researchers uncovered 16 malicious Firefox wallet extensions designed to capture recovery phrases and private keys. Here’s how the scam worked and how to protect your wallet.
Sixteen malicious Firefox extensions were designed to look like familiar crypto wallets. Their target was not a blockchain vulnerability or a cryptographic flaw. The extensions attempted to capture recovery phrases and private keys when people imported existing wallets, then send those secrets to infrastructure controlled by the attackers.
The findings, published by Socket Threat Research on October 7, 2026, illustrate a simple but consequential security failure: a convincing wallet interface can persuade someone to hand over the very secret that protects their funds.
What researchers found
According to Socket’s investigation, the campaign included 16 Firefox extensions impersonating crypto wallets. Four larger packages imitated Rabby Wallet, using a deceptively similar name, “Raabby WaIIet.” Another 12 presented interfaces resembling OKX Wallet and prompted users to import an existing wallet.
Socket examined extension packages, manifests, event handlers, and network behavior. The researchers identified code intended to collect recovery phrases or private keys and send them to attacker-controlled endpoints hosted on Cloudflare Workers.
That does not mean every extension successfully stole funds. Socket reported that one compact variant contained implementation mistakes that prevented its normal theft flow from working as packaged. The investigation did not establish how many people were affected or how much cryptocurrency, if any, was stolen through these extensions.
Socket also reported that Mozilla had unpublished the malicious extensions by October 5, before the research write-up appeared. The useful lesson is therefore not that these exact listings remain available today. It is how easily a wallet-import screen can become a collection point for sensitive credentials.
How the seed phrase theft worked
Importing a wallet is a familiar process. An application asks for a 12- or 24-word recovery phrase, reconstructs the relevant keys, and displays the user’s accounts. In a legitimate application, that can be an intentional recovery or migration step.
A malicious extension can imitate the same flow. The user sees a familiar import screen and enters their phrase, but the extension’s code captures it and attempts to transmit it elsewhere.
In the Rabby-like packages, Socket identified handlers for importing mnemonic phrases and private keys. In the smaller packages, the interface passed entered secrets to a background handler that could prepare a network request to the attackers’ infrastructure.
No one needs to guess a private key if its recovery phrase has already been disclosed. A person who obtains a valid phrase can generally reconstruct the associated keys in another wallet application. The exact accounts and assets at risk depend on the phrase, derivation paths, networks, and any additional protections involved.
It is important to distinguish malicious functionality from confirmed financial loss. Researchers can prove that a package contains code designed to exfiltrate a secret without proving that every installation resulted in a successful theft.
Another detail from the Socket analysis is worth noting: the extensions’ manifests declared that user data was not collected. The researchers nevertheless found logic intended to process and transmit wallet secrets. A privacy declaration is not a substitute for verifying what software actually does.
Why a fake wallet can look legitimate
Attackers do not necessarily have to build an entire wallet from scratch. They can copy familiar screens, icons, terminology, and parts of a legitimate application’s code, then add a malicious import flow.
Socket found that the larger packages reused substantial Rabby-related code and interface elements, including links to legitimate resources. That combination matters because visual familiarity is often mistaken for authenticity.
A convincing design does not prove that an extension came from the real developer. Neither does a listing in an official extension store. Review systems reduce risk, but malicious software can still appear in distribution channels that users generally trust.
A better question than “Does this look like my wallet?” is “How did I get here, who published this software, and why does it need my recovery phrase?”
Would a hardware wallet protect you?
Hardware wallets are designed to keep private keys separate from the general-purpose devices and browsers people use every day. Under normal operation, transactions can be signed without exposing the underlying private keys to a browser extension.
That separation is valuable, but it has a clear limit. If someone manually types the recovery phrase from a hardware wallet into a malicious extension, the secret is no longer confined to the protected environment.
This does not mean a compromised browser can automatically extract keys from a properly designed hardware wallet. It means social engineering can bypass the separation by persuading the owner to disclose the backup.
There is also a distinction between seed phrase theft and malicious transaction signing. A browser may attempt to trick a user into approving an unsafe transaction even when the private key never leaves a hardware device. Those are different threat models and require different defenses.
The principle applies across wallet brands: offline key storage helps only while the recovery phrase and private keys remain secret.
_________________________________________________________________
Your keys can stay offline. Your recovery phrase still needs protection. ERA Wallet helps keep private keys isolated from your everyday online environment. The rest starts with knowing what never to share.
Code ERABLOG20 for 20% off.
_________________________________________________________________
What to do if you entered your recovery phrase
If you entered a recovery phrase or private key into an extension you now suspect was malicious, treat the secret as potentially compromised. Removing the extension may stop further activity on your browser, but it cannot make a disclosed secret private again.
First, stop using the suspicious environment for wallet operations. Inspect your browser for other unknown extensions, and use a clean, trusted device for the next steps. Avoid websites or support accounts offering to “verify” or “rescue” your seed phrase by asking you to type it again.
Create a new wallet with a newly generated recovery phrase in a trusted environment. Then plan to transfer assets from addresses derived from the exposed phrase to addresses controlled by the new one. Consider the networks, account types, transaction fees, and any time-sensitive risks involved.
A single recovery phrase may control multiple accounts. Do not assume that only the address shown in the suspicious extension is at risk.
Review token and smart-contract approvals as well, especially if you interacted with unfamiliar applications. Revoking an approval can address a separate permission-related risk, but it does not solve a leaked-seed problem. Anyone who has the underlying key may still control the old address.
Changing the local password of a browser wallet is also insufficient. That password may protect a local encrypted copy of the keys; it does not revoke keys that an attacker has already obtained.
If the situation involves substantial assets, complex account setups, or evidence of an ongoing attack, seek reputable incident-response help. Never share your recovery phrase with someone claiming to assist.
How to vet wallet extensions before installing them
Start at the wallet developer’s official website and follow its link to the extension listing. Check the exact spelling of the name and the publisher rather than relying on a logo or search-result position.
Treat unexpected recovery-phrase requests as a reason to stop and verify. Importing a seed into another application is sometimes a legitimate operation, but it expands the number of environments that have handled that secret. It should never be a casual step prompted by an unfamiliar extension.
Keep your browser extension list small and review it periodically. Remove tools you no longer use, and pay attention if an extension suddenly changes purpose or asks you to restore a wallet without a clear reason.
Most importantly, distinguish a wallet’s everyday connection or signing workflow from the exceptional act of entering its recovery phrase. An application asking to connect to a wallet is not the same as an application asking to learn the secret that controls it.
Frequently asked questions
Can a Firefox extension steal a seed phrase?
Yes. If a user enters a recovery phrase into a malicious extension, its code can read the phrase and attempt to send it to an attacker. Socket documented this mechanism in the packages it investigated.
Is a hardware wallet safe from fake extensions?
A hardware wallet can keep keys out of the browser during normal use. But if the owner manually enters the hardware wallet’s recovery phrase into a fake extension, that phrase may be compromised.
What should I do if I entered my seed phrase into a fake wallet?
Assume the phrase may be exposed. On a clean, trusted device, generate a new wallet with a new phrase and arrange to move assets away from addresses controlled by the old one. Check related accounts and permissions, and do not enter the old phrase into random recovery tools.
Does uninstalling the extension protect my funds?
Not by itself. Uninstalling removes the application, but it does not invalidate a recovery phrase or private key that may already have been copied.
Key takeaways
- The Firefox campaign involved 16 malicious wallet-like extensions, but the research did not establish that every variant worked or that every installation caused a loss.
- Familiar branding and polished interfaces do not establish that an extension is authentic.
- A recovery phrase entered into untrusted software should be treated as exposed.
- Hardware-wallet isolation cannot protect a secret that its owner manually discloses.
- After a suspected seed leak, moving to newly generated keys matters more than simply uninstalling an extension or changing a local password.
Originally published at https://blog.era-wallet.com on October 9, 2026.
