19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons
Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'
Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available.
Why this severity: Only partly contained, many people exposed.
- Started
- Aug 30, 2026
- Chains
- Multiple EVM chains, Solana, Tron
At risk
- Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'
- Multiple EVM chains wallets
- Solana wallets
- Tron wallets
What to do now
- Remove the extension. Then, from a clean browser profile or device, create a new wallet, move your funds and revoke approvals on the old address.
- Change passwords, sign out all sessions and rotate API keys on your exchange accounts (Coinbase, Binance, Kraken, OKX and others).
Stay safe
Am I affected?
Check chrome://extensions and edge://extensions for any of these: Enable Right Click & Copy (Smart Unlock + OCR), RapidLens, QuickLens, Password Protect PDF, Allow Copy, PixelCheck, Creative Library, MirrorSphere SEO Stats, Site Signal, SEO Pulse Pro, Private Crypto News Reader, Blockfolio: Address Monitor, Crypto Rates & Fiat Converter, Crypto Alerter, DeFi Pulse Tracker, Crypto Price Badge, Multi-Chain Explorer, LedgerLook: Wallet Checker, or FeedX-Ray.
What to do now
- Remove the extension. Then, from a clean browser profile or device, create a new wallet, move your funds and revoke approvals on the old address.
- Change passwords, sign out all sessions and rotate API keys on your exchange accounts (Coinbase, Binance, Kraken, OKX and others).
How to avoid this
- Use a separate browser profile that has only your wallet extension in it for crypto.
- Remove extensions you don't need; a change of owner can turn a good extension bad overnight.
- If a site suddenly asks for your recovery phrase or tells you to run a 'browser update' command, stop. Real Ledger and Trezor pages never ask for your seed.
Timeline 1
BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.
Source
News & write-ups ›1
How this method works
A fake wallet extension, or a real extension that was sold or hijacked, reads your seed phrase or swaps transactions as you sign. Read about malicious browser extensions →
Follow new drains and updates in your feed reader or Telegram RSS bot.