16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys
Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons
Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen.
Why this severity: Only partly contained, a narrower target.
- Started
- Oct 5, 2026
- Chains
- Multiple EVM chains
At risk
- Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons
- Multiple EVM chains wallets
What to do now
- Remove the extension.
- On a clean device, install the real wallet from the link on its official website, create a new wallet and move all funds there. Changing the extension password does not help, because the seed itself was stolen.
- After moving funds, revoke token approvals on the old address.
Stay safe
Am I affected?
Only if you installed a Rabby or OKX wallet extension on Firefox from a listing that was not the official one (names like 'Raabby WaIIet' or 'Portal WALLET') and typed a recovery phrase or private key into it.
What to do now
- Remove the extension.
- On a clean device, install the real wallet from the link on its official website, create a new wallet and move all funds there. Changing the extension password does not help, because the seed itself was stolen.
- After moving funds, revoke token approvals on the old address.
How to avoid this
- Install wallet extensions only from the link on the wallet's official website, and check the publisher name and user count.
- Watch for spelling tricks such as a capital I in place of a lowercase l, or doubled letters.
- No real wallet needs you to re-import your seed to fix, verify or update anything.
Timeline 2
News & write-ups ›1
How this method works
A fake wallet extension, or a real extension that was sold or hijacked, reads your seed phrase or swaps transactions as you sign. Read about malicious browser extensions →
Follow new drains and updates in your feed reader or Telegram RSS bot.