{
 "tag": "metamask",
 "name": "MetaMask",
 "group": "Wallets & apps",
 "incidents": [
  {
   "slug": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "title": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "json": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "solana",
    "tron"
   ],
   "method": "malicious-extension",
   "product": "Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'",
   "tags": [
    "multi-evm",
    "solana",
    "tron",
    "malicious-extension",
    "chrome",
    "edge",
    "browser-extension",
    "extension-takeover",
    "seed-phishing",
    "clickfix",
    "ledger",
    "trezor",
    "metamask",
    "socket"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-30",
   "closedAt": null,
   "updatedAt": "2026-08-30T12:00:00Z",
   "summary": "Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available."
  },
  {
   "slug": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "title": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026",
   "json": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "multi-evm",
    "bitcoin",
    "tron"
   ],
   "method": "fake-app",
   "product": "iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps",
   "tags": [
    "multi-evm",
    "bitcoin",
    "tron",
    "fake-app",
    "ios",
    "app-store",
    "kaspersky",
    "sparkkitty",
    "metamask",
    "ledger",
    "trust-wallet",
    "coinbase",
    "seed-phrase",
    "developer-profile"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-04-20",
   "closedAt": "2026-04-20",
   "updatedAt": "2026-04-20T12:00:00Z",
   "summary": "Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published."
  },
  {
   "slug": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "title": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "json": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "The founder said he saw a deepfake of his friend on the fake Zoom call that came from the friend's hacked Telegram account."
   },
   "chains": [
    "ethereum"
   ],
   "method": "social-engineering",
   "product": "THORChain co-founder's personal wallet",
   "tags": [
    "ethereum",
    "social-engineering",
    "dprk",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "metamask",
    "zachxbt",
    "thorchain",
    "thorswap",
    "ai"
   ],
   "amountUsd": 1350000,
   "victims": 1,
   "startedAt": "2025-09-04",
   "closedAt": "2025-09-12",
   "updatedAt": "2025-09-12T12:00:00Z",
   "summary": "In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected."
  }
 ],
 "changes": [
  {
   "incident": "chrome-edge-19-extensions-wallet-drainer-aug-2026",
   "incidentTitle": "19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons",
   "severity": "high",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-08-30",
   "title": "BleepingComputer reported Socket's discovery of 19 malicious Chrome and Edge extensions; the Chrome versions were gone but one Edge version was still live.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/",
   "url": "https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026"
  },
  {
   "incident": "kaspersky-fakewallet-26-ios-apps-apr-2026",
   "incidentTitle": "Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-04-20",
   "title": "Kaspersky discloses 26 FakeWallet apps on the App Store, active since at least fall 2025, and reports them to Apple.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets",
   "url": "https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "The Block reported ZachXBT's $1.35M tally and North Korea attribution, and THORSwap's on-chain bounty offer to the attacker.",
   "sourceUrl": "https://www.theblock.co/post/370433/thorswap-issues-bounty-offer-tied-to-over-1m-exploit-of-thorchain-user",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-12",
   "title": "ForkLog reported his account of seeing a deepfake of his friend on the call.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  },
  {
   "incident": "thorchain-founder-deepfake-zoom-wallet-drain-sep-2025",
   "incidentTitle": "THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-09-04",
   "title": "He received a fake Zoom link on Telegram from a friend's compromised account, according to his own post.",
   "sourceUrl": "https://forklog.com/en/thorchain-founder-loses-1-3-million-in-cryptocurrency-theft/",
   "url": "https://drains.watch/i/thorchain-founder-deepfake-zoom-wallet-drain-sep-2025"
  }
 ]
}