Over 40 Fake Firefox Wallet Extensions Are Stealing Crypto Seed Phrases and IPs by Cloning Well-Known Wallet Apps Like MetaMask and Coinbase

Fake Wallets Flood Firefox Store as Hackers Target Crypto Users With Malicious Extensions

Crypto users are being lured into installing fake wallet extensions on Firefox, as hackers step up attacks using copycat apps that closely mimic the real thing.

At least 40 fraudulent extensions impersonating major wallet brands—including MetaMask, Coinbase Wallet, Trust Wallet, Phantom, and Exodus—have been identified, with some still available for download in the official Firefox Add-ons store.

The malicious campaign, active since around April 2025, was exposed by cybersecurity firm Koi Security, which flagged the growing number of clones stealing users' seed phrases and transmitting data to attacker-controlled servers.

The operation shows no signs of slowing, despite removal efforts, as new fake apps continue to appear.

How Fake Wallets Are Tricking Users With Real-Looking Apps

Attackers used the open-source code from legitimate wallet projects, injecting their own malicious logic into extensions that still behaved like genuine apps.

By copying the logos, branding, and even wallet functions, the extensions appeared authentic—making them far harder for users to spot as fraudulent.

Koi Security’s analysis confirmed that once installed, these fake extensions immediately extracted wallet credentials and user IP addresses, which were then sent to attacker servers.

In some cases, the extensions remained undetected for extended periods due to their close resemblance to official tools.

Source: Koi Security

Adding to the deception, many of these malicious apps were padded with hundreds of fake five-star reviews, giving the appearance of popularity and trustworthiness.

According to Koi, this strategy helped the fraudulent extensions pass under Mozilla’s automated detection systems, which rely on signals like low ratings and spam flags.

Is Firefox Doing Enough to Remove Malicious Extensions?

Mozilla has not issued a formal statement on the situation.

However, a blog post from its extension team noted:

“If a wallet extension reaches a certain risk threshold, human reviewers are alerted to take a deeper look. If found to be malicious, the scam extensions are blocked immediately.”

Despite these internal mechanisms, fake apps remain a persistent problem.

OKX, whose brand was spoofed in one of the fake extensions, had already warned users back in January that it had never published a Firefox wallet.

The company urged users to withdraw funds if they had installed any suspicious plugins and filed formal complaints to Mozilla.

Fake Firefox extensions posing as crypto wallets (Source: GitHub)

Russian-Origin Clues Found in Malicious Code

Koi’s investigation traced the origin of the attack to a Russian-speaking threat group.

Evidence includes code comments written in Russian and metadata from one of the command-and-control servers.

The attackers’ infrastructure remains active, with some clones still being distributed via unofficial websites, despite being pulled from official stores.

Other firms, including SlowMist, have also issued alerts, warning users that the attack remains live.

The firm stressed that “many users have already reported losses,” particularly those who had searched for wallet tools without verifying sources.

Crypto Theft Hits $2.2 Billion in 2025 Amid Broader Wave of Attacks

The campaign comes during a surge in crypto-related breaches.

CertiK’s latest report shows total crypto losses exceeded $2.47 billion in the first half of 2025 alone.

Wallet-specific attacks made up a staggering $1.7 billion across 34 incidents, while phishing scams caused another $410 million in damage.

Ethereum continues to be the top target, suffering $1.6 billion in losses across 175 incidents.

The year’s largest single theft occurred in February when Bybit lost over $1.5 billion in liquid-staked ETH and MegaETH due to a smart contract exploit.

Beyond browser-based attacks, fraudsters are also targeting hardware wallets.

In China, a victim lost $7 million after buying a fake cold wallet through Douyin (TikTok’s mainland version), which was preloaded with known private keys.

Meanwhile, macOS users have been hit by malware-laced Ledger Live clones spreading through thousands of compromised websites.

Some attackers have even resorted to physical mail scams, sending fake letters impersonating Ledger via postal services to trick users into scanning malicious QR codes.

Will Regulation Ever Catch Up to Sophisticated Crypto Threats?

As crypto adoption spreads, so do the risks.

The latest Firefox wallet scam is not just a wake-up call—it’s a signal that attackers are moving faster than most security frameworks can respond.

The use of cloned open-source tools, paired with fake social proof and seamless design, shows how easy it is for attackers to weaponise trust.

Unless app stores and crypto platforms overhaul how extensions are verified, these types of breaches will remain an ongoing threat—one update away from draining everything.