This malicious Firefox extension will drain your crypto wallet

(Image credit: Shutterstock)
Audio player loading…

A malicious Firefox (opens in new tab) add-on named "Safepal Wallet" managed to stay listed on the official Mozilla add-ons website for seven months as it scammed users by emptying out their cryptocurrency wallets (opens in new tab).

SafePal is a legitimate hardware cryptocurrency wallet that is designed to hold more than 10,000 types of assets, including Bitcoin (opens in new tab), Ethereum (opens in new tab), and Litecoin.

However, while the wallet does have official smartphone apps available for both Apple AppStore (opens in new tab) and Google Play Store (opens in new tab), the website doesn’t list any browser extensions.

TechRadar needs yo...

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window (opens in new tab) <<

“After I installed this extension and logged in with my credentials it was not working,” reported (opens in new tab) Firefox user Cali, adding that when they checked back about 8 hours later, their cryptos worth around $4000 had been transferred to another wallet.

Due diligence

Within five days of Cali's public report of the incident this month, a Mozilla spokesperson responded (opens in new tab) saying that they were investigating the incident, before dropping the fake add-on’s listing.

Reporting on the development, BleepingComputer explains that in order to publish an add-on on Mozilla's add-ons website, developers must follow a submission process (opens in new tab) that states submitted add-ons are "subject to review by Mozilla at any time."

However, the extent of such a review isn’t specified, nor has Mozilla explained how the fake add-on managed to get listed.

Furthermore, while the malicious browser add-on has been taken down, BleepingComputer reports that the phishing (opens in new tab) website set up by the threat actors is still up. 

The website asks users for their secret twelve-word backup phrase in order to pair the SafePal wallet, which is then silently sent to the threat actor behind the fake extension.

Via BleepingComputer (opens in new tab)

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.