Warning: New Chrome Extension Targets Solana Traders

Warning: New Chrome Extension Targets Solana Traders – 0.05% Stolen Per Swap!

A recently identified harmful Chrome extension is stealing funds from Solana traders by quietly taking a fee from each swap they make. This is according to recent research from Socket's Threat Research Team. The extension, named Crypto Copilot, has been available on the Chrome Web Store since June 2024 and claims to simplify Solana trades directly from users’ X feeds. However, it has a hidden agenda to divert a portion of traders' funds to an attacker's wallet.

Key Takeaways

Malicious Extension: Crypto Copilot is a harmful tool disguised as a trading aid for Solana users.
Stealing Transactions: It siphons off 0.05% from each swap traders make.
Hidden Transfers: The extension adds extra, unauthorized transfer instructions while traders think they are making legitimate transactions.
Researcher's Findings: The extension is poorly documented and suspicious, pointing to malicious intent.
Rising Threats: This incident highlights increasing browser extension attacks targeting crypto users.

The Threat Posed by Crypto Copilot

The Cybersecurity team at Socket revealed that the malicious Chrome extension, Crypto Copilot, has been operating undetected since June 2024. Marketed as a convenient shortcut for executing Solana trades directly from X feeds, it has a nefarious side. Researchers found that the extension modifies standard swap instructions to include an additional transfer, redirecting at least 0.0013 SOL (approximately 0.05%) from each Raydium swap to an attacker’s wallet.

How the Extension Works

According to Socket researchers, the extension appears to construct a regular Raydium swap instruction but secretly adds a second instruction. This hidden process sends funds to the address labeled "Bjeida." Users only see the legitimate swap request, while wallet confirmation windows often show a general summary, keeping the unauthorized transfer concealed.

The malicious fee structure is hardcoded within the extension and concealed with obfuscated JavaScript. It charges either a minimum fee or a percentage fee, with trades exceeding 2.6 SOL subject to the full 0.05% extraction.

Researchers noted that the extension employs techniques such as variable renaming and aggressive minification to hide its malicious activities. The attacker’s wallet is disguised under a benign variable deep within the code.

As of now, the extension is still available on the Chrome Web Store. Socket has submitted a takedown request to Google but has yet to receive any confirmation regarding action taken against it.

Data Theft and Anomalous Activities

In addition to siphoning fees, investigators found that Crypto Copilot connects to a suspicious backend at crypto-coplilot-dashboard.vercel.app—a misspelled domain that currently only displays a blank placeholder page. Despite its emptiness, the extension continually sends wallet identifiers and activity data to this backend, using a hardcoded Helius API key for simulating transactions.

Another domain linked to this extension, cryptocopilot.app, appears to be parked. The lack of documentation, a functioning dashboard, or genuine support for users is inconsistent with a valid trading tool and reflects typical traits seen in harmful browser extensions.

While on-chain activities associated with the attacker’s wallet are limited, researchers believe that the low transaction volume signifies the extension’s restricted distribution rather than a lack of threat.

A Warning for Traders

The mechanism utilized in this extension means that high-frequency traders could unknowingly incur significant losses over time due to the small amounts being siphoned with each transaction.

Browser Extension Attacks on the Rise

The revelation comes amid increasing concerns regarding browser-based crypto threats. In July, more than 40 malicious Firefox extensions mimicked major wallet providers like MetaMask and Coinbase, gathering wallet credentials from users and sending them to attacker-controlled servers.

Exchanges like OKX alerted users following the discovery of fake plugins pretending to be trustworthy wallet tools. The prevalence of browser extensions has escalated, marking them as one of the most persistent attack vectors for 2025 and accounting for a huge share of crypto losses.

For instance, wallet-related breaches totalled $1.7 billion out of $2.2 billion stolen in the first half of the year, with additional phishing incidents contributing another $410 million.

Despite the increase in threats from extensions, the overall crypto sector saw a temporary decline in successful hacks. In October, only $18.18 million was stolen across 15 incidents, marking the lowest monthly theft total of the year. In September, losses had surged to $127.06 million due to nearly 20 major exploits. However, while the overall losses dipped, notable breaches continued to occur.