40 Firefox Extensions Found Stealing Crypto Keys: A Supply Chain Attack on the Web3 Gateway

The Web3 security firm Socket has exposed a sophisticated supply chain attack targeting Firefox users, identifying 40 malicious browser extensions that have been silently draining cryptocurrency wallets since at least March. The operation, which may have compromised thousands of users, represents a new level of tactical sophistication in the ongoing war for user trust in the decentralized web. According to Socket's forensic analysis, the attackers employed a "trust then poison" strategy. Nine of the 40 malicious extension IDs initially hosted harmless sports betting tools, accumulating user ratings and installs over months. In a subsequent update, the same extension IDs were silently replaced with wallet-draining code. This is not a bug in Firefox's security model—it is a deliberate exploitation of the platform's update mechanism, turning a browser extension into a remotely controlled data exfiltration tool. Socket's investigation reveals a modular attack framework. The 40 malicious identities used at least five distinct attack vectors: 7 served as remote-controlled phishing loaders, 15 captured recovery phrases, private keys, or other wallet secrets, 13 were modified clones of the popular Rabby Wallet that exfiltrated serialized key strings before local encryption, 5 gathered credentials and clipboard data, and the remaining ones employed hybrid techniques. The Rabby clones are particularly insidious: they look and behave exactly like the legitimate wallet until the user signs a transaction, at which point the attacker's server receives the full key material. "The critical insight is that the attack persists even after the user uninstalls the extension," said a Socket security researcher. "Any recovery phrase or private key that touched those malicious versions must be considered compromised. Uninstalling doesn't undo the exposure." This means every user who interacted with these extensions—even if they never lost funds—must now treat their wallets as burned and create new ones with fresh recovery phrases. Mozilla has acknowledged the incident, stating that it uses automated risk indicators and manual review to identify malicious wallet extensions. The company recommends users only install extensions from the official website of the wallet provider. However, this advice ignores the core problem: the attacker's extensions were published on the official Firefox Add-ons store, officially signed by Mozilla, and appeared legitimate. The platform's own vetting process failed to detect the code injection. This attack vector is not new in principle—supply chain attacks have plagued software ecosystems for decades. What makes this case uniquely dangerous for crypto users is the direct access to financial assets. Unlike a banking app that requires a second factor, a browser extension often has unfettered access to the user's browsing data, clipboard, and even the ability to inject scripts into web pages. When that extension is a wallet manager, the attacker effectively owns the user's private keys. The scale of the operation is industrial. Socket recorded 40 confirmed malicious identities, but notes that 77 additional related identities are under investigation. The attack infrastructure appears capable of mass-producing malicious extensions, swapping payloads, and rotating identities to evade detection. This suggests a well-funded, organized group rather than a lone hacker. From a market perspective, this event is a negative signal for the entire browser-based wallet sector. The trust that users place in extension wallets is the foundation of DeFi accessibility. Once that trust is broken, the entire ecosystem suffers. Expect a short-term migration to hardware wallets and standalone desktop applications. Companies like Ledger and Trezor will likely see increased demand, while wallet providers like Rabby must now invest heavily in proving their official distribution channels are uncompromised. Regulatory implications are also significant. While this is a criminal act rather than a securities violation, the incident puts pressure on browser vendors to tighten their extension review processes. The European Union's Digital Services Act and similar regulations could force platforms like Mozilla and Chrome to implement more rigorous code-signing and permission controls, potentially at the cost of the openness that made the Web3 extension ecosystem vibrant. Socket's report is a wake-up call. The attackers' use of "trust-building" through benign initial versions is a classic social engineering tactic, but applied at the platform level. It exploits the asymmetric trust relationship: the user trusts the browser store, the browser store trusts the developer, and the developer betrays both. The cryptographic keys are never the weak point—the trust chain is. For users, the immediate action is clear: if you have installed any Firefox wallet extension in the past six months, particularly one that updated its functionality, assume your wallet is compromised. Generate a new wallet on a hardware device or a clean desktop application, transfer all assets, and never reuse the old seed phrase. This is not paranoia—it is the only rational response to a supply chain attack that has been active for months. The longer-term question is whether browser extensions can ever be made safe for high-value crypto interactions. The answer may be no, unless browsers adopt hardware-backed isolation or mandatory code audits for extensions that access sensitive APIs. The industry must decide: convenience or security? The 40 compromised extensions suggest the current balance is dangerously tilted toward convenience. We build the rails, then watch the trains derail. The rails here are Firefox's extension store, and the trains are the millions of dollars in user funds that may have already been stolen. The only way to prevent the next derailment is to rebuild the track with stronger ties—cryptographic, not just administrative.