40 Malicious Firefox Extensions Drained Crypto Wallets, 9 Disguised as Sports-Score Tools
Nine of the malicious extensions researchers just uncovered didn’t start out pretending to be crypto wallets at all. They started out as sports-score apps.
Security researchers at Socket identified a network of 77 Firefox extensions tied to cryptocurrency wallet theft and credential harvesting, an operation they’re calling the Offside Wallet Theft Factory. Of those, 40 were confirmed outright malicious, impersonating real wallets like OKX, Rabby Wallet, and TronLink to capture users’ recovery phrases, either by loading a fake wallet interface remotely or by baking the theft functionality directly into a modified copy of the real wallet’s code.
The remaining 37 extensions are the more unusual part of the story. They launched on the official Firefox add-ons marketplace as ordinary-looking utilities, VPN tools, password generators, dark mode switches, note-taking apps, and in nine specific cases, tools that simply displayed football, basketball, and hockey scores using a legitimate sports-data API. Under the same developer IDs used for those sports and utility shells, the extensions were later converted into wallet-draining malware, meaning a routine update to what looked like a harmless scoreboard widget was the actual delivery mechanism. Socket traces the campaign back to at least March 2026, running continuously through August.
The sports-score disguise is what makes this campaign notable versus ordinary fake-wallet extensions: it’s specifically designed to get past the instinct crypto users have already learned, to be suspicious of anything claiming to be a wallet, by hiding inside categories nobody thinks to scrutinize. Researchers say anyone who installed one of the confirmed malicious extensions should treat any recovery phrase, private key, or wallet state it had access to as compromised, and move funds to a freshly generated wallet rather than simply uninstalling the extension.
Want to understand how to evaluate whether a browser extension is safe to use with a crypto wallet? Learn more in the Bitcoin Academy.