Malicious Chrome Extension Skims Fees from Solana Trades

Thursday Nov 27 2025 14:10

Duration

2 min

  1. 1. Malicious Chrome Extension Skims Fees from Solana Trades

  2. 1.1 A Long-Lived Operation

  3. 1.2 The Latest in a String of Malicious Chrome Extensions

Malicious Chrome Extension Skims Fees from Solana Trades

A deceptive Google Chrome extension has been discovered exploiting Solana (SOL) traders. According to a recent report by cybersecurity firm Socket, this extension, posing as a convenience tool, quietly skims a portion of each Solana swap and redirects it to the creator's wallet. This contrasts with typical wallet-draining malware which aims to steal the entire balance. Unlike conventional wallet drainers, Crypto Copilot discreetly "injects an extra transfer into every Solana swap, siphoning a minimum of 0.0013 SOL or 0.05% of the trade," Socket's investigation revealed. This subtle approach makes it harder for users to detect the malicious activity. On the backend, Crypto Copilot leverages the decentralized exchange Raydium to execute swaps. However, it appends a second instruction to the transaction that transfers SOL from the user to the attacker. The user interface displays the swap details, but the wallet confirmation screens "summarize the transaction without surfacing individual instructions," effectively concealing the illicit transfer. "Users sign what appears to be a single swap, but both instructions execute atomically on-chain," Socket explained, highlighting the insidious nature of the attack.

A Long-Lived Operation

Socket has reported the malicious extension to the Chrome Web Store security team, requesting its removal. Despite being published on June 18, 2024, the extension, dubbed Crypto Copilot, surprisingly claims to have only 15 users at the time of this report. Crypto Copilot is marketed as a tool allowing Solana traders to execute swaps directly from their X (formerly Twitter) feeds. It lures users by promising "allowing you to act on trading opportunities instantly without the need for switching between apps or platforms."

The Latest in a String of Malicious Chrome Extensions

Google Chrome's massive user base and flexible extension system have made its extension ecosystem a prime target for cryptocurrency-related scams. Earlier this month, Socket warned that the fourth-most-popular crypto wallet extension in the Chrome Web Store was actively draining user funds. In late August, decentralized exchange aggregator Jupiter reported discovering another malicious Chrome extension emptying Solana wallets. In June 2024, a Chinese trader reportedly lost $1 million after installing a Chrome plugin called Aggr. That extension stole browser cookies to hijack accounts, including access to the trader's Binance account. This underscores the ever-present need for vigilance when installing browser extensions, especially those related to cryptocurrency.

Risk Warning: This article is provided for informational purposes only and does not constitute investment advice, investment research, or a recommendation to trade. The views expressed are those of the author and do not necessarily reflect the position of Markets.com. When considering shares, indices, forex (foreign exchange), and commodities for trading and price predictions, remember that trading CFDs involves a significant degree of risk and may not be suitable for all investors. Leveraged products can result in capital loss. Past performance is not indicative of future results. Before trading, ensure you fully understand the risks involved and consider your investment objectives and level of experience. Cryptocurrency CFD trading restrictions may apply depending on jurisdiction.

Default Author Avatar

Written by:

Noah Lee

Asset List

View Full List
Most Traded Commodities Indices Crypto Shares Forex
Asset
Sell
Buy
Change (%)

Trade Now

Trade Now

Trade Now

Trade Now
Asset
Sell
Buy
Change (%)

Trade Now

Trade Now

Trade Now

Trade Now
Asset
Sell
Buy
Change (%)

Trade Now

Trade Now

Trade Now

Trade Now
Asset
Sell
Buy
Change (%)

Trade Now

Trade Now

Trade Now

Trade Now
Asset
Sell
Buy
Change (%)

Trade Now

Trade Now

Trade Now

Trade Now
Asset
Sell
Buy
Change (%)

Trade Now

Trade Now

Trade Now

Trade Now

Latest

View all
spacex-stock

Wednesday, 12 August 2026

Duration

7 min

SpaceX Stock Jumps 9.7% on Starlink and AI Push; LUNR Gains Ahead of Earnings

Tuesday, 11 August 2026

Duration

6 min

Gold Price Today, August 12, 2026: XAU/USD Rises 0.5% Near $4,400 Ahead of US CPI
What Factors Drive Crude Oil Price Fluctuations

Tuesday, 11 August 2026

Duration

5 min

Oil Nears $90 as Fading U.S.-Iran Deal Hopes Renew Hormuz Supply Fears

Latest news

gold-trading

Wednesday, 12 August 2026

Indices

Gold Price Today, August 13: Gold Climbs Above $4,400 as Cooler US CPI Cuts Fed Hike Bets

tsmc-stock

Wednesday, 12 August 2026

Indices

TSMC Stock Rises 1.7% as AI Infrastructure Rally Lifts Chip Sector

WTI vs Brent Crude Oil

Wednesday, 12 August 2026

Indices

Oil Prices Fall Over 1% as OPEC and IEA Cut 2026 Demand Forecasts

bank-of-japan

Wednesday, 12 August 2026

Indices

USD/JPY forecast: Rate gap limits impact of US and Japanese intervention

kospi

Wednesday, 12 August 2026

Indices

KOSPI Jumps Nearly 5% as SK Hynix Surges 7% and Asian Chip Rally Accelerates

spacex-stock

Wednesday, 12 August 2026

Indices

SpaceX Stock Jumps 9.7% on Starlink and AI Push; LUNR Gains Ahead of Earnings

Tuesday, 11 August 2026

Indices

Gold Price Today, August 12, 2026: XAU/USD Rises 0.5% Near $4,400 Ahead of US CPI

What Factors Drive Crude Oil Price Fluctuations

Tuesday, 11 August 2026

Indices

Oil Nears $90 as Fading U.S.-Iran Deal Hopes Renew Hormuz Supply Fears

nio stock news today

Tuesday, 11 August 2026

Indices

NIO Stock News Today: Shares Slide as BlackRock Trims Stake Despite Record ES9 Demand

sk-hynix

Tuesday, 11 August 2026

Indices

U.S. Stocks Fall as SpaceX Drops 3.9%, While SK Hynix Jumps 4.7%

See all news