Solana

Jupiter

Raydium

DeFi

<p>Decentralized trading platform Jupiter Exchange has recently published a detailed report on how Chrome Extension Bull Checker has been stealing tokens from Solana DeFi users over the past few weeks. Over the last week, several users reported losing the tokens leading to a detailed investigation.</p>
<h2 id="stop-using-chrome-extension-bull-checker">Stop Using Chrome Extension Bull Checker</h2>
<p>As reported by Jupiter Exchange, the Bull Checker Chrome Extension targeted several users on the Solana DeFi-related subreddits. Besides, it also allowed users to interact with <a href="https://coingape.com/glossary/decentralized-applications-dapps/" target="_blank" rel="noopener noreferrer nofollow">decentralized applications</a> (dApps) as usual, with transactions looking absolutely normal during simulations. However, after completing the transactions, the Chrome extension would maliciously transfer tokens to another wallet without the user’s knowledge.</p>
<p>Thus, Jupiter Exchange confirmed that there’s no vulnerability within the wallets or the dApps themselves, thereby confirming that the issue is solely due to the Bull Checker extension. Although the extension was supposed to be a read-only tool for viewing memecoin holders, it had permission to read and modify data across all websites, a major red flag overlooked by its users. The Jupiter Exchange added:</p>
<blockquote>
 <p>“After installing Bull Checker, it will wait till a user interacts with a regular dApp on the official domain, before modifying the transaction sent to the wallet to sign. After modification, the simulation result will still be “normal” and not appear to be a drainer”.</p>
</blockquote>
<p>“If you have this extension (or similar extensions with extensive permissions you cannot trust), please remove it immediately,” noted Jupiter Exchanges.</p>
<blockquote class="twitter-tweet">
 <p dir="ltr" lang="en">Identification Of Malicious Extension<br> Over the last week, we received reports that a small number of users using Solana DeFi got drained.</p>
 <p>After extensive investigation, we have identified a malicious Chrome extension called “Bull Checker” that had targeted users on several… <a rel="noopener noreferrer nofollow" href="https://t.co/pubayfmD9h">pic.twitter.com/pubayfmD9h</a></p>
 <p>— Jupiter <img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1fa90.png" alt="🪐" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@JupiterExchange) <a rel="noopener noreferrer nofollow" href="https://twitter.com/JupiterExchange/status/1825600323320434830?ref_src=twsrc%5Etfw">August 19, 2024</a></p>
</blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<h2 id="targeting-solana-defi-and-memecoin-traders">Targeting Solana DeFi and Memecoin Traders</h2>
<p>As per the investigation, Reddit account Solana_OG publicized the Chrome extension that was targeting <a href="https://coingape.com/sponsored/wif-and-bonk-continue-decline-with-solana-but-this-new-gamblefi-token-is-surging/" target="_blank" rel="noopener noreferrer nofollow">Solana memecoin</a> traders. This account lured the traders into downloading the extensions with the intent of stealing their assets.</p>
<p>Examples of affected transactions reveal that Bull Checker added malicious instructions to legitimate Jupiter and Raydium instructions, leading to the unauthorized transfer of tokens and authority to a malicious address. <a href="https://coingape.com/glossary/defi-decentralized-finance/" target="_blank" rel="noopener noreferrer nofollow">DeFi protocol</a> Raydium has verified that at least one affected user was using the Bull Checker extension.</p>
<p>Jupiter Exchange has thus advised users to remove other similar extensions with extensive, untrusted permissions, and thus protect their assets. On the other hand, the CBOE removed the 19b-4 application from its website at the SEC’s request thereby reducing the possibility of a <a href="https://coingape.com/vaneck-exec-remains-confident-on-solana-etf-launch-heres-why/" target="_blank" rel="noopener noreferrer nofollow">Solana ETF</a> in the market.</p>
<p>The post <a href="https://coingape.com/chrome-extension-bull-checker-steals-tokens-from-solana-defi-users/" rel="noopener noreferrer nofollow">Chrome Extension “Bull Checker” Steals Tokens from Solana DeFi Users</a> appeared first on <a href="https://coingape.com" rel="noopener noreferrer nofollow">CoinGape</a>.</p>

Chrome Extension “Bull Checker” Steals Tokens from Solana DeFi Users

Table of Contents

Coingape News Media

Other articles published on Aug 20, 2024

Ethereum and Cardano Show Bullish Trends – Here’s What You Need to Know

Litecoin’s Rising Metrics and Strengthening Fundamentals: Is LTC Severely Undervalued?

Dogecoin (DOGE) Explodes 72% in Volume, Price Breakout Coming?

Will XRP Price Hit $1 Next Month, for a 65% Surge?

Bitcoin Price Prediction: As Grayscale Says BTC Will Skyrocket Regardless Of US Election Result, ...

RAKBANK Teams Up with Bitpanda to Make Crypto accessible for UAE Residents

Join our free newsletter for daily crypto updates!