Solana

Jupiter

Raydium

A malicious Google Chrome browser extension is letting users trade on Solana, while quietly skimming a fee from every swap into the creator’s wallet.
According to a Tuesday <a href="https://socket.dev/blog/malicious-chrome-extension-injects-hidden-sol-fees-into-solana-swaps" rel="noopener noreferrer nofollow" target="_blank">report</a> by cybersecurity company Socket, the Google Chrome extension allows users to trade on <a href="https://cointelegraph.com/learn/articles/solana-sol-ecosystem-overview" rel="noopener noreferrer nofollow" target="_self">Solana</a> (<a href="/solana-price-index" rel="noopener noreferrer">SOL</a>) from their X social media feed. Unlike typical wallet-draining malware that tries to steal the entire balance, Crypto Copilot “injects an extra transfer into every Solana swap, siphoning a minimum of 0.0013 SOL or 0.05% of the trade,” Socket found.
On the back end, Crypto Copilot uses the <a href="https://cointelegraph.com/learn/articles/what-are-decentralized-exchanges-and-how-do-dexs-work" rel="noopener noreferrer nofollow" target="_self">decentralized exchange</a> Raydium to perform swaps for the user, but appends a second instruction that transfers SOL from the user to the attacker. The user interface only shows the swap details while wallet confirmation screens “summarize the transaction without surfacing individual instructions.”
“Users sign what appears to be a single swap, but both instructions execute atomically on-chain,“ Socket said.
<figure>
 <img alt="Malicious Chrome extension skims Solana swaps with hidden extra transfers" src="https://s3.cointelegraph.com/uploads/2025-11/019ac574-8706-7e89-9ae6-050b9ca31b7b" title="">
 <figcaption style="text-align: center;">
 Featured image of the Google Chrome extension. Source: Chrome Web Store
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/slowmist-uncovers-5-emerging-crypto-scams-q2" rel="noopener noreferrer nofollow" target="_self">5 ‘insidious’ crypto scams to watch out for this year</a>
<h2 id="a-long-lived-operation">A long-lived operation</h2>
Socket noted that it submitted a takedown request for the extension to the Chrome Web Store security team. The malicious extension is relatively long-lived, having been published on June 18, 2024, but the store reported that it only had 15 users at the time of writing.
Crypto Copilot markets itself as a convenience tool allowing Solana traders to execute swaps directly from Twitter. It promises “allowing you to act on trading opportunities instantly without the need for switching between apps or platforms.”
Related: <a href="https://cointelegraph.com/news/new-npm-supply-chain-attack-compromises-major-ens-and-crypto-libraries" rel="noopener noreferrer nofollow" target="_self">NPM supply-chain attack compromises major ENS and crypto libraries</a>
<h2 id="latest-of-many-malicious-google-chrome-extensions">Latest of many malicious Google Chrome extensions</h2>
Google Chrome’s massive user base and extensible design have long made its extension ecosystem a target for crypto-focused scams. Earlier this month, Socket warned that the fourth-most-popular crypto wallet extension in the Chrome Web Store was <a href="https://cointelegraph.com/news/malicious-crypto-wallet-google-extension-steals-seed-phrases" rel="noopener noreferrer nofollow" target="_self">draining user funds</a>. In late August, decentralized exchange aggregator Jupiter said it had identified another malicious Chrome extension that was <a href="https://cointelegraph.com/news/malicious-bull-checker-chrome-extension-found-targeting-solana-users" rel="noopener noreferrer nofollow" target="_self">emptying Solana wallets</a>.
In June 2024, a Chinese trader <a href="https://cointelegraph.com/news/hackers-steal-millions-chrome-plugin-binance-scam" rel="noopener noreferrer nofollow" target="_self">reportedly lost $1 million</a> after installing a Chrome plugin called Aggr. That extension stole browser cookies to hijack accounts, including access to the trader’s Binance account.
Magazine: <a href="https://cointelegraph.com/magazine/help-smart-home-devices-hacked-steal-crypto-bitcoin-cybersecurity/" rel="noopener noreferrer nofollow" target="_self">‘Help! My robot vac is stealing my Bitcoin’: When smart devices attack</a>

Malicious Chrome extension skims Solana swaps with hidden extra transfers

Table of Contents

Cointelegraph

Other articles published on Nov 27, 2025

Join our free newsletter for daily crypto updates!