Security

<ul>
 <li>Crypto Copilot Chrome extension steals SOL during trades</li>
 <li>The tool pretends to offer Solana trading via X (Twitter)</li>
 <li>Users should uninstall the extension to protect their funds</li>
</ul>
<p>A new scam targeting Solana users has been uncovered. The malicious <strong>Crypto Copilot Chrome extension</strong> is posing as a helpful trading tool that allows users to trade SOL directly through X (formerly Twitter). However, behind the scenes, it’s skimming a portion of every transaction without users’ knowledge.</p>
<p>This extension, once installed, integrates with X and makes it appear as if it’s simplifying crypto trading. But instead of acting as a trusted bridge to Solana’s DeFi ecosystem, it secretly drains small amounts of SOL from every swap conducted using the platform.</p>
<h2 class="wp-block-heading" id="img-src-https-s-w-org-images-core-emoji-16-0-1-72x72-1f50d-png-alt-how-the-scam-works"><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/1f50d.png" alt=""> How the Scam Works</h2>
<p>The scam operates by injecting malicious code into the browser session. While users believe they are executing legitimate trades, the extension silently redirects a part of each swap to wallets controlled by the attackers. This tactic makes it hard to detect unless users closely monitor their outgoing transactions.</p>
<p>Security researchers and community members have begun to track the stolen funds, and early estimates suggest the losses are significant. The extension has gained traction quickly due to its social engineering approach and seemingly useful functionality.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>ALERT: A malicious Chrome extension called Crypto Copilot is letting users trade Solana from X while secretly skimming SOL from every swap. <a href="https://t.co/qzb8ptpk2d" rel="noopener noreferrer nofollow">pic.twitter.com/qzb8ptpk2d</a></p>— Cointelegraph (@Cointelegraph) <a href="https://twitter.com/Cointelegraph/status/1994171886012338339?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 27, 2025</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="img-src-https-s-w-org-images-core-emoji-16-0-1-72x72-26a0-png-alt-what-you-should-do"><img src="https://s.w.org/images/core/emoji/16.0.1/72x72/26a0.png" alt=""> What You Should Do</h2>
<p>If you have installed the <strong>Crypto Copilot Chrome extension</strong>, uninstall it immediately. Also, consider revoking any permissions granted via connected wallets and scanning for potential compromises. It’s also wise to move remaining assets to a fresh wallet to prevent further losses.</p>
<p>Users should be cautious of any browser extension that asks for access to their crypto wallets or promises to simplify trading directly through social media platforms. Always verify the source and reviews before installing any crypto-related tool.</p>
<p>The post <a href="https://coinomedia.com/crypto-copilot-extension-scam/" rel="noopener noreferrer nofollow">Crypto Copilot Chrome Extension Steals SOL from Users</a> appeared first on <a href="https://coinomedia.com" rel="noopener noreferrer nofollow">CoinoMedia</a>.</p>

Crypto Copilot Chrome Extension Steals SOL from Users

Table of Contents

CoinoMedia

Other articles published on Nov 28, 2025

Join our free newsletter for daily crypto updates!