Solana

Raydium

when

Security

Phantom

Security researchers <a href="https://socket.dev/blog/malicious-chrome-extension-injects-hidden-sol-fees-into-solana-swaps" rel="noopener noreferrer nofollow">disclosed</a> that Crypto Copilot, a Chrome extension, has been consistently skimming <a href="https://med.etoro.com/B10215_A67747_TClick_Scb-solana.aspx?TargetURL=https://www.etoro.com/markets/sol" rel="noopener noreferrer nofollow">SOL</a> from users trying to swap on <a href="https://www.cryptobreaking.com/raydium-ray-token-plummets-as-pump-fun-allegedly-tests-amm-is-it-falling-off-a-cliff/" rel="noopener noreferrer nofollow">Raydium</a>. Instead of directly draining wallets, the extension attaches a hidden transfer instruction to legitimate transactions, siphoning at least 0.0013 <a href="https://med.etoro.com/B10215_A67747_TClick_Scb-solana.aspx?TargetURL=https://www.etoro.com/markets/sol" rel="noopener noreferrer nofollow">SOL</a> or 0.05% of the trade value directly into the wallet of an attacker.
<h2 id="b-how-the-hidden-transfer-slipped-past-wallet-screens-b">How the Hidden Transfer Slipped Past Wallet Screens&nbsp;&nbsp;</h2>
The extension, launched on the Chrome Web Store on June 18, 2024, by a developer account listed as “sjclark76,” positioned itself as the perfect companion for traders glued to X, promising instant swaps directly from the feed by integrating with DexScreener for pricing, Helius for blockchain access, and mainstream wallets like Phantom and Solflare.
When a user initiates a swap, the extension silently modifies the transaction before it ever reaches the wallet.&nbsp;
The malicious code injects an additional SystemProgram.transfer instruction that routes funds to a hardcoded recipient address. Because the legitimate swap and the theft are combined into a single atomic transaction, the wallet’s confirmation screen shows only the expected trade details. The extra transfer remains invisible unless the user consciously expands and examines every instruction, a step only few traders take.
The extension’s source code is heavily compressed and hidden, while its supposed official website, cryptocopilot.app, remains a parked GoDaddy domain with no functional content. As of November 27, 2025, the extension, Crypto Copilot, is still available on the Chrome Web Store with only 12 and 15 known installations.
<h2 id="b-what-users-must-do-before-it-s-too-late-b">What Users Must Do Before It’s Too Late</h2>
The siphon scheme was disclosed by security company Socket on November 25, 2025, after fully reverse-engineering the extension. According to researcher Kush Pandya, the transfer is silently added to and forwarded to a personal wallet rather than to any protocol treasury, meaning most victims never notice unless they carefully review every instruction before signing.
Socket has submitted a removal request to <a href="https://www.cryptobreaking.com/google-finance-now-features-kalshi/" rel="noopener noreferrer nofollow">Google</a>. The incident follows a series of similar attacks on <a href="https://www.cryptobreaking.com/upbit-halts-solana-network-activity/" rel="noopener noreferrer nofollow">Solana</a> users, including the Bull Checker extension flagged in August 2024 and another high-ranking wallet that was flagged earlier in November 2025, which operate using similar tactics.
Users who have ever installed Crypto Copilot are advised to remove the extension immediately, move remaining funds to a new wallet, and revoke all associated approvals using services such as revoke.cash.&nbsp;
Moving forward, traders and investors are advised to manually review every transaction instruction before signing, particularly when using third-party browser extensions to interact with <a href="https://www.cryptobreaking.com/solana-price-prediction-sol-nears/" rel="noopener noreferrer nofollow">Solana</a> protocols.
This article was originally published as <a href="https://www.cryptobreaking.com/hidden-fee-scam-in-plain/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Hidden Fee Scam in Plain Sight: How Crypto Copilot Quietly Drained Solana Traders&nbsp;&nbsp;</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.

Hidden Fee Scam in Plain Sight: How Crypto Copilot Quietly Drained Solana Traders

Table of Contents

Crypto Breaking News

Other articles published on Nov 28, 2025

Join our free newsletter for daily crypto updates!