Socket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets.

Once installed, the malicious extensions stole recovery phrases and private keys, which would provide the attacker with full control of a wallet.

A crypto wallet is an app, browser extension, or physical device that lets you manage cryptocurrency such as Bitcoin. Despite its name, it doesn’t actually hold your coins. Those are recorded on a blockchain, a shared digital record of transactions. Instead, the wallet manages the secret digital keys that let you access and spend them.

When you create a wallet, you may be given a recovery phrase: a list of words you can use to restore access. Write it down and store it offline. It’s a backup of your keys, not just an ordinary password. Anyone who gets hold of it can take control of your funds, which is why fake wallet extensions try to steal it.

Cybercriminals listed three fake wallet extensions on Firefox Add-ons, impersonating Phantom, Jupiter, and Bitget. The genuine wallets offer extensions for other browsers: Jupiter lists Chrome, Brave, and Edge; Bitget’s extension is for Chrome; and Phantom says its Firefox extension is no longer supported.

The malicious extensions looked for 12-, 15-, 18-, and 24-word recovery phrases, as well as Ethereum and Solana private keys. They could read input fields, detect pasted text, and scan screens displaying recovery phrases.

A recovery phrase or private key is a bearer secret: whoever holds it controls the wallet and can move its assets. The Phantom variant’s backend logged captured secrets, sent them to a Telegram bot, and automatically moved funds to hardcoded payout addresses. Those addresses covered Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana, and Bitcoin. The Phantom variant could read a phrase both when it was typed during import and when it was displayed on a reveal screen.

How to stay safe

Socket says all three listings were live on Firefox Add-ons during its analysis and have since been removed. But if you find one of these extensions in your Firefox browser, you should:

• Remove the extension. Use the three-dot menu next to it and choose Remove.
• If you ever entered a phrase or key, create a new wallet on a clean device and move your assets immediately. Treat the old wallet as compromised.
• In the future, install wallets only from the vendor’s official website link, not from store search results.
• The fake Phantom listing asked to access data on all websites and had no privacy policy. These are warning signs to look out for.
• Use an up-to-date, real-time anti-malware solution that blocks malicious websites.

Never enter your recovery phrase on a website. Enter it only in the official wallet app when restoring. Wallet support will never ask for it.

IOCs

The malicious extensions:

• Phantom impersonator: add-on ID 3092199
• Jupiter impersonator: add-on ID 3092666
• Bitget impersonator: add-on ID 3092059

Subdomains:

• bonto[.]io
• phantom[.]bonto[.]io
• jupiter[.]bonto[.]io
• bitget[.]bonto[.]io
• coinbase[.]bonto[.]io
• exodus[.]bonto[.]io

IP addresses:

• 104.21.34[.]69
• 172.67.155[.]198

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Bitget says suspected North Korea-linked actors stole $351.6M from hot and warm wallets. Withdrawals were suspended while Mandiant investigates.

Cryptocurrency exchange Bitget says suspected North Korea-linked threat actors stole $351.6 million from a limited number of hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals.

Bitget said customer balances, cold wallets and most platform assets remain secure. Mandiant and SlowMist are investigating the incident, while deposits and trading continue normally.

“We are currently working with independent third-party experts Mandiant and SlowMist for a full investigation. Our first priority is our users. User balances remain intact, and Bitget’s User Protection Fund covers the impact on this platform-wide incident.” the company added. “Bitget Wallet operates as a self-custodial wallet on a completely separate and independent infrastructure from Bitget Exchange and was not affected by this incident. Bitget Wallet users’ assets remain onchain under users’ control and remain unaffected.”

Bitget CEO Gracy Chen said the security breach affected ETH, XRP, BNB, AVAX, USDT and USDC across several blockchains. The attacker reportedly compromised a backend wallet system, spoofed transaction data and bypassed the authorization process to move funds. Bitget said affected blockchain foundations were contacted and some have frozen hacker wallets.

“We have contacted the foundations of all affected chains, and some foundations have confirmed the freezing of hacker wallet addresses,” Chen explained. “Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations.”

Bitget is a cryptocurrency exchange and Web3 company founded in 2018. It provides services for buying, selling and trading digital assets, including spot and futures trading, copy trading and other financial products. The company has expanded beyond crypto into traditional markets and now describes itself as a “Universal Exchange.” Bitget says it serves more than 120 million users in over 150 countries and regions.

The attribution to North Korea-linked threat actors doesn’t surprise. According to Chainalysis, North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, bringing the estimated total stolen by DPRK-linked actors to $6.75 billion.

The thefts increasingly target crypto exchanges and other digital-asset services, with attackers using techniques ranging from sophisticated cyber intrusions to fake IT-worker identities.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Bitget)