Drainer Extensions in the Browser: A New Door to Your Wallet

MetaMask, Phantom, Trust Wallet — crypto wallets as browser extensions have become the standard for DeFi. But any extension runs in the same context as the page and can theoretically see wallet data. Attacks via malicious extensions are one of the fastest-growing vectors in 2025-2026.

How Drainer Extensions Work

An attacker publishes an extension in the Chrome Web Store or Edge Add-ons disguised as a useful tool: translator, currency converter, RPC manager, gas tracker. After installation, the extension requests permission read your data on all websites (standard for many extensions) and:

• Intercepts calls to the wallet (eth_requestAccounts, signTransaction).
• Swaps the recipient address at the moment of transaction signing.
• Asks to confirm a harmless transaction that actually gives approve for the entire token balance.

The user sees the familiar MetaMask interface and confirms — unaware that the data has been swapped on the fly.

Signs of a Suspicious Extension

Small developer, new extension. Less than 10,000 downloads, developer history of 2-3 months, reviews look forced (identical wording from different accounts).

Mismatch between functionality and permissions. A calculator asking for access to all websites — reason to think twice.

Description with poor grammar or suspicious promises. A good extension writes clearly, a bad one copies from a translator.

Basic Protection Measures

Separate browser for crypto. For example, Brave or Firefox only for MetaMask and DeFi, without other extensions. A browser for everyday internet — separate, with all work extensions.

Regular extension audit. Once a month, go through the list, remove what you haven't used in a while. Fewer extensions — smaller attack surface.

Hardware wallet. Trezor or Ledger instead of bare MetaMask. Even if a drainer intercepts the request, the signature is physically performed on the device — and you see the real recipient address on the screen.

Never sign a transaction blind. If an app asks you to sign something you don't understand — don't sign. Drainers often use permit or approve(unlimited) — wording that looks scary in MetaMask's spend window, but beginners skip it.

What to Do If Already Compromised

Urgently transfer all assets to a new, clean wallet — generated on a device without the compromised extension. Old approves won't cancel themselves, but assets will no longer be on the old address.