Briefing
A newly identified threat actor utilized a malicious Chrome browser extension, “Crypto Copilot,” to execute a stealthy, recurring theft against Solana-based decentralized exchange (DEX) users. The extension’s core function was to inject a hidden transfer instruction into legitimate Raydium swap transactions, siphoning a small percentage of the trade value without user knowledge. This novel, low-volume attack vector has proven highly effective at evading detection, accumulating an estimated total of over $1 million in stolen assets across numerous victims over 18 months, highlighting a critical blind spot in user-facing security.
Context
The prevailing attack surface for Web3 users has shifted from smart contract exploits to wallet-level compromises, specifically through social engineering and malicious software. This incident leverages the inherent trust users place in browser extensions and the common failure of wallet interfaces to display all granular transaction instructions. The risk was compounded by the Chrome Web Store’s inadequate moderation, allowing the malicious extension to remain active for over a year, establishing a long-term, low-profile drain mechanism.
Analysis
The attack compromised the client-side execution environment. The “Crypto Copilot” extension, marketed as a trading shortcut, was designed with obfuscated JavaScript to intercept and modify user-initiated swap transactions. Specifically, before the transaction was sent to the wallet for signing, the extension programmatically appended an additional, hidden transfer instruction to the transaction payload.
This instruction directed a small fee → a minimum of 0.0013 SOL or 0.05% of the swap value → to the attacker’s wallet. Because most wallet confirmation screens only summarize the primary swap action and not the full, low-level instruction set, the victim unknowingly signed a transaction that authorized the theft alongside their intended trade.
Parameters
- Total Siphoned Assets → Over $1,000,000; The estimated total loss accumulated from the recurring, small-percentage fee over the extension’s lifespan.
- Vulnerability Vector → Malicious Chrome Extension (Crypto Copilot); The specific software used to execute the client-side transaction modification.
- Theft Mechanism → Hidden Transaction Instruction Injection; The method of appending an unauthorized transfer instruction to a legitimate Solana swap.
- Recurring Fee Structure → 0.05% of Swap Value or 0.0013 SOL Minimum; The small, incremental amount siphoned from each successful transaction.
Outlook
Users must immediately revoke permissions for all non-essential or unverified browser extensions and treat any third-party wallet utility with extreme skepticism. The industry will likely establish new best practices requiring wallet providers to implement granular transaction decoding and “firewall” features that flag or block unexpected instructions within a transaction bundle. This incident establishes the “hidden instruction injection” as a critical new threat pattern, forcing a shift from only auditing smart contracts to also securing the user’s execution environment against supply chain compromises.
