🚨 Warning: Firefox Store Overrun by Crypto-Draining Fake Wallet Extensions (July 2025)

Firefox's extension marketplace is under siege—hackers are flooding it with malicious wallet clones designed to empty your crypto. Here's how to spot the fakes before they drain your assets.

The Fake Wallet Epidemic

Cybercriminals are exploiting Firefox's weaker vetting process compared to Chrome, pushing lookalike MetaMask, Phantom, and Ledger extensions. These clones mimic legitimate interfaces but siphon private keys the moment you enter them.

Why This Matters Now

With crypto markets nearing ATH again, scammers are capitalizing on bullish sentiment. A single fake extension could net attackers millions—because nothing says 'financial revolution' like old-school theft in a digital trench coat.

Protect Yourself

Always verify extension developer IDs, check reviews skeptically (bot farms inflate ratings), and never input seed phrases into browser extensions. Hardware wallet users: bridge interactions should happen only through official apps.

The irony? These scams thrive while regulators obsess over 'protecting investors' from legit DeFi protocols. Priorities, right?

A "cat and mouse game"

Mozilla pointed to a recent blog post reporting on its efforts to address the threat of crypto-stealing extensions, in which its Add-ons Operations Manager Andreas Wagner noted that the firm had uncovered “hundreds” of scam crypto wallets in recent years. “It’s a constant cat and mouse game,” Wagner said, as malware developers attempt to “work around our detection methods.”

Decrypt has reached out to Mozilla and will update this article should they respond.

To avoid being a victim of FoxyWallet or similar scams, it is suggested that users only download and install extensions from verified publishers, treat extensions as full software assets, use an extension allow list to restrict installation to pre-approved, validated extensions only, and implement continuous monitoring, not just one-time scanning.

Daily Debrief Newsletter