The post Chrome Extension Caught Skimming Solana Trades appeared on BitcoinEthereumNews.com. Crime A Google Chrome browser extension advertised as a shortcut for trading Solana directly from the X (Twitter) feed has been identified as malware, quietly siphoning funds from every transaction executed through it. Key Takeaways A malicious Chrome extension added hidden fees to every Solana swap and routed them to an attacker. The plug-in has been live since June and marketed itself as a trading shortcut for X users. Chrome extensions remain a high-risk environment for crypto transactions due to broad permissions and limited visibility into instructions users sign.  Cybersecurity firm Socket uncovered the scheme and reported that the extension — titled Crypto Copilot — inserts a hidden fee into each swap. Instead of draining entire wallets in a single hit (the hallmark of most Solana-focused malware), the attacker opted for a slower and less noticeable method: taking a small cut from every trade. How the theft is carried out Socket’s review of the code revealed that Crypto Copilot routes swaps through Raydium, a popular Solana DEX. But before users approve the transaction, the extension adds an extra instruction that funnels part of the trade — a minimum of 0.0013 SOL or roughly 0.05% of the swap value — to the attacker. The extension relies on the fact that most users only review the high-level summary shown in the wallet approval window. Because both transfers execute in the same transaction, there is no visible indication that a second transfer is taking place. Installed since June — barely noticed until now Crypto Copilot has been available on the Chrome Web Store since June 18, 2024. According to the storefront listing, it has 15 active users, though the exact number affected by unauthorized transfers is unclear. The extension marketed itself as a productivity upgrade — enabling Solana swaps without leaving the X… The post Chrome Extension Caught Skimming Solana Trades appeared on BitcoinEthereumNews.com. Crime A Google Chrome browser extension advertised as a shortcut for trading Solana directly from the X (Twitter) feed has been identified as malware, quietly siphoning funds from every transaction executed through it. Key Takeaways A malicious Chrome extension added hidden fees to every Solana swap and routed them to an attacker. The plug-in has been live since June and marketed itself as a trading shortcut for X users. Chrome extensions remain a high-risk environment for crypto transactions due to broad permissions and limited visibility into instructions users sign.  Cybersecurity firm Socket uncovered the scheme and reported that the extension — titled Crypto Copilot — inserts a hidden fee into each swap. Instead of draining entire wallets in a single hit (the hallmark of most Solana-focused malware), the attacker opted for a slower and less noticeable method: taking a small cut from every trade. How the theft is carried out Socket’s review of the code revealed that Crypto Copilot routes swaps through Raydium, a popular Solana DEX. But before users approve the transaction, the extension adds an extra instruction that funnels part of the trade — a minimum of 0.0013 SOL or roughly 0.05% of the swap value — to the attacker. The extension relies on the fact that most users only review the high-level summary shown in the wallet approval window. Because both transfers execute in the same transaction, there is no visible indication that a second transfer is taking place. Installed since June — barely noticed until now Crypto Copilot has been available on the Chrome Web Store since June 18, 2024. According to the storefront listing, it has 15 active users, though the exact number affected by unauthorized transfers is unclear. The extension marketed itself as a productivity upgrade — enabling Solana swaps without leaving the X…