Crypto Copilot Exposed: Chrome Extension Hijacking Solana Transfers
Cybersecurity researchers have discovered a Chrome web extension that is dangerous because it can secretly initiate Solana transfers and transfer funds to a cryptocurrency wallet controlled by the attacker.
The extension is called Crypto Copilot, and it was first published by a user named “sjclark76” on May 7, 2024. The extension has been installed 12 times and is available for download at the time of writing.
How the Attack Works?
According to a report by Socket’s threat research team, “The extension behind the interface adds an extra transfer to every Solana swap. This transfers at least 0.0013 SOL, or 0.05% of the trade amount, to a fixed, attacker’s wallet.”
In fact, the extension’s code is a bit complicated to understand. It could also be misused, say, a user makes a swap on Raydium and replaces the same signed transaction with an unknown SOL transfer. Incidentally, Raydium itself is a decentralized exchange and automated market maker that runs on the Solana blockchain.
Why Users Don’t Realize They’re Being Scammed
It works by adding a hidden System Program transfer util method to every swap before requesting the user’s signature, and sending the fee to a hard-coded wallet embedded in the code. Fees are calculated based on the amount traded, with 2.6 SOL and 0.05% of the swap amount charged for trades with a minimum of 0.0013 SOL and more than 2.6 SOL. To avoid detection, the abuse is masked using techniques such as minification and variable renaming
The most interesting aspect of this attack is that users are completely unaware of the hidden platform fees. Only the swap details are visible on the interface, and everything else is hidden. Furthermore, Crypto Copilot relies on genuine services like DexScreener and Helius RPC to establish its trustworthiness.
“Because these transfers are silently added and go to someone’s personal wallet instead of the protocol treasury, most users are unaware of this unless they carefully read every instruction before signing. According to Socket’s threat research team, the entire infrastructure appears to have been designed solely to appear genuine to the Chrome Web Store and steal fees in the background.
Frequently Asked Questions (FAQs)
Crypto Copilot appears to be a handy Chrome extension for tracking crypto and swapping tokens, but it’s actually a trickster. Behind the scenes, it adds hidden Solana transfers to your transactions and transfers your funds directly to the scammer’s wallet.
Just before your swap is approved, the extension inserts an extra System Program transfer. This small step sends a secret fee, as little as 0.0013 SOL, sometimes as much as 0.05% of your trade, into the hacker’s hands.
No. The interface only shows you the general swap details. Unless you look at each transaction instruction yourself, you’ll never see the extra transfer.
It connects to genuine services like DexScreener and Helius RPC, so it appears genuine. This way, it tricks people into thinking it’s safe.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!