Browser Extensions Can Help Scammers Steal Your Bitcoin: Casa CEO

Browser add-ons can steal your crypto and identifying information, said Casa's Jeremy Welch

AccessTimeIconSep 15, 2019 at 12:30 p.m. UTC
Updated Sep 13, 2021 at 11:27 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Browser extensions can help scammers steal your crypto Casa CEO Jeremy Welch warned the audience at the Baltic Honeybadger conference in Riga this weekend.

“Browser extensions impose major risks, and these risks haven't been discussed until this point,” Welch said.

Extensions can gather a wealth of data, which can be leaked, stolen, and used by scammers. One example is browser history, which can expose users’ online habits, including crypto-related site visits.

“Make sure you don’t expose your bitcoin addresses anywhere,” Welch warned.

Another thing to keep in mind is that some extensions capture users’ KYC information and can leak it to scammers. The only major multisig system that requires KYC at the moment is the one supplied by Unchained Capital, Welch said. He warns against commonly-used consumer software that gathers identity data.

As an example, Welch demonstrated how an extension providing wallpapers with inspiring quotes or other content was actually stealing data as you filled in KYC forms. The software also extracts graphical data, like a photo of your driver’s license, which is captured as a code and then easily decoded, providing an actual picture of your ID document to hackers.

Quiet data thefts

All this is happening on the background, without the user noticing.

“You got a nice background here and you don’t realize that your browser is actually dumping data,” Welch said.

The same wallpaper extension can alter a receiving address when you’re trying to send your crypto to somebody else (or to yourself), sending it to a scammer’s wallet instead. The ubiquity and popularity of browser extensions makes the situation quite dangerous, Welch noted:

“It’s terrifying, right? We all are using browser extensions all the time.”

Even if a user is very careful and selective in what they’re using, the software can be upgraded and get new, unsafe features without a consumer noticing, Welch added.

Welch noted that many well-known applications request enough permissions to gather personal data, including password managers, text editing app Grammarly, Joule extension for in-browser Lighting transactions, Casa's own Sats extension and the Lolli bitcoin-earning extension.

The solution? There is no easy one, Welch says. Developers can only keep building better tools that will make users’ experience safer and better.

“We all need to be discussing this issues more, because we’re not even in the phase yet when real attacks will be taking place.”

Welch added that Casa is planning to publish more security research soon and encouraged bitcoin developers and entrepreneurs to approach the company and share their concerns and ideas on how to address security issues.

Image of Jeremy Welch by Anna Baydakova for CoinDesk

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.