Suspicious browser extension installed
You installed a browser extension that may be reading your crypto wallet data or injecting malicious code.
Time-sensitive — act within the next 10 minutes
Follow the steps below in order. Stay calm and be thorough.
Recovery steps
Remove the extension immediately
Go to your browser extensions page and remove the suspicious extension right now.
Move funds to a new wallet
If the extension had access to your browser, it may have captured your wallet data. Create a new wallet and move funds.
Check for other suspicious extensions
Review all your browser extensions. Remove anything you don't recognize or no longer use.
Clear browser data
Clear cookies, cache, and stored passwords for crypto-related sites.
Scan for malware
Run a full system malware scan on your computer.
Change relevant passwords
Update passwords for any crypto services you accessed while the extension was installed.
Going forward: minimize extensions
Only install extensions from verified publishers. Keep the number of extensions minimal, especially in the browser you use for crypto.
Quick checklist (printable)
Related tools
This tool provides educational information only. It is not financial, tax, or legal advice. Always consult qualified professionals for decisions about your specific situation. Results are based on general patterns and may not reflect your circumstances.