A malicious Chrome extension posing as a Solana trading assistant has quietly siphoned fees from user swaps for months, exploiting the way wallet interfaces bundle transactions.

The extension, named Crypto Copilot, had been available on the Chrome Web Store since June as a convenience tool for traders on the Solana DEX Raydium. It injected a hidden second instruction into every Raydium swap, sending either 0.0013 SOL or 0.05% of the trade value to an attacker-controlled wallet.

The exploit worked because wallet interfaces typically present multiple instructions as a single atomic transaction. Users unknowingly signed off on both the intended swap and the hidden transfer—similar to pressing “confirm” on an order that secretly charges for extra items without notice.

Cybersecurity firm Socket, which flagged the extension earlier this week, noted that while on-chain data suggests limited adoption so far, the mechanism could scale: trades above 2.6 SOL trigger the 0.05% fee, meaning a 100 SOL swap would lose 0.05 SOL (around $10 at current prices).

Further signs point to a rushed setup. The extension’s main domain, cryptocopilot.app, is parked on GoDaddy, and the backend dashboard at crypto-coplilot-dashboard.vercel.app (with a noticeable misspelling) returns a blank page despite collecting wallet metadata.

Socket has submitted a formal takedown request to Google, though the extension was still live at the time of reporting. Users are advised to avoid closed-source extensions requesting signing privileges and to move assets to new wallets if they interacted with Crypto Copilot.