Browser Extension Wallet Drainers: How to Audit and Remove Risky Add-ons in Chrome and Edge

Your browser is probably the most sensitive piece of software you own. It holds your saved logins, your session cookies, your autofill data, and, for anyone who uses crypto, the interface to your wallet. Yet most people install browser extensions the way they accept cookies: quickly, without reading, and without ever looking back. That habit is exactly what criminals are counting on.

Browser extension wallet drainers are one of the quieter threats in the current landscape. Instead of breaking into a platform, they sit inside your browser, wait for you to visit a crypto exchange or DeFi site, and then quietly request approvals or swap your tokens. Security firms have repeatedly documented malicious extensions that masquerade as popular wallets, password managers, coupon finders, or productivity tools, some of which were published to the official Chrome Web Store and Edge Add-ons catalogs before being pulled. Each one needed only a few hundred installs to do real damage.

This article is a practical guide to finding and removing risky add-ons in Chrome and Edge. We will cover how drainers actually work, a step-by-step audit you can finish in about thirty minutes, how to read the permissions that should worry you, how to remove an extension cleanly (including the parts people forget), and how to build a habit that keeps the problem from coming back. If you want to remove malicious browser extensions with confidence, you need to know what to look for, not just where the uninstall button lives.

Key Takeaways

• A wallet drainer is an extension (or injected script) that exploits broad site-access permissions to trick you into signing transactions that move your funds.
• Audit every extension at least once a quarter. Start with the ones that request "Read and change all your data on all websites."
• Permissions matter more than star ratings. A 4.8-star extension with unnecessary access can be more dangerous than an unrated one with narrow permissions.
• Removing an extension is not the same as cleaning up. Revoke token approvals, clear site data, and rotate any credentials it could have seen.
• Keep only the extensions you use weekly. Every extra one is attack surface you are paying for with your own risk.
• Use a separate browser profile for crypto and banking so that a compromised general-purpose profile cannot reach your high-value sessions.

What Is a Browser Extension Wallet Drainer?

A wallet drainer is malicious code designed to take cryptocurrency or tokens from a victim's wallet without a clear, understandable consent step. In the browser context, the drainer usually lives in an extension and interacts with the wallet your browser is connected to, such as MetaMask, Phantom, or a similar Web3 wallet.

The most common mechanics look like this:

• Approval hijacking: The extension prompts you, or silently triggers, a token approval that grants an attacker's contract permission to spend your tokens. The approval is often unlimited.
• Signature phishing: You are asked to sign a message that looks harmless ("verify your account") but is actually a transaction authorization.
• Clipboard and address swapping: The extension replaces a copied wallet address with the attacker's address just before you paste and send.
• Session and seed theft: Extensions that can read page content may capture seed phrases typed into fake recovery screens.

The reason extensions are so effective is structural. A browser extension often has more privileges than an ordinary web page. It can read and modify what you see, intercept network requests, and inject scripts into pages you visit. Those capabilities are necessary for legitimate ad blockers and password managers. They are also exactly what a drainer needs.

How Much Risk Are You Actually Carrying?

Before you start removing things, it helps to understand the scale of the problem on your own machine. Most people underestimate how many extensions they have accumulated.

Consider a realistic example. Say you have been using Chrome for three years. You installed a PDF converter for a single project, a coupon finder during a holiday sale, a tab manager you tried once, two "AI writing assistants," a password manager, and a wallet. Maybe you also have a color picker, a grammar checker, and an ad blocker. That is roughly twelve extensions. Now suppose three of them have "Read and change all your data on all websites" permission, and you have not thought about any of them since installing.

Those three extensions each have the technical ability to see every page you load, including your exchange login page and your wallet dashboard. You are trusting every one of them, every day, with no review. A single compromised update, a sold-off extension (a common pattern where a legitimate developer sells the listing to a new owner who then pushes malicious code), or a clever impersonator can turn one of them into a drainer.

The point of an audit is to shrink that trusted surface from "everything I ever installed" to "the handful I actively need and can justify."

How to Audit Your Extensions in Chrome and Edge

The audit below takes about thirty minutes for a typical profile. Do it in a quiet moment, not while you are mid-transaction.

Step 1: Export your current extension list

1. Open Chrome and type chrome://extensions in the address bar, then press Enter.
2. In Edge, type edge://extensions instead.
3. Turn on Developer mode (toggle in the top-right in Chrome, or the left sidebar in Edge). This reveals extra details, including the extension ID and the "Inspect views" links.
4. Take a screenshot or write down every extension listed, including the ones you think you disabled. Disabled extensions can still be re-enabled by a malicious update, so they still count.

Step 2: Check each extension's permissions

1. Click Details on each extension.
2. Scroll to the Permissions section and the Site access setting.
3. Record three things: whether it has access to "all sites," what specific permissions it lists (such as tabs, webRequest, scripting, clipboardRead, or nativeMessaging), and whether "Allow in incognito" is enabled.
4. Note the Source. Extensions installed from outside the official store, or sideloaded through "Developer mode → Load unpacked," deserve extra suspicion.

Step 3: Verify the publisher and listing history

1. Click the extension's name to open its store listing (Chrome Web Store or Microsoft Edge Add-ons).
2. Check the developer name and whether it matches the brand. Look for a verified publisher badge where available.
3. Read the Last updated date and the recent reviews. A sudden surge of reviews after a long quiet period, or complaints about new popups and redirects, are warning signs.
4. Check whether the extension has changed hands. A listing whose description or developer changed recently deserves scrutiny.

Step 4: Score each extension

Use a simple three-question test for every item on your list:

• Do I use it at least weekly? If not, it goes.
• Can I name the exact reason it needs its current permissions? If the answer is "I don't know," treat it as a risk.
• Is it from a publisher I recognize and trust? If not, replace it with a known alternative or remove it.

Anything that fails two or more questions is a removal candidate.

Reading Permissions: What Should Actually Worry You

Not every broad permission is malicious. A password manager legitimately needs to read login fields on every site. The question is whether the permission matches the job.

Permission or setting	What it allows	Typical legitimate use	Risk level for a wallet user
Read and change data on all sites	See and modify every page you load	Password managers, some ad blockers	High
webRequest / declarativeNetRequest	Inspect or block network traffic	Ad blockers, privacy tools	High
clipboardRead / clipboardWrite	Read or replace what you copy	Clipboard managers	High (address swapping)
nativeMessaging	Talk to programs installed on your PC	Password manager desktop bridges	Medium to high
tabs or history	See your open tabs and browsing history	Tab managers, productivity tools	Medium
Access to specific sites only	Limited to listed domains	Most well-designed tools	Low

A useful rule: if an extension's job is "make shopping cheaper" or "convert PDFs," it has no reason to hold all-site access, clipboard access, or network inspection. Those requests are a mismatch, and mismatches are how you spot trouble.

Removing a Risky Extension Properly

Uninstalling is the obvious step, but a complete cleanup has more parts. Many people remove the extension and then keep the damage active without realizing it.

Step-by-step removal

1. Disable the extension first. In chrome://extensions or edge://extensions, switch the toggle off. This stops it from acting while you clean up.
2. Remove it. Click Remove and confirm.
3. Check for leftover files. On Windows, look in %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions (or the Edge equivalent under %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions). Extensions are normally cleaned up on uninstall, but if a folder with that extension ID remains after a restart, note it and recheck after the next update cycle.
4. Clear site data for affected domains. Go to Settings → Privacy and security → Site settings → View permissions and data stored across sites. Remove data for exchanges, wallet dashboards, and banking sites you visited while the extension was active.
5. Review installed browser-level permissions. In Site settings, check Notifications, Pop-ups, and Clipboard for sites you do not recognize and reset them.

The steps people forget: revoke token approvals

If you used a crypto wallet while a suspicious extension was active, uninstalling it does not revoke anything. Token approvals live on the blockchain, not in your browser.

1. Open a reputable approval-checker tool such as Revo

   Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse.