Today’s Field Note

While the timeline is busy counting the $3.1 billion in liquidated shorts, two credential-theft operations are quietly running. Socket flagged 40 malicious Firefox extensions (part of a 77-add-on cluster dubbed “Offside Wallet Theft Factory”) impersonating OKX, Rabby, and TronLink to exfiltrate wallet secrets directly from the browser. Separately, Rapid7 disclosed an SMS phishing campaign hitting 885,000 phone numbers, routing victims to counterfeit wallet-provider sites. Neither is exotic, and that is the point: rallies bring in distracted retail, and distracted retail signs anything. The extensions are the sharper risk because they steal keys from inside a wallet you already trust.

Today’s Move

  • Audit your Firefox extensions today. Remove any wallet add-on you did not install directly from the vendor’s official site, and treat OKX, Rabby, and TronLink lookalikes as compromised.
  • If you interacted with any suspect extension, assume the seed is burned. Generate a fresh wallet on a clean device and migrate funds now, do not wait.
  • Ignore any SMS pushing you to a “wallet verification” or “sync” page. Wallet providers do not text you links. Never type a seed phrase into a website, ever.
  • Bookmark your wallet’s real URL and use only that. Do not reach wallets via search results or messages during this rally window.
  • Move long-term holdings behind a hardware signer so a browser-level compromise cannot sign transactions unattended.

Resources

  • https://thehackernews.com/2026/08/40-malicious-firefox-extensions-pose-as.html
  • https://cointelegraph.com/news/cybersecurity-unveils-crypto-phishing-885000-phone-numbers?utm_source=rss_feed&utm_medium=rss_tag_hacks&utm_campaign=rss_partner_inbound
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.