GreedyBear's Crypto Heist: Russian Hackers, Firefox Extensions, and a Million-Dollar Crypto Theft

A Russian-linked group, GreedyBear, stole over $1 million in crypto by weaponizing Firefox extensions. Learn how they did it and how to stay safe!

Hold on to your hats, crypto enthusiasts! A Russian-linked cybercriminal group named GreedyBear has been wreaking havoc, pilfering over $1 million in cryptocurrency in just five weeks. Their weapon of choice? Weaponized Firefox extensions. Buckle up, because this is a wild ride.

GreedyBear's Extension Hollowing Tactic

GreedyBear didn't just stumble into this million-dollar heist. They strategically deployed 150 malicious Firefox extensions, primarily targeting English-speaking crypto users. Koi Security reports they nearly tripled their attack arsenal since April 2025. How did they do it?

They used a sneaky method called “Extension Hollowing.” GreedyBear uploads legitimate versions of popular crypto wallet extensions—think MetaMask, Exodus, Rabby Wallet, and TronLink—and then updates them with malicious code. This lets them bypass Firefox's security checks and stay hidden for ages. Crafty, right?

Once installed, these extensions swipe sensitive wallet credentials, giving GreedyBear access to drain crypto assets. They even fabricate positive reviews to trick users. Talk about a comprehensive con!

Beyond Firefox: A Multi-Pronged Attack

But wait, there's more! GreedyBear also distributed nearly 500 malicious Windows executables on Russian software platforms. These include credential stealers, ransomware, and trojans, often bundled with pirated software. And if that's not enough, they run dozens of phishing websites mimicking legitimate crypto services, snagging login credentials and siphoning funds.

Most of these attacks trace back to a single IP address—185.208.156.66—suggesting a centralized operation. This structured approach indicates a growing sophistication and operational scale.

Staying Safe in the Crypto Wild West

This campaign highlights the growing risks in the crypto world. As we rely more on browser extensions and software to manage digital assets, we become bigger targets. So, how do we stay safe?

• Verify Everything: Only download extensions and software from trusted sources.
• Enable Multi-Factor Authentication: Add an extra layer of security to your accounts.
• Regular Updates: Keep your applications updated to patch vulnerabilities.

The Browser Battle: What's Next?

This attack is a wake-up call for browser companies like Mozilla. They need to step up their game, improving how they check and monitor extensions, especially after installation. Extension Hollowing is a sneaky trick that needs to be addressed ASAP.

AI's Role in Cybercrime

Cybersecurity experts suggest that artificial intelligence tools are contributing to the speed and complexity of campaigns like GreedyBear's. AI likely enhances their ability to evade detection and rapidly iterate on new attack methods. As this operation evolves, analysts warn that similar campaigns may soon emerge on other major browsers, including Chrome and Edge.

Final Thoughts: A Crypto Caper

So, what’s the takeaway? The world of crypto is a bit like the Wild West, but with more lines of code and fewer tumbleweeds. Stay vigilant, double-check those extensions, and maybe keep your digital wallet a little closer. After all, a little paranoia never hurt anyone—especially when Russian hackers are on the prowl. Happy (and safe) trading, folks!