My question is- do you know of any way I can find a log of the extension in question accessing data on my desktop to have proof this happened as I suspect?

System.storage - Gives your extension access to the API. System.display - Gives your extension access to the API. And I also know that the below also exist but were not granted to these extensions in question.ĭesktopCapture 0Gives your extension access to the sktopCapture API.ĭocumentScan -Gives your extension access to the chrome.documentScan API.įileBrowserHandler - gives your extension access to the chrome.fileBrowserHandler API.įileSystemProvider - Gives your extension access to the chrome.fileSystemProvider API. I know chrome extensions have certain permissions granted I could see in developer mode under Extensions> inspect background page > Application. So my question: Either GeroWallet or Phantom Wallet apps have accessed data on my mac desktop in some way. No, this was not due to a rogue smart contract that zapped my wallet (because that would not explain how more than 1 wallet got hacked) and no, it was not due to some keylogger or other malware (have done many scans from several software, all negative). No, I was never phished nor entered my secret keys online ever in any way- I have never done this and would never do this. This has been here for months and there has not been any issue prior to this, and the fact that this happened the day after I installed 2 new extensions points to this hypothesis. The data in question was my secret keys stored in a text file on my Mac desktop. No, these were not fraudulent extensions with whom I got phished, but these were the original proper extensions I have verified.Īnd I did not fund these 2 new wallets, it is my other unrelated wallets that got hacked (Exodus, Metamask) and I believe it is because there is likely a way a Chrome extension and therefore developer or other affiliated person can access personal data. The day before the hack, the only thing thing I did was install 2 wallet extensions on my Chrome browser. How have I narrowed it down to this as the attack vector?

Last Thursday, I suffered a major 70k worth of crypto hack of 2 personal self-custody wallets of mine and after much analysis, I have determined that it was due to a chrome extension accessing personal data on my macbook desktop (and reading secret keys of said wallets which was stored in a text file on the desktop). This is a question for those familiar with chrome extensions and how data exploits happen via their permissions.

Best google chrome hack extensions