# SCAM Alert – Fake OKX Wallet Extension on Firefox Stole My Funds

**URL:** <https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359>\
**Category:** Add-ons\
**Tags:** issue\
**Created:** [June 25, 2025, 7:51pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359 "2025-06-25T19:51:16Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Quinn\_hao](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/quinn_hao/32/73799_2.png) [@Quinn\_hao](https://discourse.mozilla.org/u/Quinn_hao)\
**Post date:** [June 25, 2025, 7:51pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/1 "2025-06-25T19:51:16Z")

</div>

Hey everyone,

Just a heads-up: I recently downloaded an **“OKX Wallet” extension from the Firefox Add-ons Store** , thinking it was legit. It had **high ratings and good reviews** , but that was all fake — most likely **pushed up by bots or fake users**.

**I imported my seed phrase into the extension** , thinking it was safe. **Within minutes, all my USDC (over $4,000) was drained from my wallet.**  
This is a **scam extension** , impersonating the real OKX wallet. It’s designed purely to steal your crypto.

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [June 25, 2025, 8:49pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/2 "2025-06-25T20:49:07Z")

</div>

Do you mean this one?

> **[OKX Wallet – Get this Extension for 🦊 Firefox (en-US)](https://addons.mozilla.org/en-US/firefox/addon/okx-add/)**
>
> Download OKX Wallet for Firefox. OKX Wallet is a universal crypto wallet available on multiple platforms, including app, web, and extension

It has 13 Users and 279 Reviews, that’s a HUGE red flag!  
Also, it was released 11 days ago by a user registered also 11 days ago - another big red flag.

I wish the addons store had some automatic threat level system, instead of the generic warning message that people learn to ignore (because basically all extensions has it) ☹ .

There was a an article published here recently about this topic:

> **[Crypto wallet scams — thwarting a new threat – Mozilla Add-ons Community Blog](https://blog.mozilla.org/addons/2025/05/30/crypto-wallet-scams-thwarting-a-new-threat/)**
>
> According to the FBI’s 2024 Internet Crime Report, crypto-related scams accounted for nearly $16.6 billion in victim losses last year across the globe ($9.3 billion in the United States alone ...

---

<div class="post-metadata">

**Author:** ![Quinn\_hao](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/quinn_hao/32/73799_2.png) [@Quinn\_hao](https://discourse.mozilla.org/u/Quinn_hao)\
**Post date:** [June 26, 2025, 10:30am UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/3 "2025-06-26T10:30:51Z")

</div>

Yes, this is exactly the extension. Many people have already been scammed one after another. In just one day, I saw many comments from people who had fallen for it, which shows how absurd the community management is. I personally migrated from the Brave browser, and when I switched wallets, I ended up using a fake one. I’m extremely disappointed with the management of the Firefox browser.

---

<div class="post-metadata">

**Author:** ![Quinn\_hao](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/quinn_hao/32/73799_2.png) [@Quinn\_hao](https://discourse.mozilla.org/u/Quinn_hao)\
**Post date:** [June 26, 2025, 10:40am UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/4 "2025-06-26T10:40:49Z")

</div>

I have submitted multiple reports about the scam, but the official team has yet to respond. When I was scammed, there were only 2 one-star reviews. As of now, there are already 42 one-star reviews, which means at least 40 more users have been scammed. So what exactly are the Firefox extension platform managers doing? Why is it that despite my repeated and urgent feedback, no one has taken action to remove this extension? As a result, many more users have fallen victim to the scam.

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [June 26, 2025, 11:49am UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/5 "2025-06-26T11:49:59Z")

</div>

I was in a hurry and forgot to mention the most important link - for Requesting an addon block (ban)

> **[Add-ons Blocking Process](https://extensionworkshop.com/documentation/publish/add-ons-blocking-process/#requesting-a-block)**
>
> Get help creating & publishing Firefox extensions.

This goes directly to devs team, so it’s meant to be used only when you are 100% sure something is bad/dangerous.

I’ve only briefly checked the source code, but I couldn’t find anything obviously malicious (but most of the code is minified, maybe even obfuscated, so I can’t really analyze it well).

Also there is a lot of code, one file has 2MB of minified JS code, that’s ~2 million characters!

But there is a one piece of code with Russian comments that sends user IP address to some suspicious looking address:

 ![image](https://us1.discourse-cdn.com/flex001/uploads/mozilla/original/3X/5/2/5235f342d1c8062233c1824939595b6ddd66d97f.png)

---

<div class="post-metadata">

**Author:** ![dotproto](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/dotproto/32/62957_2.png) [@dotproto](https://discourse.mozilla.org/u/dotproto)\
**Post date:** [June 26, 2025, 10:05pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/6 "2025-06-26T22:05:56Z")

</div>

> [@Quinn\_hao](#):
>
> Why is it that despite my repeated and urgent feedback, no one has taken action to remove this extension? As a result, many more users have fallen victim to the scam.

The add-on @juraj.masiar linked [in his first comment](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/2) is no longer available on AMO.

---

<div class="post-metadata">

**Author:** ![Quinn\_hao](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/quinn_hao/32/73799_2.png) [@Quinn\_hao](https://discourse.mozilla.org/u/Quinn_hao)\
**Post date:** [June 27, 2025, 7:13am UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/7 "2025-06-27T07:13:21Z")

</div>

“Oh my god, this plugin has been put back online again. Is there any way to fix this at the source? Another malicious actor has appeared.”

 ![image](https://us1.discourse-cdn.com/flex001/uploads/mozilla/original/3X/7/1/71ef4eb88363e047376cbfd2bc9a0ab103ad35fc.png)

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [June 27, 2025, 11:04am UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/8 "2025-06-27T11:04:11Z")

</div>

Why post a screenshot and not a link? 🙃

> **[OKX Wallet – Get this Extension for 🦊 Firefox (en-US)](https://addons.mozilla.org/en-US/firefox/addon/okx-addons/)**
>
> Download OKX Wallet for Firefox. OKX Wallet is a universal crypto wallet available on multiple platforms, including app, web, and extension

But yeah, the addon is back under new URL…  
Someone should ban the account since it’s seems to be the same one.

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [July 7, 2025, 7:59pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/9 "2025-07-07T19:59:56Z")

</div>

OMG, yet another clone…

> **[OKX Wallet – Get this Extension for 🦊 Firefox (en-US)](https://addons.mozilla.org/en-US/firefox/addon/okx-wallet-addon/)**
>
> Download OKX Wallet for Firefox. OKX Wallet is a universal crypto wallet available on multiple platforms, including app, web, and extension

I guess Firefox team will have to implement some new way to identify clones and block them pro-actively, because this could continue forever.

---

<div class="post-metadata">

**Author:** ![dotproto](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/dotproto/32/62957_2.png) [@dotproto](https://discourse.mozilla.org/u/dotproto)\
**Post date:** [July 9, 2025, 11:18pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/10 "2025-07-09T23:18:19Z")

</div>

Unfortunately these folks are quite persistent. Thanks for flagging these listings!

---

<div class="post-metadata">

**Author:** ![juraj.masiar](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/juraj.masiar/32/30587_2.png) [@juraj.masiar](https://discourse.mozilla.org/u/juraj.masiar)\
**Post date:** [July 10, 2025, 8:06am UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/11 "2025-07-10T08:06:19Z")

</div>

Well, I’ve checked again and there is already a new one, released 10h ago 😃 .  
This time by a new user that has 4 other addons:

> **[User Profile for Crypto Wallet – Add-ons for Firefox (en-US)](https://addons.mozilla.org/en-US/firefox/user/19064207/)**
>
> The profile of Crypto Wallet, Firefox extension author. Find other extensions by Crypto Wallet, including average ratings, tenure, and the option to report issues.

I have a feeling, with modern AI we are entering new era of malware…

---

<div class="post-metadata">

**Author:** ![LuureAmet](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/luureamet/32/77602_2.png) [@LuureAmet](https://discourse.mozilla.org/u/LuureAmet)\
**Post date:** [June 1, 2026, 4:34pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/12 "2026-06-01T16:34:18Z")

</div>

But is this Github one good one:

> **[GitHub - cbk96962/okx-wallet-firefox: OKX Wallet Extension for Firefox: The Complete...](https://github.com/cbk96962/okx-wallet-firefox)**
>
> OKX Wallet Extension for Firefox: The Complete Guide to Setup, Features & Why It Beats the Rest

The takeover of strategic ruling in many fronts of Firefox, is by desing, someones inside, do it in purpose.

---

<div class="post-metadata">

**Author:** ![mozchris](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/mozchris/32/76781_2.png) [@mozchris](https://discourse.mozilla.org/u/mozchris)\
**Post date:** [June 2, 2026, 2:00pm UTC](https://discourse.mozilla.org/t/scam-alert-fake-okx-wallet-extension-on-firefox-stole-my-funds/144359/13 "2026-06-02T14:00:15Z")

</div>

> [@LuureAmet](#):
>
> rategic ruling in many fronts of Firefox, is by desing, someones inside, do it in purpose.

What do you mean there is someone inside Firefox, who is doing what on purpose?

We are taking all the necessary measures to identify and remove malicious add-ons. If you have one to report, please do it 🙂