At least 40 Firefox wallet extensions have been confirmed as malicious, according to a report by Decrypt. The extensions impersonate established crypto wallet brands including OKX, Rabby and TronLink, with the apparent aim of collecting users’ recovery phrases. Anyone who enters a recovery phrase into one of these extensions could expose access credentials for the associated wallet. The findings are particularly relevant to users of TronLink and the TRON ecosystem, linked to the TRX asset. The report highlights the risks posed by unofficial browser extensions that resemble legitimate wallet tools. Recovery phrases are highly sensitive credentials: they can provide control over wallet funds, making requests to enter them a key warning sign for users reviewing wallet software. Decrypt published its report on August 25, 2026.