A old friend lost 0.5BTC because of a browser extension

[NotATether]

If you have "enough" bitcoin (whatever that is to you), having some type of cold storage is key.  Whether it is a computer that never is online or a hardware wallet, just do it.  A Chromebook isn't expensive, put electrum or something on it and never go online with it. 

Many of these programs come with AppImages too. So you can just download one and make it executable and just run it.

I know for one thing that there are Bitcoin and Monero wallets like that. Coins like Ethereum less so because of "web3" and their insistence of you storing your crypto on either a browser extension, mobile app (yuck!) or hardware wallet.

[MidNite36]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

Exodus could not even be the bad wallet here but his own stupid mistake, if this Bitcoin was in a hardware wallet it could still be here. No Bitcoin is safe on your PC, even if they are sitting in the wallet for years one silly mistake can claim it all.

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

0.5 Bitcoin is half a thousand American dollars, you mean to tell me that your friend doesn't have the money to buy $200 dollar hardware wallet. The $200 is even an estimation, most often high end hardware wallet are $180 and low as $70, so that amount is too high. Let's even say the person have a phone, why not use phone only to keep the Bitcoin or you want to tell me he doesn't know much about after owing 0.5 Bitcoin, I'm sad and angry on his behalf to be honest.

In case people don't know about extension, there are some extension that can read your copy and paste, there are some that can even read everything on your computer page anytime you are interacting with another extension. So, when you copy a sensitive thing on your keyboard, it possible the extension was able to copy the private keys or modified something on his laptop unaware, all this can make your Bitcoin to disappear over a night.

Some people are like this normally, they have thousands of dollars with them but they can't buy small things out of the money to benefit themselves, I am very sure that the person OP is talking about is a very stingy person who worship money that life itself, there are unfortunately many people like this.

I was shocked the day I found out that a close relative is worth more than 100k in dollars, I argued with my sibling, because the way he looks and that of his age there is no point keeping money and avoiding to spend it, even on himself, until one day he was sick and everyone who running around to gather money for the hospital bill, I immediately invalidated my siblings mindset that how can a man be dying and not use his money to safe himself, then the money was not enough and this relative added the rest amount, his wife got mad and shouted on him for keeping money and not want to spend, she exposed him on that day, we all took our money back and his money was used to settle the bills, I can't write the whole story here but on that day onward I started to believe that some people are slaves to the money they make.

[The Cryptovator]

The amount he lost is a big amount. Who has around $60K in his wallet? I'm just wondering why he hasn't bought a hardware wallet. I don't store any funds in a web wallet or software wallet, even if it's more than a thousand dollars. Comparing $60K to a hardware wallet, which just costs a couple of dollars, but it would save all of his money. Sorry to hear your friend lost his funds and didn't hear what you said. I really don't compromise with my fund's security at all, because if I can't afford to buy a hardware wallet, then I have to afford lost funds.

However, it has gone and will never be recovered. But we can take a lesson from here and apply it to us. I don't trust even a centralised exchange. I don't store funds there since I have multiple hardware wallets. After trading, just move funds into the hardware wallet, and whenever you need to sell, then move it again to the exchange. I'm really not a fan of installing any extension to my browser. Right now MetaMask is my only extension; there is nothing else there.

[notocactus]

The mistake he made was storing half of one Bitcoin in Exodus wallet, and I could have fought for him that he is a very careful type, the BTC was moved not very long ago and it is been sitting in his wallet for few years, he haven't tell this to his partner because they have planned to buy a house with the money.

Exodus wallet is not a good wallet. Let's check why.

https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=Exodus
From Desktop to mobile application store, the wallet software is close source as it is shown as "No Source" in the reviews.

The amount he lost is a big amount. Who has around $60K in his wallet? I'm just wondering why he hasn't bought a hardware wallet. I don't store any funds in a web wallet or software wallet, even if it's more than a thousand dollars. Comparing $60K to a hardware wallet, which just costs a couple of dollars, but it would save all of his money.

$60,000 is too much for a hot wallet and I agree with you on this. With $60,000 fund, it is important to spend some hundreds of dollars for a hardware wallet and store bitcoin securely.

Choose an open-source hardware wallets, and avoid close-source hardware wallets.
[LIST] Open Source Hardware Wallets
[GUIDE] How to buy a Hardware Wallet the right way

[beveryu778]

I have no prior experience using Exodus wallet because I have never used it before. Bitcoin is a very valuable asset so it must be taken care of. Your friend did not take care of the Bitcoin due to which such an incident happened to him. For a large Bitcoin holding, you must use a secure wallet that will always keep the Bitcoin safe. For this, I should use Electrum wallet as a software wallet and there are several hardware wallets. If you do not take care of Bitcoin, Bitcoin will not take care of you. And once you lose Bitcoin, it is never possible to get it back.

[peter0425]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

Mind sharing what this extension was? So we could all also avoid it. Maybe it was a replica of another legit extension he was trying to download.

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

Exodus is actually a pretty decent wallet. I have heard great reviews and only very few bad ones. But if you are not careful yourself, the wallet can only do so much to protect your coins. Remember to double check what you are downloading and if possible do not use the devices where you have bitcoin in to download links from the internet.

[Cricktor]

It's my impression that often the same mistakes are made, be it out of ignorance, no security knowledge or whatever else makes people do risky setups.

This isn't a complete list and isn't ordered by severity:

• Avoid Windows as the host OS for your wallet(s) and crypto stuff.
  It's has (still) major market share and is therefore commonly the most targeted OS by malware.
• Avoid your daily driver device for your wallet(s) and crypto stuff.
  You don't want to put your coins at risk on the device where you do all your daily internet shit with. You likely know yourself what I'm talking about.
• Too much value in a hot software wallet. Don't need to say more, you're simply asking for trouble and desaster.
  Hot wallets should only contain amounts you can afford to loose. YMMV.
• Avoid closed-source wallets.
  You can't easily put those under scrutiny compared to open-source wallets. Bugs and security issues usually fly under the radar for closed-source stuff.
• Store your mnemonic recovery words strictly offline and on analog storage media like paper and stamped metal for hazard resistance. No digital pictures, screenshots or files on online devices of your recovery words or similar valuable secrets.
• There's usually no reason at all to expose your recovery words on an online website, especially when you're asked by another party to do so (this is a big red flag and usually a scam or trick to part you of your coins).
• You can still make mistakes with a hardware wallet, if you're not careful. Always and in every single case carefully inspect ALL details of a transaction BEFORE you sign it with your hardware wallet. Your hardware wallet should have an own and independant display to check and verify EVERY detail of a transaction BEFORE you finally sign it. Make this a habit without exceptions.
• Personally, I avoid my mobile phone for wallets larger than some little pocket money values.
  Mobile phones are easy to loose, could easily be stolen and you basically have no chance to assess the security of the device. Not to mention how much internet shit people do on a daily base with their mobile phones.
• NOT checking and verifying that your wallet software or hardware wallet firmware downloads (or similar files) are genuine.
• Using questionable browser extensions and browser wallets.
  Check the reputation of a browser extension with great scrutiny. Why do you need a browser extension for your crypto stuff anyway?
  Browsers are very complex software behemoths and commonly your primary software that's heavily exposed to the internet's evil. They are full of bugs and quite a target. I find the idea of a browser wallet a very risky approach.

I've surely missed something, above is just what quickly got off the top of my head. Feel free to add more to it.

[Abu-Naim]

I feel sorry for your friend, I really do. 0.5 BTC is a life-changing amount of money and would do a lot for some persons in some countries. I don't know why he didn't take your advice, whether it was stinginess or what, but I'm sure he regrets it. Spending a few dollars to get a good hardware device would have averted this mess.

This is a sad story to hear, half a f Bitcoin is a very huge amount of money that worth anything.

I am still wondering why extension, and why didn’t he have a seed phrase? Or is it that the Exodus wallet is like an exchange that didn’t give you private key or seed phrase? And even if it is an exchange I think since it is not a general problem, you are supposed to recover your funds in another device if you have your login details, but I don’t know why this wallet in question is different because even phantom wallet, MetaMask, and others that support extension do give seed phrase or private key depending on either the wallet is an open or close-source.

Nevertheless, this is a lesson learned the hard way, I am sure your friend will never leave his Bitcoin in even a central exchange or any wallet that he will not be in control of his coin.

[Stalker22]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

Mind sharing what this extension was? So we could all also avoid it. Maybe it was a replica of another legit extension he was trying to download.

I would also like to hear more about this case.  As far as I know, there is no browser extension that can simply "steal" coins from your desktop wallet.  Or is there?
In any case, it would be useful for all of us to know more information about how the theft actually happened.  Though, I kinda doubt the original poster will give us an update.

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

Exodus is actually a pretty decent wallet. I have heard great reviews and only very few bad ones. But if you are not careful yourself, the wallet can only do so much to protect your coins. Remember to double check what you are downloading and if possible do not use the devices where you have bitcoin in to download links from the internet.

Right, I havent heard anything awful about Exodus wallet either, except its closed source, which bugs some people, me included.  If the user messed up here, its not really the wallet fault.  It boils down to what went wrong – like a phishing scam or nasty malware.  But if you are not paying attention, that same bad stuff could still happen even if you used a hardware wallet.

[Findingnemo]

It is not just the extension, it is not just the wallet, it is not just the operating system, it is the device which connected to internet then there will always be a risk for compromise. And yes hardware wallet brings better security by eliminating the contact of the wallet with the device combined with not losing the convenience. But no wallet is safe 100%, if there is something happened to the wallet backup then it will end in a disaster too.

[Ultegra134]

The amount he lost is a big amount. Who has around $60K in his wallet? I'm just wondering why he hasn't bought a hardware wallet. I don't store any funds in a web wallet or software wallet, even if it's more than a thousand dollars. Comparing $60K to a hardware wallet, which just costs a couple of dollars, but it would save all of his money. Sorry to hear your friend lost his funds and didn't hear what you said. I really don't compromise with my fund's security at all, because if I can't afford to buy a hardware wallet, then I have to afford lost funds.

However, it has gone and will never be recovered. But we can take a lesson from here and apply it to us. I don't trust even a centralised exchange. I don't store funds there since I have multiple hardware wallets. After trading, just move funds into the hardware wallet, and whenever you need to sell, then move it again to the exchange. I'm really not a fan of installing any extension to my browser. Right now MetaMask is my only extension; there is nothing else there.

I don't think not using a a hardware wallet is too much of an issue. Although hardware wallets are safer, this doesn't mean that wallets such as Electrum aren't safe. The users are who ultimately sabotage themselves, either by downloading something they shouldn't have, or being careless in general. Metamask is also a wallet that is prone to scams, but ultimately, it's the users fault. Unfortunately, the internet is full of phishing links, scammers and fake extensions or applications in general. If you're using your computer and storing bitcoin at the same time, it's way safer to isolate your wallet completely.

[tread93]

Well, I feel sorry for him. I confess that I used Exodus for many years, but I learned early on that I shouldn't use the Exodus extension. I was robbed once. It wasn't a big deal, but it taught me a lesson. I started using only the Exodus wallet on my desktop, without installing the browser extension.

Honestly, I can't understand why he didn't just keep the Exodus wallet on his computer, with a password and secure private keys somewhere outside of his computer, and didn't install the Exodus extension in his browser. That way, he wouldn't have lost everything. Why not? The guy wasn't trading, so why put the Exodus wallet in his browser? I don't understand

He didnt understand the risks and people dont bother to take the time to research and find the right solutions for this. He definitely should have put on his own hardware wallet, wish he could have learned this lesson with a very small amount .5 BTC is a nice chunk of sats

[abaeze]

This is why Bitcoin users always have to be aware. Currently, the value of 0.5 BTC is not very high, but not low too. Therefore, since investing in Bitcoin gives you the freedom to safeguard your own assets. Therefore, it was necessary to use a hardware wallet for the sake of secure security. Although not all Exodus wallets are hacked like this. Still, it should have been done for the sake of security. Because no one can predict in advance when hackers will hack or when they will be hacked. Therefore, it is important to use a hardware wallet for maximum security. Since internet is essential for hacking, and Ledger and Trezor work like offline wallets and do not require internet all the time, it is more secure than any other wallet.

[GigaBit]

A person can lose all his wealth in life due to lack of awareness. Therefore, it is best to take maximum security on his part. In the mentioned incident, it has been seen that the person who lost 0.5 BTC was not very careful. If he had not neglected the storage of Bitcoin and had kept it in a hardware wallet, then there would have been no possibility of his Bitcoin being stolen. Due to not paying attention at that time, he had to lose his permanent property. I think it wasn't because of using the Exodus wallet, but rather negligence was the main reason for the loss.

[davis196]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

Exodus could not even be the bad wallet here but his own stupid mistake, if this Bitcoin was in a hardware wallet it could still be here. No Bitcoin is safe on your PC, even if they are sitting in the wallet for years one silly mistake can claim it all.

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

That was most likely a wallet drainer, but I don't know how a wallet drainer could successfully drain his wallet through a browser extension.
Wallet drainers require the user to connect his wallet to the drainer and grant permissions regarding his own wallet.
Where did he download the browser extension from? I thought that browser extensions installed from Chrome webstore and Firefox App-store are supposed to be safe.
Putting the blame on Exodus is pointless. I know that many people don't like Exodus. I've never had any problem with Exodus in the last 3 years, but I might be switching to another wallet.