A old friend lost 0.5BTC because of a browser extension

[Pterosaur]

So I have someone who I personally introduce to Bitcoin few years back, he is married and living well for himself, he got a inheritance money from his grandma before she passed and he used all that money to buy Bitcoin.

The mistake he made was storing half of one Bitcoin in Exodus wallet, and I could have fought for him that he is a very careful type, the BTC was moved not very long ago and it is been sitting in his wallet for few years, he haven't tell this to his partner because they have planned to buy a house with the money.

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

Exodus could not even be the bad wallet here but his own stupid mistake, if this Bitcoin was in a hardware wallet it could still be here. No Bitcoin is safe on your PC, even if they are sitting in the wallet for years one silly mistake can claim it all.

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

[Charles-Tim]

It could be the browser extension. There are many fake browser extensions now. But maybe it is because of another thing if he is using his laptop to download apps, extensions and files.

0.5 BTC today is around $60000. To get a hardware wallet or a cold storage set up will be cheap as low as $50 to $300. Some people will think nothing will happen until it has happened.

[Orpichukwu]

It's never very safe to store a big amount of money in a hot wallet, even on a mobile wallet. Your friend was just careless, but then again, have you tried to investigate and see if your friend's wallet got hacked through phishing or if he spent the money and gave it to scammers? Things happen these days, and all blame goes to hackers.

[sokani]

I feel sorry for your friend, I really do. 0.5 BTC is a life-changing amount of money and would do a lot for some persons in some countries. I don't know why he didn't take your advice, whether it was stinginess or what, but I'm sure he regrets it. Spending a few dollars to get a good hardware device would have averted this mess.

[letteredhub]

It is to the prevention of this messy situation that may ignite the movement of old bitcoin from their wallet old address (perhaps, hot wallet) to other new addresses which could be they're move their bitcoins to some hardware wallets for tighter security.

Tough how your friend had to lose such a big sum of funds in the process of getting extra functionality from his web browser.  Just to think outside the box, have you asked your friend if he was the only person with knowledge of the wallet keys. Does his wife has idea of the keys.

[₿itcoin]

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

A brutal lesson indeed, but something that happens to us all too often. Speaking of browser extensions, they are very poorly moderated, and can even send malicious scripts, fake signature requests, or steal your seed word.

Exodus has a reputation as a strong, non-custodial software wallet afaik. In fact, the security of any software depends on how well your CPU is protected. No matter how powerful the software is, if the CPU is not malware-free, nothing on your computer is safe. So, if your PC is infected, even the best software wallet will be vulnerable.

if you are serious BTC hodler then air gapped or hd wallet are the best solution for you. if your friend had practiced hodling by using rigid & cold approach, his 0.5 BTC would still exist, so sad..

[Mia Chloe]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

This particular situation has happened multiple times and it won't actually stop happening any time soon the problem is people online are very quick to trust any random app or extension basically because most of them do not have a good understanding of how privacy works and security too.

I can still vividly remember when telegram wallet was still very new, Alot of persons were very quick to trust it and currently even if people still use it you hardly hear about it plus it was never open source or decentralized.

[crwth]

I'm curious how that could happen. I'm somewhat cautious when installing something on my PC. It's more of a precautionary measure, just because. Even if there are things that offer airdrops or something, it's still somewhat suspicious to me.

Doesn't Exodus have increased security features, such as two-factor authentication (2FA) or something similar? So that there would be another layer of protection? Would that even save your seed or wallet?

I mean, having 0.5 BTC on a hot wallet now is very dangerous. Get a small amount of BTC, buy a hardware wallet, and consider purchasing an antivirus if possible. It's better than losing your coins.

[Hamza2424]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened, later he succumb to the likely of getting phished because the only thing he remembered installing is a browser extension.

So he got scammed by a phishing link, he stored funds in a extension, for him the amount won't be that much because when someone gets free money they don't care much unless they have earned it, but if you are sure he is a careful kind person, still he should have stored funds and kept the keys somewhere safe, he did not had to keep the extension even.

Just the phrase should be kept safe, he must be using that browser regularly and thought he can click any link he want, hmm well what I can say now, if he have already lost the funds, but the best as a friend we should suggest them to be active in forums like this, and learn more, about security, it is not about extension or other things, it was his own mistake, this can happen with his bank accounts as well.

[Slow death]

Well, I feel sorry for him. I confess that I used Exodus for many years, but I learned early on that I shouldn't use the Exodus extension. I was robbed once. It wasn't a big deal, but it taught me a lesson. I started using only the Exodus wallet on my desktop, without installing the browser extension.

Honestly, I can't understand why he didn't just keep the Exodus wallet on his computer, with a password and secure private keys somewhere outside of his computer, and didn't install the Exodus extension in his browser. That way, he wouldn't have lost everything. Why not? The guy wasn't trading, so why put the Exodus wallet in his browser? I don't understand

[MidNite36]

I am curious to know, is the browser extension an exodus wallet? Because there have been similar attacks in the past where a fake exodus wallet appeared on the ad store, and many people downloaded it thinking it was the real exodus wallet.

Maybe your friend inserted his recovery seed into the extension thinking it is the real exodus app and they wipe his Bitcoin? Please ask him this question because this is the only way this makes sense.

The other way I can think about is him trying to send BTC from the wallet but the PC was already compromised, infected with a powerful malware that's good at swapping copied BTC Address to another address. Only him can know where it all went wrong.

[Rruchi man]

I did told him to go for a hardware wallet that 0.5 Bitcoin is too much to be stored in an exodus wallet, I though he listened,

Sometimes when you tell people some things from experience and the exposure you have,  they choose the one to listen to and ignore others. They later learn from their own experience because they think that whatever situation or danger that you tell them about concerning the risk they are taking will never happen to them for some reasons best known to them. For persons like these who were warned of the risks they are taking, I share no sympathy for them because they are the reason of their problems.

To others, it should a note of caution to avoid installing random extensions to a browser you use on a device that has important documents and information. It may not be you loosing bitcoins per say, but there are some other sensitive informations on your device that can be stolen if you install an extension to your browser that you cannot verify the source.

[dkbit98]

He doesn't even know how exactly he lost his coins, but I know he made a bunch of mistakes.
First, he probably used wind0ws OS, and with that it is much easier to get malware installed.
Than he used closed source wallet like exodus, and installed unknown extensions in his browser.
This is recipe for disaster 

[salad daging]

0.5 BTC today is around $60000. To get a hardware wallet or a cold storage set up will be cheap as low as $50 to $300. Some people will think nothing will happen until it has happened.

Sometimes people are reluctant to buy cheap hardware wallets because they think that storing their coins in a hot wallet is sufficient, or they think that instead of buying a hardware wallet for around $100, it would be better to invest the money elsewhere.

This way of thinking is wrong—if they lose their funds, they will regret it.

Doesn't Exodus have increased security features, such as two-factor authentication (2FA) or something similar? So that there would be another layer of protection? Would that even save your seed or wallet?

They did not store their funds in the Exodus desktop wallet but in a browser extension wallet that is only secured by a password.
It is possible that the OP's friend visited a phishing site and connected to their Exodus wallet.

[Karl_3000]

First, he probably used wind0ws OS, and with that it is much easier to get malware installed.

Other OS can also be vulnerable to malware, even the commonly used Linux OS can still have malware but just that people that are using it are pros. To stay away from malware, it is better to use a cold wallet but your advice is also good because people will still want to leave small amount of money on online wallet.

[Ultegra134]

A few years ago I tried moving funds from Kraken to Binance. When I tried copy/pasting the deposit/withdrawal addresses the tabs would crash and were glitchy. Unfortunately, I didn't think much of it and proceeded with my deposit on Binance. I waited, and waited, and nothing was showing, not even on pending deposits where it would show almost immediately the second a transaction was broadcasted. I contacted their live support and they told me that this isn't their address and I likely had a malware on my computer. No anti-virus showed any results back then, so I was likely one of their first victims, since a few months later, it was all over Google's results.

This here is my thread, Fake browser extension. However, in my case, I highly doubt that this extension would be able to change or do much on an offline basis, meaning, outside of the browser. Can you elaborate more on the extension? Perhaps it was an executable that was disguised as one?

I'm sorry for your friend's loss.

[Anthony Bill]

He is not the first person to lost Bitcoin and he will not going to be the last to lost Bitcoin for unsafe wallet. The mistake you made is that you forget to recommend him to standard and safe wallet to hold Bitcoin for long years, but you teach him cryptocurrency to have the wisdom that make him to use his inheritance money to invest Bitcoin, now that he has lost the Bitcoin do you think he will be happy with you, because there is electrum and other good wallet that would have protect his Bitcoin for long. This is a lesson to other newbies that is in hurry to use any how wallet to save their Bitcoin or other coins for long years before marketing the coin to show up new cars or new houses.

[lionheart78]

As long as the device is connected to the internet, it is always at risk.  It is sad for your friend to learn the lesson the hardway. If only he listen to you and bought a hardware wallet, this thing would never have happened.

He is not the first person to lost Bitcoin and he will not going to be the last to lost Bitcoin for unsafe wallet. The mistake you made is that you forget to recommend him to standard and safe wallet to hold Bitcoin for long years, but you teach him cryptocurrency to have the wisdom that make him to use his inheritance money to invest Bitcoin, now that he has lost the Bitcoin do you think he will be happy with you, because there is electrum and other good wallet that would have protect his Bitcoin for long. This is a lesson to other newbies that is in hurry to use any how wallet to save their Bitcoin or other coins for long years before marketing the coin to show up new cars or new houses.

Yeah, he should have learned from so many reports about a pc getting infected by installing browser extension.  If I am the one holding that huge amount, I would never be relaxed until I got that fund stored in an air-gapped device to be sure that no matter what happen to my pc my BTC funds won't be affected.

[suzanne5223]

[snip]
Exodus could not even be the bad wallet here but his own stupid mistake, if this Bitcoin was in a hardware wallet it could still be here. No Bitcoin is safe on your PC, even if they are sitting in the wallet for years one silly mistake can claim it all.

He hates Exodus now but this company security has nothing to do when a desktop is compromised.

No. Exodus has something to do with it, based on the previous vulnerability of the wallet and hacking experience of some people who have used the wallet.
If the Bitcoin is kept in a hardware wallet, your friend will still have it, and I was surprised he was stingy enough to keep half a Bitcoin in Exodus, which was said to have some security flaws and vulnerabilities over the years due to the software used to build it.
Yes, the issue occurs through the extension, but from what I see, he also didn't have good internet security

[cr1776]

If you have "enough" bitcoin (whatever that is to you), having some type of cold storage is key.  Whether it is a computer that never is online or a hardware wallet, just do it.  A Chromebook isn't expensive, put electrum or something on it and never go online with it.