Fake Phantom, Jupiter and Bitget Firefox wallet add-ons stole seed phrases via bonto.io
Malwarebytes, citing Socket, reports three fake Firefox add-ons posing as Phantom, Jupiter and Bitget wallets that stole recovery phrases and keys; the listings have been removed.
- First reported
- Reports
- 1
Source: malwarebytes.com · published
What happened
On 29 October 2026 Malwarebytes reported, based on research by Socket, that three malicious Firefox extensions impersonating the Phantom, Jupiter and Bitget crypto wallets stole recovery phrases and private keys. The genuine wallet brands are impersonated and are not involved. Malwarebytes lists add-on IDs 3092199 (Phantom impersonator), 3092666 (Jupiter impersonator) and 3092059 (Bitget impersonator), and the domain bonto.io with the subdomains phantom.bonto.io, jupiter.bonto.io, bitget.bonto.io, coinbase.bonto.io and exodus.bonto.io, plus the IP addresses 104.21.34.69 and 172.67.155.198.
How the scam works
According to Malwarebytes, the extensions looked for 12-, 15-, 18- and 24-word recovery phrases and for Ethereum and Solana private keys. They could read input fields, detect pasted text and scan screens that display a recovery phrase. The Phantom variant could capture a phrase both when it was typed during import and when it was shown on a reveal screen. Its backend logged captured secrets, sent them to a Telegram bot and automatically moved funds to hardcoded payout addresses covering Ethereum, BSC, Polygon, Arbitrum, Optimism, Base, Avalanche, Solana and Bitcoin.
A recovery phrase or private key is a bearer secret: anyone who has it controls the wallet and its assets. The genuine wallets offer extensions for other browsers (Jupiter for Chrome, Brave and Edge; Bitget for Chrome), and Malwarebytes notes that Phantom says its Firefox extension is no longer supported, which is why a Firefox listing is itself a warning sign. The fake Phantom listing asked to access data on all websites and had no privacy policy. Socket says all three listings were live on Firefox Add-ons during its analysis and have since been removed, but anyone who installed one may still be at risk.
Source
Malwarebytes (Pieter Arntz), "Malicious Firefox extensions impersonate popular crypto wallets", 29 October 2026, reporting research by Socket.
Red flags
- A "wallet" extension for a browser the wallet maker says it does not support.
- An extension that asks permission to read data on all websites and has no privacy policy.
- Any page or add-on that asks you to type or paste your recovery phrase.
- Wallet look-alike subdomains of bonto.io.
- Funds leaving the wallet soon after you import it into a new extension.
If you were targeted
- 1Remove any of the three extensions from Firefox (three-dot menu, then Remove).
- 2If you ever entered a phrase or key, create a new wallet on a clean device and move your assets at once; treat the old wallet as compromised.
- 3Install wallets only from the vendor's official website link, not from store search results.
- 4Never enter your recovery phrase on a website; use it only in the official wallet app when restoring.
- 5Use up-to-date anti-malware that blocks the bonto.io subdomains.