report<\/a>, the \u201cCrypto Copilot\u201d Chrome extension is siphoning SOL from anyone who installs it.<\/p>\nThe extension pretends to be a trading helper for Solana users, letting you execute swaps directly from X (Twitter) posts.\u00a0<\/p>\n
On the surface, it looks totally normal: it connects to standard wallets, shows DexScreener price data, and routes swaps through Raydium, Solana\u2019s biggest AMM.<\/p>\n
But underneath that UI, it secretly injects an extra instruction into every transaction you sign.<\/p>\n
How it works\u00a0<\/h2>\n
The extension quietly attaches a second instruction behind the scenes: a tiny, hidden SOL transfer to the attacker\u2019s personal wallet.<\/p>\n
You never see it in the UI. Wallets like Phantom only show a summary unless you manually expand the instruction list. So most users never notice an outbound transfer buried inside the same transaction.<\/p>\n
The fee-extraction code itself is simple: it calculates either a tiny fixed fee or a tiny percentage of the trade, converts it to lamports, and then quietly adds a second instruction to the transaction that sends that amount to the attacker\u2019s wallet.\u00a0<\/p>\n
What makes it dangerous is that this logic is buried inside heavily obfuscated JavaScript. On the surface, the UI looks completely legitimate, showing only the expected Raydium swap.\u00a0<\/p>\n
The extension also connects to a backend domain with a typo, which records wallet IDs, tracks activity, and pretends to provide \u201cpoints\u201d and referrals even though the actual website is empty and non-functional.\u00a0<\/p>\n
On-chain, the theft looks like tiny, ordinary SOL transfers sitting next to legitimate swaps. Hence, unless someone inspects instructions carefully or knows the attacker\u2019s address, it blends in.. The fee is intentionally small enough to be ignored in the moment.<\/p>\n<\/p><\/div>\n\n","protected":false},"excerpt":{"rendered":"
According to a recent report, the \u201cCrypto Copilot\u201d Chrome extension is siphoning SOL from anyone who installs it. The extension pretends to be a trading helper for Solana users, letting you execute swaps directly from X (Twitter) posts.\u00a0 On the surface, it looks totally normal: it connects to standard wallets, shows DexScreener price data, and […]<\/p>\n","protected":false},"author":1,"featured_media":320258,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[12842,10954,6897,8471,31248,23859,21029],"dealstore":[],"offerexpiration":[],"class_list":["post-320257","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-copilot","tag-crypto","tag-details","tag-extension","tag-hacker","tag-sends","tag-sol"],"yoast_head":"\n
'Crypto Copilot' Extension Sends SOL to Hacker: Details - Som2ny Network<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fivemor.com\/?p=320257\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"'Crypto Copilot' Extension Sends SOL to Hacker: Details - Som2ny Network\" \/>\n<meta property=\"og:description\" content=\"According to a recent report, the \u201cCrypto Copilot\u201d Chrome extension is siphoning SOL from anyone who installs it. The extension pretends to be a trading helper for Solana users, letting you execute swaps directly from X (Twitter) posts.\u00a0 On the surface, it looks totally normal: it connects to standard wallets, shows DexScreener price data, and […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fivemor.com\/?p=320257\" \/>\n<meta property=\"og:site_name\" content=\"Som2ny Network\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-26T17:19:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fivemor.com\/?p=320257#article\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/?p=320257\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\"},\"headline\":\"‘Crypto Copilot’ Extension Sends SOL to Hacker: Details\",\"datePublished\":\"2025-11-26T17:19:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=320257\"},\"wordCount\":291,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=320257#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg\",\"keywords\":[\"Copilot\",\"Crypto\",\"details\",\"Extension\",\"Hacker\",\"sends\",\"SOL\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fivemor.com\/?p=320257#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fivemor.com\/?p=320257\",\"url\":\"https:\/\/fivemor.com\/?p=320257\",\"name\":\"'Crypto Copilot' Extension Sends SOL to Hacker: Details - Som2ny Network\",\"isPartOf\":{\"@id\":\"https:\/\/fivemor.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/fivemor.com\/?p=320257#primaryimage\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/?p=320257#primaryimage\"},\"thumbnailUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg\",\"datePublished\":\"2025-11-26T17:19:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fivemor.com\/?p=320257#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fivemor.com\/?p=320257\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/?p=320257#primaryimage\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg\",\"width\":1600,\"height\":900},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fivemor.com\/?p=320257#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/fivemor.com\/?bp_activities=1\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"‘Crypto Copilot’ Extension Sends SOL to Hacker: Details\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fivemor.com\/#website\",\"url\":\"https:\/\/fivemor.com\/\",\"name\":\"Som2ny Network\",\"description\":\"Daily Deals\",\"publisher\":{\"@id\":\"https:\/\/fivemor.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fivemor.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/fivemor.com\/#organization\",\"name\":\"Som2ny Network\",\"url\":\"https:\/\/fivemor.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"contentUrl\":\"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png\",\"width\":300,\"height\":86,\"caption\":\"Som2ny Network\"},\"image\":{\"@id\":\"https:\/\/fivemor.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/fivemor.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/fivemor.com\"],\"url\":\"https:\/\/fivemor.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"'Crypto Copilot' Extension Sends SOL to Hacker: Details - Som2ny Network","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fivemor.com\/?p=320257","og_locale":"en_US","og_type":"article","og_title":"'Crypto Copilot' Extension Sends SOL to Hacker: Details - Som2ny Network","og_description":"According to a recent report, the \u201cCrypto Copilot\u201d Chrome extension is siphoning SOL from anyone who installs it. The extension pretends to be a trading helper for Solana users, letting you execute swaps directly from X (Twitter) posts.\u00a0 On the surface, it looks totally normal: it connects to standard wallets, shows DexScreener price data, and […]","og_url":"https:\/\/fivemor.com\/?p=320257","og_site_name":"Som2ny Network","article_published_time":"2025-11-26T17:19:42+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fivemor.com\/?p=320257#article","isPartOf":{"@id":"https:\/\/fivemor.com\/?p=320257"},"author":{"name":"admin","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371"},"headline":"‘Crypto Copilot’ Extension Sends SOL to Hacker: Details","datePublished":"2025-11-26T17:19:42+00:00","mainEntityOfPage":{"@id":"https:\/\/fivemor.com\/?p=320257"},"wordCount":291,"commentCount":0,"publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"image":{"@id":"https:\/\/fivemor.com\/?p=320257#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg","keywords":["Copilot","Crypto","details","Extension","Hacker","sends","SOL"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fivemor.com\/?p=320257#respond"]}]},{"@type":"WebPage","@id":"https:\/\/fivemor.com\/?p=320257","url":"https:\/\/fivemor.com\/?p=320257","name":"'Crypto Copilot' Extension Sends SOL to Hacker: Details - Som2ny Network","isPartOf":{"@id":"https:\/\/fivemor.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fivemor.com\/?p=320257#primaryimage"},"image":{"@id":"https:\/\/fivemor.com\/?p=320257#primaryimage"},"thumbnailUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg","datePublished":"2025-11-26T17:19:42+00:00","breadcrumb":{"@id":"https:\/\/fivemor.com\/?p=320257#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fivemor.com\/?p=320257"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/?p=320257#primaryimage","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2025\/11\/IMG_5844.jpeg","width":1600,"height":900},{"@type":"BreadcrumbList","@id":"https:\/\/fivemor.com\/?p=320257#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/fivemor.com\/?bp_activities=1"},{"@type":"ListItem","position":2,"name":"‘Crypto Copilot’ Extension Sends SOL to Hacker: Details"}]},{"@type":"WebSite","@id":"https:\/\/fivemor.com\/#website","url":"https:\/\/fivemor.com\/","name":"Som2ny Network","description":"Daily Deals","publisher":{"@id":"https:\/\/fivemor.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fivemor.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/fivemor.com\/#organization","name":"Som2ny Network","url":"https:\/\/fivemor.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/","url":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","contentUrl":"https:\/\/fivemor.com\/wp-content\/uploads\/2026\/07\/4a0953c4-logo-300x86-1.png","width":300,"height":86,"caption":"Som2ny Network"},"image":{"@id":"https:\/\/fivemor.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/fivemor.com\/#\/schema\/person\/b85e3c3dc0e1daea076524dc8810c371","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/fivemor.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/729ae85bf62b9917e93538db2f2688ca?s=96&r=g&default=https%3A%2F%2Ffivemor.com%2Fwp-content%2Fplugins%2Fbuddypress-first-letter-avatar%2Fimages%2Fdefault%2F96%2Flatin_a.png","caption":"admin"},"sameAs":["https:\/\/fivemor.com"],"url":"https:\/\/fivemor.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/320257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=320257"}],"version-history":[{"count":0,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/posts\/320257\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=\/wp\/v2\/media\/320258"}],"wp:attachment":[{"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=320257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=320257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=320257"},{"taxonomy":"dealstore","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdealstore&post=320257"},{"taxonomy":"offerexpiration","embeddable":true,"href":"https:\/\/fivemor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fofferexpiration&post=320257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}