Read this first. What follows is a composite teaching case. The person, the dates and the amounts are constructed to make the mechanics clear; they do not describe one identifiable reader. The technique itself is real: a lookalike wallet extension captures your seed phrase while you set the wallet up, then waits until the balance is worth taking.

Sixteen days of nothing going wrong

Daniel searches the Chrome Web Store for MetaMask and gets three extensions carrying that name. He picks the one with the friendlier icon and the higher rating. Setup runs exactly like the tutorials: create wallet, write down twelve words, set a password. Over the next two weeks he moves small amounts in and out, connects to a couple of dApps, and nothing looks wrong. That is the point — nothing is supposed to look wrong yet.

Day sixteen

He moves 6 ETH over from an exchange, opens a DEX to add liquidity, and comes back a few hours later to a near-empty wallet. There is no signature he approved and no allowance he granted — only a plain transfer out of his own address to one he has never seen. A wallet that sends funds without asking you to sign means one thing: the private key left the machine long before the money did.

What he actually installed

Open chrome://extensions/, click Details, and read three fields separately. For the real MetaMask they are fixed: the extension ID is nkbihfbeogaeaoehlefnkodbefgpgknn — the same string that ends its Chrome Web Store listing URL — the name is MetaMask, and the developer is metamask.io. The copy Daniel installed carried a different ID. A matching name and a matching icon prove nothing on their own; if any one of the three fields is off, walk away.

Why the delayed version is the nastier one

An instant drainer at least tells you immediately: you know the hour, you know what you just installed, you can warn people. The delayed kind takes the seed phrase at wallet creation and waits for the balance to be worth harvesting, so by the time it fires you have spent two weeks visiting hundreds of sites and installing other things, and every one of them looks like a suspect. I have not found a reliable public tally of how many people these lookalike extensions have hit, or for how much — and I am not going to invent one. The shape of the attack is the part you can act on.

Verification steps before installing any wallet extension

  • Arrive from the official site. For MetaMask that means metamask.io, which links out to the store listing. Picking from store search results is where this goes wrong — the ordering is gameable.
  • Check the extension ID. Anything other than nkbihfbeogaeaoehlefnkodbefgpgknn is not MetaMask, no matter what the listing says.
  • Check the developer field. It should read metamask.io. A name can be imitated; check the developer alongside it, not instead of it.
  • Several same-named extensions side by side? Treat all of them as suspect unless you got there from the official site.
  • Permissions tell you little here. The real MetaMask also asks to read data on the sites you visit — which is exactly why a fake one can do everything the real one can.

If you already installed one

Uninstalling is not recovery: the seed phrase is already gone. Treat every address that wallet ever held as burnt. From a clean device, move anything left to a freshly generated hardware-wallet address, and run a malware scan on the old machine — if it is the same laptop you bank on, a fresh OS install is the cautious call.

What I do instead

I keep a separate browser profile for wallet extensions, with nothing else installed in it: the wallet, one ad-blocker, and that is the whole list. It does not make me immune to a bad install, but it keeps the blast radius small.