The "DEX aggregator" that drained 12 wallets

September 2024. A trader in New York installs "Uniswap+ Pro Trading," a Chrome extension that promises "MEV protection and 0% slippage routing." The extension has 23,000 downloads and a polished landing page. He connects his main wallet and trades $40,000 in USDC for ETH. The swap goes through. Two hours later, his entire wallet — $283,000 in stablecoins and majors — is gone, drained via permits the extension silently submitted while he wasn't looking.

What a malicious wallet extension can actually do

An extension with full access to your browser tab can: read every page including your wallet's RPC calls, inject script into wallet popups, modify the recipient address before MetaMask shows the confirmation, sign transactions on your behalf if it has captured a session key, and submit pre-built Permit signatures using cached transaction data. It can do all of this silently while showing you a normal-looking interface.

The three rules for browser extensions and money

  • No extension should have access to your wallet's tab. Use a clean browser profile with only your wallet extension and an ad-blocker. No "trading helpers," no "aggregators," no "MEV protectors." If the feature is useful, the real protocol will ship it.
  • Uniswap does not have a Chrome extension. Neither does 1inch. Neither does Cowswap. They are web apps. Any "Uniswap Extension" listing is fake by definition.
  • Audit your installed extensions monthly. Open chrome://extensions. If you do not remember installing it, remove it. If you do not remember why you installed it, remove it.

The compromise recovery

Move every asset from every wallet that ever connected to that browser to a fresh wallet generated on a different device. Revoke every approval on revoke.cash for the compromised addresses. Re-image the affected browser profile or the whole laptop if the extension had broad permissions.

Why the bait works

"MEV protection" and "0% slippage routing" are real terms from the DeFi vocabulary. The scammer borrows the language to make the fake extension feel like a legitimate trader's tool. The defense is to learn what each term actually means — and to notice that the protocols that genuinely offer these features (Cowswap, Flashbots Protect) deliver them through web interfaces, not extensions.