The "DEX aggregator" that drained 12 wallets

September 2024. A trader in New York installs "Uniswap+ Pro Trading," a Chrome extension that promises "MEV protection and 0% slippage routing." The extension has 23,000 downloads and a polished landing page. He connects his main wallet and trades $40,000 in USDC for ETH. The swap goes through. Two hours later, his token balances — $283,000 in stablecoins and wrapped majors — are gone. He had not missed a hidden signature; he had clicked through the popups. Around the swap, the extension slipped extra requests into the flow, dressed up as "routing permissions": unlimited approvals for his other tokens, with the attacker's address as spender. MetaMask showed him exactly those requests, and he clicked Confirm the way he always does.

What a malicious wallet extension can actually do

An extension allowed to read and change data on every site can rewrite the pages you use, including the request a dApp sends to your wallet. It can swap the recipient, the spender, or the amount before MetaMask ever receives the request — so the wallet popup faithfully displays the tampered version — while the page itself keeps showing you the swap you meant to make. What it cannot do is sign for you. That makes the wallet popup the last place to catch it, and the one place worth reading slowly.

The three rules for browser extensions and money

  • No extension should have access to your wallet's tab. Use a clean browser profile with only your wallet extension and an ad-blocker. No "trading helpers," no "aggregators," no "MEV protectors." If the feature is useful, the real protocol will ship it.
  • Only the protocol's own website can tell you whether an extension is real. Most DeFi protocols have no extension at all. Uniswap Labs does publish an official wallet extension, and the safe way to install it is the download link on wallet.uniswap.org. A "Uniswap+ Pro" — or any same-named listing the official site does not link to — is not theirs.
  • Audit your installed extensions monthly. Open chrome://extensions. If you do not remember installing it, remove it. If you do not remember why you installed it, remove it.

The compromise recovery

Move every asset from every wallet that ever connected to that browser to a fresh wallet generated on a different device. Revoke every approval on revoke.cash for the compromised addresses. Re-image the affected browser profile or the whole laptop if the extension had broad permissions.

Why the bait works

"MEV protection" and "0% slippage routing" are real terms from the DeFi vocabulary. The scammer borrows the language to make the fake extension feel like a legitimate trader's tool. The defense is to learn what each term actually means — and to notice that the tools that genuinely offer these features deliver them without a separate trading extension: CoW Swap through its web app, Flashbots Protect as an RPC endpoint you add to your wallet.