What happened
Vulnerability fixed, no compensation reported
From January 21 to 24, 2025, crypto wallet extensions that users installed or updated in AdsPower were replaced with malicious versions. AdsPower itself reported the incident on January 25. According to the company, as reported by an industry publication, the attackers exploited a vulnerability in a third-party technical service and primarily replaced the MetaMask extension. A researcher who studies browser extension security suspected that the OKX extension was also affected. According to SlowMist, the fake extensions sent seed phrases and private keys to the attackers’ server, after which the funds were drained.
Who was affected
> 34,000 wallets
Anyone who installed or updated wallet extensions in AdsPower between 10:00 UTC on January 21 and 10:00 UTC on January 24, 2025, according to the company. AdsPower did not disclose the number of affected users; the developer of one of the replaced extensions reported more than 34,000 wallets.
Losses
≈ $4.7 million
Approximately $4.7 million, according to SlowMist’s estimate. On January 25, SlowMist founder Yu Xian put the figure at more than $4.1 million across four attacker addresses. The developer of one of the replaced extensions reported more than $3 million. AdsPower did not publish an official figure.
What the company did
On January 25, AdsPower reported the incident, removed the malicious extensions, invited SlowMist to investigate, and advised users to reinstall their wallets from the Chrome Web Store and transfer their funds to new addresses. On January 27, the company said it had reported the incident to the Singapore police and had also brought in another blockchain security firm. In March 2025, according to an industry publication, AdsPower announced that recommended extensions in its catalog would link directly to the Chrome Web Store. It did not officially announce any compensation.
Our editors collected and checked the sources; the text says who gives each figure.