Chrome Web Store

11Versions

1Code reviewed

Do not install

Code review: critical

Our reviewer read this extension’s code and confirmed malicious behaviour. 6 security findings documented below. Do not install it. Remove it if you already have it.

Bitcoin Extension

ID: afhfbdbjojkmnjhlcefomefflbkbhpcc

Extension Info & Metadata

Status

Active

Version

1.7.0

Size

0.23 MB

Rating

4.6/5

Reviews

Users

2,000

Type

Extension

Updated

Jul 6, 2026

Publisher Contextual Analysis

Author: https://sites.google.com/view/bitcoin-extension/View Profile
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Extensions

Active

Obsolete

Listed

Unlisted

Users

2,000

Screenshots & videos

Install growth

User Growth

Showing data from Jan 04, 2023 to Jan 09, 2024

Versions

No change in user count

Compared to 3 months ago

8 versions released in this period

Rating Count

Total: 74 ratings

Average Rating

Current: 4.65 / 5.0-0.03

See plans

React Flow

Internal permhash`3d20c0b955…`
1 malicious

No other extension carries this fingerprint.

Permhash (Mandiant)`92db993f63…`
1 malicious

7 other extensions carry this fingerprint; 1 of the cluster are known malicious.

Withheldnot flagged
Withheldnot flagged
Withheldnot flagged
Withheldnot flagged
Withheldnot flagged
Withheldnot flagged
Withheldnot flagged

Network indicators

41 URLs and 2 IP literals were extracted from this version.

Item	Type	Severity	Description
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
background	Permission	Medium	This permission allows continuous background operation. Rated Medium because it can perform actions without user awareness, consume system resources, and maintain persistent connections.
https://.bitcoinaverage.com/	Host	Medium	Host permission — access limited to this URL pattern.
https://blockchain.com/*	Host	Medium	Host permission — access limited to this URL pattern.
https://.blockchain.com/	Host	Medium	Host permission — access limited to this URL pattern.
Access to Sensitive Domains	Risk Factor	Medium	This extension requests access to sensitive domains: https://blockchain.com/, https://.blockchain.com/*
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Sensitive Domain Access

This extension has access to the following sensitive domains:

https://blockchain.com/*
https://*.blockchain.com/*

3 critical
3 high

The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.

Gain full insight into all external connections.

Upgrade for full visibility.

About this extension

This Extension shows the current Bitcoin exchange rate.

Read the publisher’s full description

This extension allows you to monitor the current bitcoin exchange rate. It also includes an online bitcoin calculator. Supported languages: English and Russian.

User reviews

3.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

steals private keys

Ivan Starinin·20 Sept 2026

ꜱᴄᴀᴍᴍɪɴɢ... ꜰʀᴇᴇᴢɪɴɢ ᴘᴇᴏᴘʟᴇꜱ ᴀᴄᴄᴏᴜɴᴛꜱ ᴀɴᴅ ᴍᴀᴋɪɴɢ ᴛʜᴇᴍ ʟᴏᴏꜱᴇ ᴛʜᴏᴜꜱᴀɴᴅꜱ ᴏꜰ ᴅᴏʟʟᴀʀꜱ ᴀɴᴅ ꜱᴜᴘᴘᴏʀᴛ ᴅᴏᴇꜱ ɴᴏᴛʜɪɴɢ. I contacted ʀᴇᴛʀace¢oin Agency for assistance and they ʀᴇꜱᴘᴏɴᴅᴇᴅ Qᴜɪᴄᴋʟʏ . ᴛʜᴇʏ ʜᴀɴᴅʟᴇᴅ ᴇᴠᴇʀʏ ꜱᴛᴇᴘ ᴡɪᴛʜ ᴄᴀʀᴇ, ᴋᴇᴇᴘɪɴɢ ᴛʜɪɴɢꜱ ᴄʟᴇᴀʀ ᴀɴᴅ ꜱᴛʀᴇꜱꜱ-ꜰʀᴇᴇ. ᴛʜᴇɪʀ ᴛᴇᴀᴍ ꜱᴛᴀʏᴇᴅ ᴘᴏʟɪᴛᴇ, ᴄʜᴇᴄᴋᴇᴅ ᴀʟʟ ᴛʜᴇ ᴅᴇᴛᴀɪʟꜱ, ᴀɴᴅ ꜰᴏʟʟᴏᴡᴇᴅ ᴜᴘ ᴛᴏ ᴍᴀᴋᴇ ꜱᴜʀᴇ ɪ ᴡᴀꜱ ꜱᴀᴛɪꜱꜰɪᴇᴅ. ɪ ᴀᴘᴘʀᴇᴄɪᴀᴛᴇᴅ ʜᴏᴡ ꜱᴍᴏᴏᴛʜ ᴛʜᴇ ᴘʀᴏᴄᴇꜱꜱ ᴡᴀꜱ—ɪᴛ ᴍᴀᴅᴇ ᴍᴇ ꜰᴇᴇʟ ʟɪᴋᴇ ᴍʏ ᴛɪᴍᴇ and concerns really matters to them. whtspp: 1***445***247***3745 (Retracecoin (@) hotmail (.) com)

Derrick Robinson·30 Jul 2025

I was scammed over ( $345,000 ) by someone I met online on a fake bitcoin investment project . I started searching for help legally to recover my money and I came across a lot of Testimonies about BRIGADIA TECH REMIKEABLE Recovery Expects. I contacted them providing the necessary information's and it took the experts about 27hours to locate and help recover my stolen crptocurrency funds.I am so relieved and the best part was, the scammer was located and arrested by local authorities in his region. I hope this help as many out there who are victims and have lost to these fake online investment scammers. I strongly recommend their professional services for assistance with swift and efficient recovery. They can reached through the link below. Email Address:brigadiatechremikeable@proton.me

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs

IPv4

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found

No IP addresses found

Gain full insight into all external connections.

Upgrade for full visibility.

Version	Size	Verdict	Findings	Permhash
1.7.0 Latest	0.23 MB	Malicious	0	92db993f6307d61a91d7661a0ef81c84c1326e0a0fff0f8259d233e650fafcd2
1.6.0	0.29 MB	Caution	—	92db993f6307d61a91d7661a0ef81c84c1326e0a0fff0f8259d233e650fafcd2
1.2.0	0.22 MB	Caution	—	aac2c2c108b92de3f7abdaa69686d494f21a36435ddcd0ba64a7341ee995d5de
1.1.3	0.90 MB	Caution	—	aac2c2c108b92de3f7abdaa69686d494f21a36435ddcd0ba64a7341ee995d5de
1.1.2	0.99 MB	Caution	—	aac2c2c108b92de3f7abdaa69686d494f21a36435ddcd0ba64a7341ee995d5de
1.1.1	1.03 MB	Caution	—	aac2c2c108b92de3f7abdaa69686d494f21a36435ddcd0ba64a7341ee995d5de
1.1.0	1.04 MB	Caution	—	aac2c2c108b92de3f7abdaa69686d494f21a36435ddcd0ba64a7341ee995d5de
1.0.8	0.90 MB	Caution	—	d0f941141441188e63703a093173b95b63f23c74a1c283dabf4690fe739bee64
1.0.7	0.90 MB	Caution	—	d0f941141441188e63703a093173b95b63f23c74a1c283dabf4690fe739bee64
1.0.6	0.88 MB	Caution	—	d0f941141441188e63703a093173b95b63f23c74a1c283dabf4690fe739bee64

Showing 1 to 10 of 20 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Do not install

Bitcoin Extension

Extension Info & Metadata

Publisher Contextual Analysis

Screenshots & videos

Install growth

User Growth

Rating Count

Average Rating

Threat relationships

Internal permhash`3d20c0b955…`
1 malicious

Permhash (Mandiant)`92db993f63…`
1 malicious

Network indicators

Security analysis

Manifest File Security Analysis

Sensitive Domain Access

Code Analysis

Store listing & files

About this extension

User reviews

User Reviews

Extension files

Network indicators

URLs

Versions & changes

Version History

Code Diff

User Reviews

Threat relationships

Internal permhash`3d20c0b955…`
1 malicious

Permhash (Mandiant)`92db993f63…`
1 malicious

Network indicators

User Growth

Rating Count

Average Rating

Do not install

Bitcoin Extension

Extension Info & Metadata

Publisher Contextual Analysis

Screenshots & videos

Install growth

User Growth

Rating Count

Average Rating

Threat relationships

Internal permhash3d20c0b955…1 malicious

Permhash (Mandiant)92db993f63…1 malicious

Network indicators

Security analysis

Manifest File Security Analysis

Sensitive Domain Access

Code Analysis

Store listing & files

About this extension

User reviews

User Reviews

Extension files

Network indicators

URLs

Versions & changes

Version History

Code Diff

User Reviews

Threat relationships

Internal permhash3d20c0b955…1 malicious

Permhash (Mandiant)92db993f63…1 malicious

Network indicators

User Growth

Rating Count

Average Rating

Internal permhash`3d20c0b955…`
1 malicious

Permhash (Mandiant)`92db993f63…`
1 malicious

Internal permhash`3d20c0b955…`
1 malicious

Permhash (Mandiant)`92db993f63…`
1 malicious