Browser Wallets: Why They Are Riskier Than Hardware Wallets

A browser wallet stores your keys in your browser, the very program you use every day to open other people's websites. That makes it convenient and at the same time riskier than a hardware wallet: every other extension, every update, every piece of malware on the computer and every website that requests a signature is a possible route to your bitcoin. A hardware wallet keeps the key on a separate device and shows you on its own display what you are signing. For amounts whose loss would hurt, that is the decisive difference.

Which device suits you is shown in the hardware wallet comparison. The most common scams, from fake support to recovery fraud, are collected in How to spot bitcoin scams. This article is about the technology: why the browser of all places is such a poor home for keys.

What a browser wallet is

A browser wallet is an extension for Chrome, Brave, Edge or Firefox. You install it from the browser's store, set a password and get a seed phrase. The private keys are stored encrypted in the browser's storage on your hard drive. Once you unlock the wallet with the password, they sit decrypted in memory for as long as the session is open.

The point of it: websites can talk to the wallet directly. A marketplace asks for your address, an application sends you a transaction to sign, you click "Confirm". This is common above all in the world of Ethereum and other blockchains, where almost every application runs in the browser. In bitcoin, it is mostly users of Ordinals marketplaces and Lightning extensions who know it.

For someone who buys and holds bitcoin, this connection to websites is unnecessary. But it is the heart of the risk.

The attack surface: everything that can reach your keys

A hardware wallet has a small, clearly bounded attack surface: the device itself and its firmware. With a browser wallet, the list is long.

The common denominator: with a browser wallet, keys, display and confirmation are all on the same computer. Whoever controls that computer controls everything. With a hardware wallet, they are separate.

Malicious and fake extensions

Extensions are granted permissions when installed. Many ask to "read and change all your data on all websites". With that, an extension can see every page you open, swap text in it and read what you type. A harmless-looking extension for coupons, screenshots or translations with these permissions sits right next to your wallet.

Two patterns keep recurring:

Fake wallets in the official store. In November 2025, the security firm Socket described a Chrome extension called "Safery: Ethereum Wallet". It looked like a normal wallet. Anyone who created a wallet or imported their seed phrase sent it, unnoticed, to the criminals, hidden in tiny transactions on another blockchain. Such fakes often climb high through paid search ads or good ratings.

Hijacked genuine extensions. At the end of December 2024, an employee of the security firm Cyberhaven received a phishing email that claimed to come from Google and threatened to remove the extension. The attackers gained access to the developer account this way and published a tampered version. Users received it as a normal update. The extension had nothing to do with crypto, and that is precisely the point: any extension you once installed as trustworthy may belong to someone else tomorrow.

When the wallet itself becomes the attacker: Trust Wallet 2025

The clearest case so far hit a large, reputable wallet. On 24 December 2025, version 2.68 of Trust Wallet's Chrome extension appeared. It contained code that sent seed phrases to a server run by the attackers. According to Trust Wallet, about 2’600 wallets were drained and the damage came to roughly 7 million dollars; later analyses put it as high as 8.5 million. Only users of the Chrome extension who opened version 2.68 during that window were affected. The mobile app was not. Trust Wallet promised to reimburse the losses.

According to the analyses so far, the code did not come through a bug in the wallet but through publishing on the Chrome Web Store: the attackers were able to upload a version that bypassed the internal release process. For you as a user, that means you can do everything right, use the real wallet from the real store, and still be robbed because the code is different overnight.

Hardware wallet users are not automatically safe either if they sign without paying attention. In December 2023, a Ledger software library that many Ethereum applications embed in the browser was tampered with. For a few hours, those sites displayed fake transactions. Anyone who confirmed on the device without checking lost money. The difference: the hardware wallet's display would have shown the real transaction. With a pure browser wallet, there is no second display.

Clipboard hijacking and swapped addresses

Almost nobody types out a bitcoin address. You copy it. That is exactly where an old, very widespread scam comes in: malware watches the clipboard and replaces every copied bitcoin address with the attacker's. What that looks like, and how address poisoning works without any malware, is explained in detail in Bitcoin addresses.

In the browser, there is an extra variant: an extension with read access to all sites does not even need to touch the clipboard. It can swap the address directly on the web page, for example on your exchange's withdrawal page or in an invoice in your webmail. You copy cleanly and paste cleanly, but the address displayed was already wrong.

Infostealers: malware that hunts for wallets

A category of malware of its own, called infostealers, searches infected computers for stored passwords, cookies and wallet files. Well-known examples such as RedLine or Lumma carry lists of the folders where popular wallet extensions keep their encrypted data. They copy these files and send them to the criminals. There the password is guessed, offline and with no time pressure. A short or reused password does not hold for long.

Infostealers mostly arrive via cracked software, fake game mods, rigged downloads or attachments. In May 2025, Microsoft and Europol took down a large part of Lumma's infrastructure, but the species lives on.

None of this works against a hardware wallet: the computer only holds the public part, which lets you see balances but not move anything.

When a browser wallet is acceptable

A browser wallet is not forbidden; it is a tool for a narrow purpose. It is acceptable when all three points apply:

1. Small amount. As much as you would carry around in your wallet. What you save for the long term does not belong in it.
2. Clear purpose. You really need the connection to a website, for example for a Lightning payment in the browser or a specific marketplace.
3. Separate browser profile. The wallet runs in a profile without other extensions that you open only for this.

Many browser wallets can also be connected to a hardware wallet. The extension is then just the interface, and signing happens on the device. That is much better, as long as you check every transaction on the display and never confirm blindly.

How to protect yourself: six rules

1. Do not save in the browser. Long-term bitcoin belong on a hardware wallet. How to set one up is shown in Setting up a bitcoin wallet.
2. Never enter an existing seed phrase into a browser extension. Not to "import" a wallet, not to "verify" it. A seed that has been in a browser counts as burned.
3. Install as few extensions as possible, and none with access to all sites that you do not really need. Clean up once a quarter.
4. Install wallets only via the link on the maker's website, which you type yourself, not via search ads.
5. Check every receiving address on the device. What the screen shows can be faked. What the hardware display shows cannot.
6. Keep the computer clean. No cracked software, no unknown attachments, updates for the system and browser. If you feel specifically targeted, sign with no connection to the computer at all: see Air-gapped wallet.