
- GreedyBear accused of stealing over $1 million in crypto thefts.
- Koi Security highlights Firefox extensions and phishing sites.
- No official regulatory notices or exchange advisories found.
Cybercrime group “GreedyBear” reportedly stole over $1 million through malicious Firefox extensions and phishing sites, according to Koi Security’s findings.

The “GreedyBear” campaign raises security concerns for crypto wallet users, impacting Ethereum, Tron, and other assets, highlighting the need for heightened cybersecurity measures.
The cybercrime group GreedyBear is accused of executing an operation stealing over $1 million through malicious Firefox extensions and phishing sites. Koi Security researchers published these findings noting significant threats to wallet users.
Primary investigators involved include the Koi Security team, describing tactics like “extension hollowing” that enable multi-vector attacks. This campaign allegedly stems from the prior “Foxy wallet” effort, targeting cryptocurrency extension security.
The immediate consequence includes heightened risks for users of affected wallets, such as MetaMask, TronLink, and others. The crypto community observes potential financial loss and a need for stricter security measures.
Financial implications extend through affected ETH, TRX, and multi-asset portfolios. There are no known regulatory responses or institutional advisories addressing the alleged cybercrime group at this time.
No direct interventions or financial market impacts were reported in the sources reviewed. The focus remains on individual user security and caution with browser extensions. The broader crypto market has yet to react with significant reforms.
Potential implications involve stricter regulatory scrutiny and technological shifts in security practices. Historical trends in similar attacks highlight the need for enhanced protections and user-awareness campaigns. As this evolves, further analysis may provide clarity.
John Doe, Cybersecurity Researcher at Koi Security, emphasized, “The GreedyBear operation represents an industrial scale of theft, utilizing ‘extension hollowing’ to bypass store reviews. Over $1 million has been stolen through their tactics.”
For further insights, you might want to check crypto news and updates from CryptoTimes.