Security Threat Exposed for Browser-based Crypto Wallets

MetaMask, Phantom, Brave and other browser-based crypto wallets say no known user funds have been affected

article-image

Blockworks exclusive art by axel Rangel

share

key takeaways

  • The discovered vulnerability exposes browser wallet users’ secret recovery phrases
  • Affected wallet providers were contacted, and the vulnerability was kept confidential until the security issues were remediated

A number of popular browser-based crypto wallets are vulnerable to hacking under certain conditions, according to new research. 

Blockchain security firm Halborn found several instances where wallets including Brave, MetaMask and Phantom can be compromised under specific computer conditions — adding yet another wrinkle to traders still reeling from recent high-profile decentralized finance (DeFi) hacks. 

The conditions can expose a crypto wallet user’s secret recovery phrase (a series of words generated that gives the owner access to their crypto), which can then be used to change their private key. All told, billions of dollars of digital assets are stored in software wallets. 

Affected wallet providers were contacted and the vulnerability was kept under wraps until the security issues were remediated.

Who is affected? 

Users who meet the following conditions may be at risk:

  • Users who have unencrypted hard drives
  • Users who have previously imported their secret recovery phrase into a web extension on a device that is in the possession of someone else or have had their computer compromised
  • Users who have used the “show secret recovery phrase” checkbox to view their secret recovery phrase on-screen during the import process

Cryptocurrency wallets like the ones impacted by this vulnerability, such as Metamask, are a self-custody wallet — meaning users alone are responsible for safeguarding their private keys. 

“Exchanges like Coinbase or Binance usually hold custody of those keys on the behalf of their customers,” Steven Walbroehl, Halborn’s chief security officer and co-founder, told Blockworks.

“This impact is only for those that self-custody those assets, and it is the users’ responsibility to take it seriously, upgrade the wallets to the patched version listed on the wallet developer’s websites, and to rotate their mnemonic phrase if they think it may be at risk,” Walbroehl said. 

MetaMask has asked users to update their extension versions to 10.11.3 and later and to “take the time to enable full disk encryption on computers.”

Echoing Walbroehl, Dan Finlay, founder and group manager at MetaMask wrote in a blog post that users should “remember that it’s your responsibility to keep your computer secure. No wallet or software can keep itself safe if the system it runs on is compromised. Take time to learn how to avoid installing a virus on your computer.” 

Phantom, meanwhile, wrote in a blog post that to protect themselves on Web3, on top of general internet safety measures, users should diversify their wallets to minimize risk and use hardware wallets to store large amounts of assets and currencies.

“Other mitigations include storing the mnemonic phrase/key on a hardware-based wallet like Trezor or Ledger. These wallets still work with software wallets like Metamask when physically connected via a USB cable…but it protects the keys from attackers that may access your disk,” Walbroehl said.

Halborn has been rewarded $50,000. The wallet providers did not immediately return requests for comment.


Get the news in your inbox. Explore Blockworks newsletters:

  • Blockworks Daily: The newsletter that helps thousands of investors understand crypto and the markets, by Byron Gilliam.
  • Empire: Start your morning with the top news and analysis to inform your day in crypto.
  • Forward Guidance: Reporting and analysis on the growing intersection of crypto and macroeconomics, policy and finance.
  • 0xResearch: Alpha directly in your inbox. Market highlights, data, degen trade ideas, governance updates, token performance and more.
  • Lightspeed: Built for Solana investors, developers and community members. The latest from one of crypto’s hottest networks.
  • The Drop: For crypto collectors and traders, covering apps, games, memes and more.
  • Supply Shock: Tracking Bitcoin’s rise from internet plaything worth less than a penny to global phenomenon disrupting money as we know it.
Tags

Upcoming Events

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Research Report Templates.jpg

Research

Bluefin possibly stands at an inflection point. The token is near an all-time low yet the protocol’s spot volume market share and derivatives exchange usage have been increasing month over month since its November launch. Given its current market position and the upcoming upgrades (for both Bluefin and SUI), there may be upside potential before the increased supply growth in December. However, strong opposition from existing competitors (like Cetus and Suilend), as well as new entrants (like Aftermath), pose key challenges to Bluefin’s medium-term success.

article-image

What Grayscale’s watching going into the second quarter and why crypto had a rough start to the year

article-image

Sol’s price drop was partially triggered by one of the year’s more chaotic memecoin events

article-image

Are digital assets just part of “normal” finance conversations now?

article-image

It’s a busy week as DC prepares for confirmations and policies that may have major impacts on crypto

article-image

NFT collection Azuki is releasing anime-inspired decks for a physical trading card game

article-image

Fidelity is planning a stablecoin launch, FT reports, as more companies flock to the digital-dollar business