Shitcoin Wallet Pushing Malicious Codes, Collecting Exchange Credentials

By January 1, 2020DApps
Click here to view original web page at

Shitcoin Wallet, a web-based Ethereum wallet, is injecting malicious javascript codes to the wallet users, stealing crucial information.

Revealed by Harry Denley, a security and anti-phishing expert, on Monday, the vulnerable codes are collecting credentials of major crypto platforms including Binance, MyCryptoWallet, and many others.

A browser crypto wallet is injecting malicious JS to steal secrets from @myetherwallet @idexio @binance @neotrackerio @SwitcheoNetwork

Extension-native wallet create also sends secrets to their backend!

Bad guys: erc20wallet[.]tk
ExtensionID: ckkgmccefffnbbalkmbbgebbojjogffn

Shitcoin Wallet works as a Chrome extension that downloads loads of javascript files from a remote server. The code then looks for any open tabs on the web browser containing pages of any digital asset exchanges and Ethereum network tools to scrape the data in those windows.

The malicious codes send all the data to a remote server identified as “” The top-level domain belongs to a group of the south pacific island territory of New Zealand called Tokelau.

A suspiciously named wallet indeed

Designed to hold Ethereum and other ERC-20 tokens, the company claims that it has over 2,000 users. The platform basically operates as browser extensions, even though per the company, there is a desktop application for Windows.

“It is a web wallet which has several extensions for different browsers,” a blog post by the company explained.

Meanwhile, many browser extensions were found in the past with malicious codes, however, most of those were indulged in the illegal mining of digital currencies on victims’ computers.

Most recently, Google banned widely used Ethereum wallet and DApp browser MetaMask for violating its financial policy from Play Store. Though not specified, the tech giant was indicating the crypto mining feature, which is strictly bans in its policy. Notably, the platform does not offer any crypto mining services to its users.

Revealed by Harry Denley, a security and anti-phishing expert, on Monday, the […]

Leave a Reply