50,000 people installed this Bitcoin browser extension. Now control of it is up for sale

Google's store lists 50,000 users for a Bitcoin price extension advertised at $55,650, with the offer including the published product, its source code, and help handing it over, giving a buyer an established crypto-facing audience rather than a ticker built from scratch.

The Bitcoin Price Tracker listing, listed on Sept. 29, puts a price on a product people have already chosen to install. Acquiring the product can also put a new owner in charge of future updates, extending the sale's consequences to people who already installed it.

The sale advertisement does not document a completed transaction or connect the product or its seller to malware.

In a separate investigation published in August, security firm Socket documented attackers acquiring five functional extensions from their authors and introducing malicious updates. Socket's Superior campaign tracker still labels that operation ongoing, with its latest recorded activity dated Nov. 6.

What the Bitcoin price tracker buyer gets

Bitcoin Price Tracker's Chrome Web Store page displays 50,000 users and identifies Extpose as its provider. It displays BTC/USD pricing from Binance in the browser toolbar.

The seller separately reports 37,100 installs from Sept. 14, 2025, through Sept. 13, 2026.

The advertisement describes the product as pre-revenue and offers a buyer opportunities to develop financial-information services or relevant partner offers. The $55,650 is an asking price for the extension, code, and 14 days of handover assistance.

Two other advertisements show how the same proposition extends beyond crypto tools:

The Page Auto Refresh and Translate figures come from dated publisher analytics described by the seller. The offers also include different assets, so their asking prices don't establish a standard price per audience member.

Control can change before the public listing does

Microsoft's documentation describes a current-owner support request followed by review and explicit confirmation from both publishers, and the process typically takes approximately three weeks, depending on responses.

After an Edge transfer, the new owner gains full control over the extension's listing and updates. But the public presentation does not necessarily change at the same moment.

Microsoft says changes to the description, screenshots, privacy-policy URL, owner name, and website link do not automatically appear when ownership transfers. The previous information remains visible until the new owner publishes an extension update.

On Edge, that creates a distinction between what they see and who controls the product. A familiar name on a listing may describe the previous owner, even though the transfer has already given someone else update rights. Microsoft describes this display lag as part of the Edge transfer process.

What appears publicly in Microsoft Edge?

The new owner controls listing and updates, while previous-owner details can remain visible until the extension is updated.

An installed tool's familiar identity and the party deciding its next update can diverge.

Edge listing behavior is not asserted for Chrome. The cited evidence does not link the current sale offers or seller to the documented malicious cases. Arrows show control and distribution, not guaranteed infection, bypass of permission prompts or victim counts.

Sources and evidence

Sources

1. www.sideprojectors.com
2. www.sideprojectors.com
3. www.sideprojectors.com
4. socket.dev
5. annex.security
6. learn.microsoft.com

Supporting facts

• According to Socket, initially functional, clean extensions later received malicious versions; acquisition of established products gave attackers an existing distribution base. [4]
• Microsoft states that the new owner gains full control over the extension's listing and updates, while owner name, description, screenshots, privacy-policy URL and website link do not automatically change publicly until the new owner publishes an update. [6]
• Microsoft's transfer procedure calls for a current-owner support request, review and explicit confirmation with both publishers, with processing typically taking approximately three weeks. [6]
• Annex's February 23 report records a new QuickLens owner on February 1, 2026 and release of malicious version 5.8 on February 17, 16 calendar days later. [5]
• Annex reports QuickLens was listed for sale on October 11, 2025, and that the malicious update added permissions that would trigger a user permission prompt; the original image-search function remained operational. [5]
• The three current sale advertisements do not document completed sales or a connection between their advertised products or seller and the Superior malware campaign. [1] [2] [3] [4]

Method

Qualitative ownership and distribution diagram; geometry is schematic, not audience size. Edge states follow Microsoft's transfer document. QuickLens dates are Annex's recorded owner and release milestones, not the contract closing date.

Scope

Edge listing behavior is not asserted for Chrome. The cited evidence does not link the current sale offers or seller to the documented malicious cases. Arrows show control and distribution, not guaranteed infection, bypass of permission prompts or victim counts.

Infographic by CryptoSlate

Google's enterprise publishing guidance directs developers seeking to transfer an extension to the organization they publish to toward Chrome Web Store support.

Google's program policies prohibit malware and phishing and restrict the use of collected information to the extension's disclosed purpose. An exception for transferring that information as part of a merger, acquisition, or asset sale requires explicit prior consent.

What a malicious buyer can change

In its Aug. 27 investigation, Socket identified 19 malicious extensions: 18 for Chrome and one for Edge. It classified 14 as created by the attacker and five as bought from legitimate authors.

According to Socket, the acquired products initially performed their advertised functions without malware, but later versions introduced malicious behavior, giving the attacker an existing distribution base.

In its analysis of the acquired right-click extension, Socket described wallet-connection and swap hijacking, fake Ledger and Trezor recovery interfaces designed to collect seed phrases, and account or session harvesting. It also described a framework that downloaded changeable JavaScript, removed Content Security Policy protections, and injected code into visited pages.

Socket estimated approximately 70,000 Chrome users and 10,000 Edge users for the largest acquired right-click utility, describing a potential exposure surface of 80,000.

In its February report, Annex recorded a new owner for the image-search extension QuickLens appearing on Feb. 1, followed by a malicious version 5.8 just 16 days later.

Annex said the update added permissions that would trigger an acceptance prompt, while the original image-search functionality continued to work.

The case shows why continued usefulness is a weak assurance about the rest of an extension's behavior, and also why an ownership change should not be described as automatically bypassing every permission safeguard.

As viewed on Nov. 13, Socket's Superior tracker labels the campaign “Ongoing,” gives Nov. 6 as its last-activity date, and records 33 affected package artifacts representing 24 unique packages.

The current sale offers remain separate from those confirmed malicious acquisitions, and their significance is that an established extension's reach and future development can be acquired, while the decision to install and trust it may have been made under another owner.

The practical question for crypto investors is whether a familiar tool's ownership, permissions, and behavior still justify keeping it installed. Socket recommends regularly reviewing extensions and removing unnecessary or suspicious ones.