50,000 people installed this Bitcoin browser extension. Now control of it is up for sale

Google's Chrome Web Store lists a Bitcoin price tracking extension with 50,000 users currently being offered for sale at $55,650. The listing, which appeared on Sept. 29, includes the published product, its source code, and 14 days of assistance with the handover process.

The seller reports 37,100 installs from Sept. 14, 2025, through Sept. 13, 2026. The Bitcoin Price Tracker extension displays BTC/USD pricing from Binance in the browser toolbar and is described as pre-revenue, offering potential buyers opportunities to develop financial-information services or partner offers.

Ownership Transfer Risks

The sale of established browser extensions creates potential security risks, as demonstrated by previous cases where malicious actors acquired legitimate extensions and introduced harmful updates. Security firm Socket documented attackers acquiring five functional extensions from their authors and introducing malicious updates.

Socket's Superior campaign tracker still labels that operation ongoing, with its latest recorded activity dated Nov. 6. The firm identified 19 malicious extensions in its Aug. 27 investigation, including 18 for Chrome and one for Edge.

Transfer Process Details

Microsoft's documentation describes the extension transfer process as taking approximately three weeks, depending on responses. After an Edge transfer, the new owner gains full control over the extension's listing and updates, though the public presentation may not change immediately.

Microsoft states that changes to the description, screenshots, privacy policy URL, owner name, and website link do not automatically appear when ownership transfers. The previous information remains visible until the new owner publishes an extension update, creating a potential disconnect between who controls the product and what users see.

Malicious Update Patterns

According to Socket's analysis, acquired products initially performed their advertised functions without malware, but later versions introduced malicious behavior. The firm described cases including wallet-connection hijacking, fake recovery interfaces designed to collect seed phrases, and account harvesting.

Socket estimated approximately 70,000 Chrome users and 10,000 Edge users for the largest acquired right-click utility, representing a potential exposure surface of 80,000 users. In another case, Annex recorded a malicious version of the QuickLens image-search extension appearing just 16 days after ownership changed hands.

The current Bitcoin extension sale offers remain separate from those confirmed malicious acquisitions, but their significance lies in demonstrating how an established extension's reach and future development can be acquired. Users must consider whether a familiar tool's ownership, permissions, and behavior still justify keeping it installed.