That 'Solidity Pro' VS Code Extension Could Drain Your Crypto Wallet

Michael Miller · 2026-08-10

If you're a developer working with Ethereum or other blockchain tech, you've probably gotten comfortable installing VS Code extensions without a second thought. They're supposed to make your life easier, right? Well, a recent discovery by cybersecurity researchers should give you serious pause. A malicious extension called Solidity Pro (or "solidity-pro") has been caught in the wild, and it's not just a buggy tool—it's a full-blown credential and crypto wallet stealer. Imagine settling in for a productive coding session, thinking you've grabbed a handy utility from the marketplace, and then finding out your private keys and passwords have been quietly exfiltrated. It's a nightmare scenario, but it's exactly what this extension was designed to do. The researchers found that it was actively delivering a browser wallet and credential stealer, meaning it could swipe your login info and drain your digital assets without you noticing a thing. ### The Malicious Extensions to Watch Out For The researchers specifically flagged two versions of this malicious extension. Here are the exact names you should look out for: - helper-beeps.solidity-pro - web3devtoolsx.solidity-pro Neither of these extensions is currently available on Open VSX, which is good news. But the fact that they were listed at all shows how easily bad actors can slip malicious code into trusted ecosystems. The GitHub repository associated with these extensions is still up, which means the threat hasn't fully disappeared. It's a reminder that the open-source community isn't immune to bad actors. ### How This Stealer Works So, how does this thing actually operate? In simple terms, it's a trojan horse. The extension looks legitimate on the surface—it probably even had decent ratings or a helpful description. But once installed, it starts running malicious code in the background. It's designed to target your browser's stored credentials, which means it can grab passwords for your email, social media, and any other accounts you've saved. More concerning, it goes after crypto wallets, looking for private keys or seed phrases that could give the attacker full control over your funds. What's particularly nasty is that it does this silently. You won't see a pop-up or a warning. The code runs quietly, sending your data to a remote server. By the time you realize something's wrong, your wallet could be emptied and your accounts compromised. ### Why This Matters for Developers If you work with blockchain or smart contracts, you're a prime target. Attackers know that developers in this space often hold significant crypto assets, either personally or for their projects. A single compromised extension can wipe out years of hard work and savings. Even if you're just a hobbyist, the risk isn't worth it. Your credentials are valuable, and a stolen API key could be used to rack up charges or access sensitive systems. I've seen this pattern before. It starts with a seemingly harmless tool, and before you know it, you're dealing with identity theft or financial loss. The best defense is always caution. Don't install extensions unless you're absolutely sure they're from a trusted source. ### How to Protect Yourself First, check your installed extensions right now. If you see either of those names, uninstall them immediately and change your passwords. Also, revoke any active sessions for your crypto wallets and move your funds to a new wallet that was generated on a clean machine. Next, be more selective about what you install. Stick to extensions from well-known publishers, and always check the download counts and reviews. A brand-new extension with a generic name should raise red flags. Finally, consider using a dedicated browser or virtual machine for your crypto activities. It adds a layer of isolation that can keep your assets safe even if you accidentally install something malicious. It might seem like overkill, but after seeing how sophisticated these attacks have become, it's a small price to pay for peace of mind. ### The Bottom Line The Solidity Pro incident is a wake-up call for the entire developer community. We rely on these tools daily, but we can't afford to be naive. The threat is real, and it's evolving. Stay vigilant, keep your software updated, and always think twice before adding a new extension to your workflow. Your crypto wallet—and your identity—depend on it.