Skip to main content
Coinbase Extension

​
Coinbase Wallet Extension: Official Guide

This document provides essential information regarding the Coinbase Wallet browser extension, including official installation sources, core functionality, and critical security warnings based on recent threat intelligence. Coinbase Wallet is a self-custody wallet, meaning you alone control your private keys and funds .

​
1. Official Source & Publisher Verification

The only legitimate source for the Coinbase Wallet extension is the official browser store listing. The publisher is listed as Toshi Holdings Pte. Ltd, not “Coinbase Inc.” .
  • Official Chrome Web Store ID: hnfanknocfeofbddgcijnmhnfnkdnaad
  • Official URL: Access via coinbase.com/wallet to be redirected to the store.
  • Warning: Do not download from GitHub repositories, GitBook pages, or random Vercel/Pages.dev subdomains claiming to offer the extension. These are frequently malicious .

​
2. What This Extension Does

The Coinbase Wallet extension is a gateway to Web3. It allows you to :
  • Self-Custody Assets: Store and manage crypto directly in your browser (private keys are not held by Coinbase.com).
  • Connect to DApps: Interact with decentralized finance (DeFi), NFTs, and Web3 applications across Ethereum, Polygon, Avalanche, BNB Chain, and other EVM networks.
  • Solana Support: Send and receive Solana (SOL) and SPL tokens directly within the extension.
  • Import Wallets: You can import existing wallets (MetaMask, Trust Wallet, Phantom, or another Coinbase Wallet) using their 12-word recovery phrase .

​
3. Installation & Setup Quick Steps

  1. Install: Go to the official Chrome Web Store listing and click “Add to Chrome.”
  2. Create or Import: Open the extension. Choose “Create new wallet” or “Import an existing wallet” .
  3. Secure Recovery Phrase: You will be given a 12-word Secret Recovery Phrase. Write this down on paper and store it offline. Coinbase cannot recover this for you .
  4. Set Password: Create a password for local access to the extension.

​
4. Critical Security Disclosures (High Risk)

​
⚠️ Active Malware Campaign Targeting This Extension

Security researchers (HP Wolf Security) have identified an active campaign (observed April–June 2026) where malware named “Needle Stealer” specifically targets the Coinbase Wallet extension .
  • How it works: Attackers lure users to download a fake “AI trading agent.” The installer uses a Microsoft-signed executable to sideload malware. This malware replaces your legitimate Coinbase Wallet extension files with a malicious copy that looks identical.
  • The Risk: When you enter your password into the fake extension, it is sent to the attacker’s server, allowing them to drain your funds .
  • Mitigation: Do not download unrelated “trading bots” or “AI tools” onto the same computer where you use your crypto wallet. If you suspect your extension was tampered with, immediately move funds to a new wallet created on a clean device.

​
⚠️ Phishing & Fake Domains

Multiple domains impersonating the Coinbase Wallet extension have been flagged as phishing/drainers (e.g., coinbasextension.vercel.app, public--coinbase-wallet-extension.pages.dev) . These sites are designed to steal your recovery phrase or trick you into signing malicious transactions.
  • Rule: Never enter your 12-word recovery phrase into a website. The extension will never ask for it outside of the initial import screen.

​
⚠️ Non-Custodial Responsibility

Because Coinbase Wallet is self-custody, you are the bank. If you lose your device and your 12-word phrase, your funds are gone. Coinbase support cannot reverse transactions or reset your password if you forget it .

​
5. Common Questions

Is this the same as my Coinbase.com account? No. Coinbase.com is a custodial exchange where Coinbase holds your keys. The Coinbase Wallet extension is a separate, non-custodial tool. You can connect them to easily transfer funds, but they are distinct products . Does it support Bitcoin? The extension focuses on EVM networks (Ethereum, Polygon, etc.) and Solana. For Bitcoin, you typically need a different wallet or use the mobile app’s broader features. What if I find a suspicious extension? Report it to the Chrome Web Store and Coinbase support. Do not interact with it further.