50,000 people installed this Bitcoin browser extension. Now control of it is up for sale

Google's store lists 50,000 users for a Bitcoin price extension advertised at $55,650, with the offer including the published product, its source code, and help handing it over, giving a buyer an established crypto-facing audience rather than a ticker built from scratch.

The Bitcoin Price Tracker listing, listed on Sept. 29, puts a price on a product people have already chosen to install. Acquiring the product can also put a new owner in charge of future updates, extending the sale's consequences to people who already installed it.

The sale advertisement does not document a completed transaction or connect the product or its seller to malware.

In a separate investigation published in August, security firm Socket documented attackers acquiring five functional extensions from their authors and introducing malicious updates. Socket's Superior campaign tracker still labels that operation ongoing, with its latest recorded activity dated Nov. 6.

What the Bitcoin price tracker buyer gets

Bitcoin Price Tracker's Chrome Web Store page displays 50,000 users and identifies Extpose as its provider. It displays BTC/USD pricing from Binance in the browser toolbar.

The seller separately reports 37,100 installs from Sept. 14, 2025, through Sept. 13, 2026.

The advertisement describes the product as pre-revenue and offers a buyer opportunities to develop financial-information services or relevant partner offers. The $55,650 is an asking price for the extension, code, and 14 days of handover assistance.

Two other advertisements show how the same proposition extends beyond crypto tools:

Advertised product Asking price Included assets Audience evidence

Bitcoin Price Tracker $55,650 Published Chrome product, code and handover assistance Google store displays 50,000 users; seller separately reports 37,100 installs over Sept. 14, 2025–Sept. 13, 2026

Page Auto Refresh $24,999 Chrome and Edge products, both source codes, website and domain Seller reports 61,363 Chrome Weekly users on Sept. 2, 2026, and 49,299 Edge Weekly users on Aug. 30, 2026

Translate $9,999 Chrome and Edge products and source code Seller reports 17,153 Chrome Weekly users on Sept. 8, 2026, and 26,084 Edge Weekly users on Sept. 6, 2026

The Page Auto Refresh and Translate figures come from dated publisher analytics described by the seller. The offers also include different assets, so their asking prices don't establish a standard price per audience member.

Control can change before the public listing does

Microsoft's documentation describes a current-owner support request followed by review and explicit confirmation from both publishers, and the process typically takes approximately three weeks, depending on responses.

After an Edge transfer, the new owner gains full control over the extension's listing and updates. But the public presentation does not necessarily change at the same moment.

Microsoft says changes to the description, screenshots, privacy-policy URL, owner name, and website link do not automatically appear when ownership transfers. The previous information remains visible until the new owner publishes an extension update.

On Edge, that creates a distinction between what they see and who controls the product. A familiar name on a listing may describe the previous owner, even though the transfer has already given someone else update rights. Microsoft describes this display lag as part of the Edge transfer process.

Google's enterprise publishing guidance directs developers seeking to transfer an extension to the organization they publish to toward Chrome Web Store support.

Google's program policies prohibit malware and phishing and restrict the use of collected information to the extension's disclosed purpose. An exception for transferring that information as part of a merger, acquisition, or asset sale requires explicit prior consent.

What a malicious buyer can change

In its Aug. 27 investigation, Socket identified 19 malicious extensions: 18 for Chrome and one for Edge. It classified 14 as created by the attacker and five as bought from legitimate authors.

According to Socket, the acquired products initially performed their advertised functions without malware, but later versions introduced malicious behavior, giving the attacker an existing distribution base.

In its analysis of the acquired right-click extension, Socket described wallet-connection and swap hijacking, fake Ledger and Trezor recovery interfaces designed to collect seed phrases, and account or session harvesting. It also described a framework that downloaded changeable JavaScript, removed Content Security Policy protections, and injected code into visited pages.

Socket estimated approximately 70,000 Chrome users and 10,000 Edge users for the largest acquired right-click utility, describing a potential exposure surface of 80,000.

In its February report, Annex recorded a new owner for the image-search extension QuickLens appearing on Feb. 1, followed by a malicious version 5.8 just 16 days later.

Annex said the update added permissions that would trigger an acceptance prompt, while the original image-search functionality continued to work.

The case shows why continued usefulness is a weak assurance about the rest of an extension's behavior, and also why an ownership change should not be described as automatically bypassing every permission safeguard.

As viewed on Nov. 13, Socket's Superior tracker labels the campaign “Ongoing,” gives Nov. 6 as its last-activity date, and records 33 affected package artifacts representing 24 unique packages.

The current sale offers remain separate from those confirmed malicious acquisitions, and their significance is that an established extension's reach and future development can be acquired, while the decision to install and trust it may have been made under another owner.

The practical question for crypto investors is whether a familiar tool's ownership, permissions, and behavior still justify keeping it installed. Socket recommends regularly reviewing extensions and removing unnecessary or suspicious ones.