What do you need to understand first?
A copied name and favourable-looking reviews do not establish the publisher. Broad permissions can reach beyond the page where you noticed the extension. Even a useful-looking feature deserves a clear reason for the access it requests. Installing an extension and granting token permission are separate risks.
What might this look like?
A helper says a browser add-on will repair your wallet balance. After installation it asks you to restore using recovery words. You stop: the repair story has turned into a request for control, and the helper supplied both the diagnosis and the supposed solution.
Where is the safety checkpoint?
How can you work through it?
Leave the supplied installation route
Close unsolicited repair and download links. Find the documented software source independently.
Read the requested browser access
Check the publisher and permission explanation. If you cannot justify the requested access, do not install or enable it.
Refuse a surprise restore
Do not type a phrase into an extension to validate a wallet, claim a reward or fix a displayed balance. Deliberate recovery needs a verified setup.
Respond to possible exposure
Pause wallet use on the affected browser and follow trusted device-security guidance. Removing an extension does not make a previously disclosed phrase secret again.
When should you pause?
Pause until you can check each point below without sharing spending secrets.
- The publisher and installation route are independently checked.
- Every requested permission has an understood purpose.
- No repair prompt received spending secrets.