According to Wu, a security expert tweeted that the security company Koi disclosed that over 40 fake encryption wallet extensions appeared in a certain browser's official plugin store, imitating mainstream wallets such as a certain platform's wallet and another platform's wallet. These malicious plugins steal mnemonic phrases by embedding event listener code and send the data back to the attacker's server.