Is OKX Wallet safe?
We analyzed OKX Wallet version 4.18.1's actual code and gave it a 25/100 trust score. OKX Wallet is useful but high risk because it runs across all…
Bottom line
OKX Wallet is useful but high risk because it runs across all websites, tracks browsing-related data, and executes remotely supplied code.
What it can access
It runs on every ordinary website and exposes wallet functions, while also sending browsing URLs and persistent device data to its services.[Q1][Q2][Q6][Q13]
Security weaknesses
The extension fetches JavaScript remotely and executes it, while loosely checked messaging can influence privileged wallet behavior.[Q7][Q11][Q16]
Signs of misuse
It sends complete visited URLs and persistent identifiers to its services, and its remote-code channel could change wallet behavior without a new store release.[Q6][Q12][Q13][Q7]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It asks for all-site HTTP/HTTPS access, storage and unlimitedStorage, scripting, tabs through host access, notifications, side panel, offscreen documents, identity, GCM, alarms, context menus, CPU information, and optional extension management. Most permissions support a cross-chain wallet, dapp provider, phishing guard, and trading UI, but the resulting authority is exceptionally broad.
Declares document_start content scripts in all frames on every HTTP/HTTPS page, broad host permissions, scripting, system.cpu, identity/GCM, storage, offscreen, notifications, sidePanel, and optional management. — manifest.json:19-139
Builds the untrusted dapp-provider engine and connects signing, accounts, network, permissions, and explicit user-approval controllers. — scripts/background/background.js:5134
Which websites can it run on, and can it read or change what appears on those pages?
Packaged code runs at document_start in every frame on every normal website, injects multichain wallet-provider services, and can add Instant Trade, X/Twitter, and Solscan interfaces. This scope is useful for connecting dapps but exposes every site to a security-sensitive bridge.
Loads four provider/content files in all HTTP/HTTPS frames, Instant Trade on all HTTPS pages, and site-specific X/Twitter, Solscan, and Trezor integrations. — manifest.json:19-72
Creates page postMessage streams and runtime-port streams for the injected wallet providers, with source and origin checks on page messages. — scripts/lib/all.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It handles seed phrases, private keys, wallet passwords, signatures, and transaction details entered in its own wallet UI. I found no evidence that it reads passwords, payment fields, messages, or arbitrary form values from ordinary host pages.
Contains mnemonic/private-key derivation and signing implementations, while private values are redacted in library error paths. — scripts/background/background.js:2359
Routes website-originated signing and wallet requests through request metadata and user-approval controllers rather than generic host-page input collection. — scripts/background/background.js:5134
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The permission and host-permission lists omit cookies, history, bookmarks, and downloads. — manifest.json:97-122
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can read the CPU model and can write user-selected wallet data such as addresses, seed phrases, or private keys to the clipboard from extension UI. It does not request clipboard-read, camera, microphone, location, screen capture, native messaging, or arbitrary file access.
Requests system.cpu but omits clipboardRead, camera, microphone, geolocation, desktopCapture, nativeMessaging, and file-system permissions. — manifest.json:97-122
Calls chrome.system.cpu.getInfo and returns the processor model name. — scripts/background/background.js:5121
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends complete visited URLs for phishing classification and sends device/fingerprint identifiers, wallet and transaction context, product events, error data, and blockchain/services requests to OKX and numerous chain services. The wallet functions explain much of this traffic, but full browsing URLs and stable identifiers are privacy-sensitive.
POSTs a supplied URL to the OKX wallet /priapi/v2/wallet/url/checkv2 endpoint and attaches persistent device/fingerprint headers to API requests. — scripts/background/background.js:5029-5030
Product and transaction tracking includes the device ID, wallet ID/type, dapp URL, chain, transaction hash, and workflow state. — scripts/background/background.js:5134
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads chain/RPC lists, feature flags, phishing classifications, services/static domains, and other instructions. More unusually, wallet pages fetch an OKX-hosted hot.js file and evaluate it inside a declared Chrome sandbox, then use its outputs as privileged UI configuration.
Builds an OKX CDN hot.js URL from parent-supplied values, fetches it as text, and executes it with eval. — sandbox.html:8-56
Starts the sandbox hot-code channel and consumes returned link, host, static-domain, API-domain, password-security, arbitrary hot-data, and feature-visibility values. — scripts/ui/ui.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically injects providers into all websites, checks changing tab URLs, may replace a risky tab with a warning page, and can show remotely enabled Instant Trade UI. Account access, signatures, and transactions are routed through wallet permission or approval workflows rather than silently granted.
Automatically loads provider scripts at document_start and the Instant Trade script at document_end. — manifest.json:19-57
Connects sensitive provider requests to approval handling and separately checks updated tab URLs for automatic risky-domain warning redirection. — scripts/background/background.js:5134-5143
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares optional management but no chrome_settings_overrides, search provider, proxy, privacy, or debugger access. — manifest.json:97-125
The tabs.onUpdated handler asks the phishing service about the current URL and redirects server-classified risky pages to domain-warning.html. — scripts/background/background.js:5143
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The 109 MB package contains very large minified first-party wallet code and third-party cryptography, chain, analytics, SES, and UI libraries. Security-relevant strings and call paths remain traceable, but full manual assurance across every supported chain is impractical.
Records 530 files and 109,253,364 unpacked bytes, including a roughly 15 MB minified background worker and multiple multi-megabyte provider/UI bundles. — inventory.json:1
Combines wallet controllers, chain SDKs, RPC clients, crypto libraries, telemetry, and browser integration into a large minified service-worker bundle. — scripts/background/background.js:1-5143
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
It explicitly fetches remote JavaScript and executes the returned text with eval in sandbox.html. Other eval/new Function instances are largely packaged SES, VM, WebAssembly, polyfill, and library mechanisms rather than demonstrated remote privileged execution.
Fetches the selected hot.js URL, reads response.text(), and passes the result directly to eval(). — sandbox.html:31-51
Loads packaged SES code under a page policy that permits unsafe-eval; this is separate from sandbox.html's remotely fetched script. — ses.html:8-30
Does it track the websites, pages, searches, or links you visit?
A tabs.onUpdated listener sends the complete current tab URL to OKX for phishing classification during ordinary navigation. This is continuous browsing-URL disclosure even though its apparent purpose is security rather than advertising.
KPa sends the supplied URL unchanged as the url field to /priapi/v2/wallet/url/checkv2. — scripts/background/background.js:5029-5030
The tabs.onUpdated listener invokes the URL classifier whenever a tab update includes a URL, except for domains already acknowledged in session storage. — scripts/background/background.js:5143
Does it create a persistent ID or browser fingerprint to recognize you?
It creates or obtains persistent device and extension-instance IDs and sends device/fingerprint/session fields in services and telemetry traffic. Public wallet addresses, wallet IDs, chain and transaction identifiers can add strong cross-session identity signals.
Creates a UUID-like devid, persists it, retrieves web-device/fingerprint/TMX values, and puts those values into API headers and telemetry identity. — scripts/background/background.js:5029-5030
Obtains a browser extension instance ID when available and otherwise stores the persistent device ID as instanceID. — scripts/background/background.js:5143
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends full page URLs, persistent device/fingerprint values, public wallet/account context, transaction details, and telemetry to OKX or relevant chain services. I found no evidence that decrypted seed phrases or raw private keys are intentionally uploaded.
Adds devid, device-token, web-device/fingerprint values, and security tokens to API traffic and sends full URLs for domain classification. — scripts/background/background.js:5029-5030
Transaction approval telemetry can include wallet ID/type, dapp URL, chain/network, transaction hash, and action outcome. — scripts/background/background.js:5134
Does it record typing, form entries, clipboard contents, or screenshots?
The wallet UI accepts highly sensitive passwords, seed phrases, private keys, and transaction details and supports explicit clipboard copying of wallet secrets or addresses. I found no host-page keylogger, clipboard reader, screenshot capture, or arbitrary form-value collector.
Contains packaged mnemonic, private-key, and transaction-signing code used by the wallet. — scripts/background/background.js:2359
Does not request clipboardRead or screen/desktop-capture permissions; all-site access alone does not establish keystroke collection. — manifest.json:97-122
Can a website or remote server send commands that make the extension take actions?
Dapps can send wallet-provider requests to the extension, and OKX services supply phishing decisions, feature flags, domains, links, and other behavior-changing data. The sandbox hot-code parent/child channels accept matching message shapes without explicit event.source or origin validation.
Forwards supported page-provider streams into a chrome.runtime port while checking the expected page window and origin. — scripts/lib/all.js:1
Accepts postMessage data containing cdn/buildType/browser without checking the sender, then downloads and evaluates code. — sandbox.html:20-56
Posts to the sandbox with targetOrigin '*' and accepts channel/status responses used for privileged UI configuration without checking event.source or origin. — scripts/ui/ui.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It can add Instant Trade UI to HTTPS sites, augment X/Twitter and Solscan, open wallet or partner links, and redirect risky pages to a warning. These features fit the wallet/trading product; no covert affiliate-code, cart, ad, or search-result rewriting was found.
Declares all-HTTPS Instant Trade and site-specific X/Twitter, Solscan, and Trezor scripts. — manifest.json:32-72
Can inject an Instant Trade button/iframe under wallet feature-state control and reports user interactions with that interface. — scripts/lib/instantTrade.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
The requested permissions omit proxy, webRequest, webRequestBlocking, declarativeNetRequest, debugger, and downloads. — manifest.json:97-125
Risk handling is implemented as a tabs.update navigation to a packaged warning page rather than network-layer interception. — scripts/background/background.js:5143
Can it communicate with software on the computer or services running on localhost?
Its all-HTTP/HTTPS website access includes localhost, and bundled wallet/chain tooling contains local development and hardware-wallet bridge services. It has no nativeMessaging permission and I found no direct control of unrelated desktop applications.
Broad http://*/* and https://*/* host permissions include loopback and local web services. — manifest.json:123-126
Loads a dedicated integration on connect.trezor.io popup pages but does not declare nativeMessaging. — manifest.json:57-72
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Selects a remote CDN URL, fetches the file, converts it to text, and executes it through eval. — sandbox.html:8-51
Declares sandbox pages with unsafe-eval but without allow-same-origin, isolating their scripts from normal extension APIs. — manifest.json:88-96, 163-169
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites receive web-accessible multichain wallet providers and can request accounts, connections, signatures, and transactions through a content-script bridge. Source/origin checks and wallet approvals reduce the risk, but the bridge deliberately exposes security-sensitive functionality.
Makes inpage.js and secure-iframe.html available to matching websites, including inpage.js on all URLs. — manifest.json:128-162
Connects injected provider streams to the extension runtime using the current page origin and window-source checks. — scripts/lib/all.js:1
Routes untrusted provider connections to accounts, signing, transaction, permission, and user-approval controllers. — scripts/background/background.js:5134
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Remote feature flags and hot-code responses can selectively show components, change service domains, and enable site-specific integrations, while phishing rules target particular domains. I found no evidence that this selectivity is used to attack chosen victims or conceal malicious behavior.
The hot-code bridge exposes allowShowComponent, requestHotCodeData, link, host, staticDomain, apiDomain, and passwordSecurity channels. — scripts/ui/ui.js:1
Activates additional packaged integrations only on HTTPS, X/Twitter, Solscan, and Trezor Connect pages. — manifest.json:32-72
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Cryptographic code is wired into key derivation, signatures, and transaction operations rather than a mining pool or background work allocator. — scripts/background/background.js:2359, 5134
system.cpu is available, but there is no proxy permission or declared mining-related service; CPU access is used to read modelName. — manifest.json:97-122
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The generic all-site path establishes provider messaging rather than enumerating or mutating form controls. — scripts/lib/all.js:1
The broad HTTPS UI path injects the wallet's Instant Trade controls and iframe, not changes to existing forms or their action destinations. — scripts/lib/instantTrade.js:1