XMRtab (Monero Wallet · Standalone)

Do not use this wallet. "Monero Wallet · Standalone" (xmrtab.com) presents itself as an open-source, non-custodial Monero wallet for Chrome, built on the official monero-ts library. The website and the code on GitHub look clean. The version actually served by the Chrome Web Store is not that code.

What we found in the store build. We downloaded version 2.4.0 straight from the Chrome Web Store (extension id `lkabbmdknccomhhhfhnljhfpofnhhifm`, package SHA-256 `5d10f7fb0b260abc2338118717815e526683583cb073d0df38891a805e2bad0a`) and compared it with official monero-ts 0.11.15, the version it claims to use:

• The wallet engine (the WebAssembly code that holds your keys) was compiled separately and contains two functions that don't exist in monero-ts: `get_node_health_state` and `set_node_health_device`.
• Every 90 seconds, the extension passes your browser's fingerprint (user agent, languages, time zone, CPU count, memory, platform) into the engine, reads a hidden string back out, cuts it into 64-character pieces and sends them to `node.xmrtab.com` disguised as ordinary transaction lookups. It does this no matter which node you chose in the settings.
• Anything it couldn't send is stored in the browser and retried later.
• None of this code is in the public GitHub repository, which is still at version 2.3.0. The extension's own "provenance" file also gives a wrong hash for the original monero-ts code.

We haven't decoded what the hidden string contains. A covert channel built into the code that holds your private keys has no innocent explanation, so we treat the wallet as malicious.

If you installed it. Assume your seed is compromised. Create a new wallet in a different, trusted app (on a clean device if you can), move your funds to it, and remove the extension.