# XMRtab (Monero Wallet · Standalone)

Category: wallets · Desktop
Grade: F
Highlights: DO-NOT-USE, BROWSER-EXTENSION, HIDDEN-CODE
Last verified: 2026-10-21
Operating since: 2026-10 (0y) — GitHub account created 2026-09-30, repository 2026-10-02.

## INCIDENT (2026-10-21, severity: critical)
The Chrome Web Store build (v2.4.0) contains code absent from the public repo: a custom-compiled wallet engine with two extra functions, and a 90-second routine that sends a hidden string, cut into 64-character chunks and disguised as transaction lookups, to node.xmrtab.com along with a browser fingerprint, regardless of the node you chose.

Curator advice: Do not install it. If you did, treat your seed as compromised: create a new wallet in a different trusted app, move your funds, and remove the extension.
Source: https://chromewebstore.google.com/detail/lkabbmdknccomhhhfhnljhfpofnhhifm

> Chrome-extension Monero wallet whose store build hides a data channel to its own server. Do not install it; if you did, move your funds to a new wallet.

## Review

**Do not use this wallet.** "Monero Wallet · Standalone" (xmrtab.com) presents itself as an open-source, non-custodial Monero wallet for Chrome, built on the official monero-ts library. The website and the code on GitHub look clean. The version actually served by the Chrome Web Store is not that code.

**What we found in the store build.** We downloaded version 2.4.0 straight from the Chrome Web Store (extension id `lkabbmdknccomhhhfhnljhfpofnhhifm`, package SHA-256 `5d10f7fb0b260abc2338118717815e526683583cb073d0df38891a805e2bad0a`) and compared it with official monero-ts 0.11.15, the version it claims to use:

- The wallet engine (the WebAssembly code that holds your keys) was compiled separately and contains two functions that don't exist in monero-ts: `get_node_health_state` and `set_node_health_device`.
- Every 90 seconds, the extension passes your browser's fingerprint (user agent, languages, time zone, CPU count, memory, platform) into the engine, reads a hidden string back out, cuts it into 64-character pieces and sends them to `node.xmrtab.com` disguised as ordinary transaction lookups. It does this no matter which node you chose in the settings.
- Anything it couldn't send is stored in the browser and retried later.
- None of this code is in the public GitHub repository, which is still at version 2.3.0. The extension's own "provenance" file also gives a wrong hash for the original monero-ts code.

We haven't decoded what the hidden string contains. A covert channel built into the code that holds your private keys has no innocent explanation, so we treat the wallet as malicious.

**If you installed it.** Assume your seed is compromised. Create a new wallet in a different, trusted app (on a clean device if you can), move your funds to it, and remove the extension.

Source: https://xmr.club/wallets/xmrtab