Cross-referencing on-chain data: The receiving address linked to this extension's theft operation has been flagged by Chainalysis, TRM Labs, and Elliptic as a known fraud wallet. This is a confirmed theft ring.