Browser add-ons can steal your crypto and identifying information, said Casa’s Jeremy Welch