For a few critical days last November, a sophisticated and malicious browser extension managed to rank as the fourth most prominent search result for the term "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively named "Safery: Ethereum Wallet," was designed with enough polish and attention to detail to easily pass as a legitimate cryptocurrency management tool to even moderately cautious users. It featured a clean, modern icon, a generic yet reassuring name adjacent to security-oriented language, a sudden and overwhelming influx of five-star reviews, and boilerplate descriptions that have become entirely familiar to anyone who has ever downloaded a digital asset wallet.
However, hidden directly behind this polished frontend was a purpose-built attack mechanism. The extension was engineered to steal sensitive user seed phrases and systematically empty unsuspecting victims’ wallets by cleverly encoding stolen security secrets into micro-transactions routed through the Sui blockchain.
The security tooling company Socket, which focuses heavily on open-source software supply chains, installed and closely analyzed the extension immediately after it was brought to light. Their primary objective was to understand how "Safery" successfully evaded automated detection systems, climbed the competitive Chrome Store rankings, and exfiltrated sensitive seed phrases without ever raising alarms, as well as to determine what proactive steps users could take to spot similar looming threats. The resulting security report walks thoroughly through the attacker’s unconventional approach, serving simultaneously as a postmortem of the security failure and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
This particular security incident is noteworthy because the malicious actors behind it did not simply rely on traditional tactics like spoofing an existing, trusted wallet brand. Unlike past scams, it was not a MetaMask lookalike or a recycled phishing domain designed to catch typos. Instead, the creators invented an entirely new identity, purchased or generated bot-driven fake reviews to artificially climb search rankings, and successfully launched as a seemingly fresh and innovative wallet option. This deliberate strategy meant the store listing displayed virtually no immediate red flags: there was no broken grammar in the descriptions, no requests for bizarre or excessive permissions, and no suspicious redirections to shady external domains.
Furthermore, the Chrome Web Store publisher page carried no prior user complaints, and its designated support URL led directly to an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s detailed analysis. Given its professional appearance and high visibility, the average user would likely not have hesitated for even a second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a remarkably common and expected request for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, it did not prompt users for extra permissions or attempt to inject content scripts that would typically trigger Chrome’s more aggressive warning prompts. The overall branding was minimalist, the companion website perfectly matched the extension’s name, and the initial setup screen naturally prompted users to create or import a wallet—reinforcing standard, expected behavior.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their recovery seed phrase. Rather than storing the phrase locally on the machine or properly encrypting it for user access, the extension silently and methodically split the phrase into small fragments. It then encoded these fragments to look like random, ordinary wallet addresses.
Socket’s comprehensive research shows that these fragmented secrets were directly inserted into active Sui blockchain transactions. Specifically, the extension issued minuscule SUI token transfers—amounts so small they would never draw attention—to addresses directly controlled by the attacker. Hidden deep inside those transactions, either tucked away neatly in memo fields or disguised within obfuscated addresses, were the broken pieces of the user’s private seed phrase.
This tactical approach offered distinct operational advantages to the hackers. It completely eliminated the need for the extension to send outbound network requests to malicious command-and-control servers. There was no suspicious beacon pinging a remote server and no data exfiltration over HTTP or WebSockets that a modern web browser or traditional antivirus software might catch and flag as malicious. Instead, the payload gracefully left the user’s local device disguised as a completely normal-looking blockchain transaction, expertly routed through a widely used, low-fee blockchain network. Once securely on-chain, the data was publicly accessible, allowing the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and sweep connected wallets clean without ever needing to touch the user’s device again.
In effect, the sophisticated scam weaponized the Sui blockchain itself, turning it into an encrypted communications channel. Because the Sui network features remarkably fast transaction confirmation times and negligible gas costs, it functioned precisely like a low-latency message bus for the thieves. Socket successfully traced multiple examples of these seed-fragment transactions, definitively confirming the direct link between the initial seed entry within the fake extension and the eventual loss of digital assets. While the actual thefts of funds occurred off-chain—typically on Ethereum or other Layer-1 networks where the victims’ wallets held substantial balances—the precise instructions for executing those thefts were hidden directly in plain sight.
Before finally releasing the version that managed to secure a spot in Chrome’s top wallet search results, the publisher likely tested this novel methodology in private. Forensic evidence suggests that earlier, unreleased builds experimented with much simpler data leaks before the Sui encoding technique was fully refined. By the time the active extension was finally flagged and reported, it had accumulated enough installations to comfortably reach Chrome’s "trending" tier, which further amplified its visibility. Reports indicated that the "Safery" wallet sat comfortably among the top organic results for "Ethereum wallet" searches even as mounting reports of suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged entirely on the underlying mechanics of Chrome’s search and ranking logic. The official Web Store search algorithm heavily weighs keyword matching, total install counts, review velocity, average user ratings, and update recency. Browser extensions that experience a sudden, manufactured burst of activity—especially within niche categories—can climb search rankings rapidly if more thoroughly vetted competitors are not updated frequently by their developers. In this specific case, "Safery" boasted a keyword-optimized name that scored exceptionally well for common user queries, a rapid blitz of positive reviews that were largely templated or duplicated, and a fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to its public publication. Chrome Web Store policies typically subject most new extension submissions to a brief automated scan and fundamental static analysis rather than exhaustive human oversight. Extensions generally undergo deeper scrutiny only when they request elevated, sensitive permissions, such as direct access to open browser tabs, the clipboard, local file systems, or browsing history. Wallet extensions routinely manage to avoid these aggressive flags by operating securely within iframes or utilizing officially approved application programming interfaces. "Safery" carefully stayed within those permitted operational bounds.
Even when vigilant users raised valid concerns about the extension, the time lag between initial reporting and eventual store takedown stretched on long enough for substantial financial damage to occur. Part of this delay is structural: the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or known malware signatures already cataloged in security databases. In this instance, the malicious payload consisted of heavily obfuscated JavaScript that relied entirely on legitimate blockchain infrastructure rather than external hosting providers. Traditional malware detection methods simply failed to catch it in time.
This security breach is far from the first time browser extensions have been exploited to steal cryptocurrency from unwary users. Previous historical scams have included fake Ledger Live companion apps that prompted users to enter sensitive recovery phrases, or hijacked legitimate extensions that allowed malicious actors to gain access to a developer’s publishing keys. What made the "Safery" incident uniquely dangerous, however, was the incredible smoothness of its functional facade and the total absence of traditional backend infrastructure. There was no phishing website to take down, and no rogue server to block—just a single browser extension quietly moving secret data onto a public blockchain and walking away undetected.
Users who fell victim still had limited avenues for recourse. If they acted with extreme urgency, they could minimize their total exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized applications. Socket and other independent security researchers promptly published triage steps for anyone who had installed the extension: uninstall the tool immediately, revoke any active token approvals, sweep remaining digital assets to a completely new wallet created on a clean and secure device, and carefully monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who stored massive amounts of wealth in vulnerable hot wallets, financial recovery remained virtually impossible.
The broader security incident has prompted security researchers, developers, and industry watchdogs to call for significantly stronger heuristics and safety checks directly from Google. One frequently proposed solution is to automatically flag and block any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase. Another advocated approach is to require mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the codebase behind a recognized, legitimate wallet brand. Furthermore, there are growing demands for much tighter security inspections of wallet-related permissions, even when those applications do not explicitly request dangerous access patterns.
For everyday end users, security firms continue to stress practical checklists for safe extension management. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s historical track record, verify direct associations with known and trusted projects, inspect review patterns for artificial bursts of identical feedback, check for real website links backed by public code repositories, and closely scan the permissions tab for vague or sweeping access requests. A clean name and a high star rating are simply no longer enough to guarantee safety in the modern web environment.
This alarming case ultimately raises much broader questions regarding the browser’s expanding role in the cryptocurrency space. Browser-based wallets originally gained widespread popularity primarily due to their accessibility and ease of use, allowing everyday users to interact seamlessly with complex decentralized applications without needing to switch platforms or download standalone desktop applications. However, that vital accessibility has come at a severe cost to security and exposure. The modern web browser remains a notoriously high-risk environment, constantly subjected to malicious extension manipulation, session hijacking, hidden clipboard scrapers, and now, covert blockchain exfiltration techniques.
Wallet developers will likely be forced to rethink their entire distribution models moving forward. Some development teams already actively discourage Chrome Web Store installations, preferring to guide users exclusively toward dedicated mobile applications or standalone desktop binaries. Others may soon implement integrated warnings for users attempting to install wallet software from unverified sources.
The core underlying problem remains stubborn and unresolved: software distribution is heavily fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a legitimate, secure wallet from a polished, malicious clone. The "Safery" extension proved conclusively that attackers no longer need to successfully impersonate industry giants like MetaMask or Phantom to steal funds. By simply creating an entirely new brand, seeding artificial trust signals, and building an invisible backdoor that quietly used a public blockchain as an efficient courier, they managed to bypass human vigilance. This reality demands a fundamental rethinking of how trust is established in cryptocurrency user experiences, highlighting the uncomfortable truth that in the wrong hands, a standard browser wallet functions less like a secure digital vault and more like an open port—and the browser will not always warn you before something slips through.
