For a few days in November, a malicious Chrome extension managed to secure the fourth spot in search results for the term “Ethereum wallet” on the official Chrome Web Store. The application, which was given the deceptive name “Safery: Ethereum Wallet,” was meticulously designed to pass as an entirely legitimate piece of software. Featuring a clean, professional icon, a generic title that closely mirrored security-focused terminology, a heavy influx of five-star reviews, and boilerplate descriptions that immediately felt familiar to anyone accustomed to downloading decentralized finance tools, the extension presented a deeply convincing front to unsuspecting users.
However, behind that polished user interface lay a purpose-built attack mechanism specifically engineered to capture seed phrases and systematically empty user wallets. Instead of relying on traditional, easily detectable methods of data exfiltration, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
Security tooling firm Socket, which specializes in open-source software supply chains, installed and analyzed the extension shortly after its malicious nature was discovered by the broader cybersecurity community. The primary objective of Socket’s investigation was to understand how "Safery" managed to evade automated detection systems, successfully climb the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without immediately raising alarms. Furthermore, the firm sought to determine what preventative steps users could take to spot similar threats in the future. The resulting technical report details the attacker’s sophisticated approach, serving simultaneously as a postmortem analysis and an urgent warning that browser extensions continue to represent a dangerous and overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the malicious actors did not simply resort to spoofing an existing, well-known wallet brand. Unfortunately, impersonating established entities like MetaMask or recycling defunct phishing domains is a well-trodden and heavily documented territory in the crypto threat landscape. Instead, Safery invented an entirely new digital identity from scratch. The perpetrators purchased or artificially generated fake, botted reviews to systematically climb the store’s search rankings and launched the software as a seemingly brand-new, independent wallet option.
This calculated approach meant that the listing displayed virtually no immediate red flags to casual observers: there was no broken grammar in the descriptions, no request for bizarre or overly aggressive permissions, and no redirection to shady, unverified external domains. The official Chrome Web Store publisher page associated with the extension had no prior history of complaints or violations. Moreover, its listed support URL directed visitors to an off-platform website that had not yet been flagged by any prominent security trackers at the time of Socket’s analysis.
Given its remarkably polished and professional appearance, the vast majority of web users would likely not have hesitated for a single moment before clicking the "Add to Chrome" button. Upon installation, the extension requested permission to run on all websites—a completely standard and necessary request for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, the software did not prompt users for extra, suspicious permissions, nor did it attempt to inject invasive content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the companion website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one, mimicking entirely standard operational behavior.
The Seed Heist, Broadcast Over Sui
The true damage of the campaign began the moment a user entered their recovery seed phrase into the extension. Rather than storing the sensitive phrase locally or attempting to encrypt it for legitimate user access, the extension covertly split the phrase into multiple smaller fragments. It then encoded these fragments to appear as completely random, innocuous wallet addresses.
Socket’s rigorous research demonstrates that these fragmented secrets were quietly inserted directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so negligible that they would never draw the attention of the user or automated monitoring tools—directed toward addresses completely controlled by the attacker. Hidden deep inside the metadata of those transactions, either within designated memo fields or through obfuscated destination addresses, were the broken pieces of the victim’s seed phrase.
This tactical execution provided significant advantages for the cybercriminals. By leveraging this method, the extension completely eliminated the need to send outbound network requests to malicious, external servers. There was no command-and-control beacon communicating over HTTP or WebSockets, which are the typical network indicators that modern browsers or antivirus programs are programmed to flag and block.
Instead, the malicious payload left the user’s local device disguised as a completely normal, everyday blockchain transaction, neatly routed through a widely used, low-fee layer-1 network. Once successfully published on-chain, the data remained publicly accessible, granting the attacker the luxury of retrieving the information at their leisure, reconstructing the original seed phrase, and completely sweeping the victims’ assets without ever needing to touch the user’s device a second time.
In effect, the operation utilized the Sui blockchain itself as an unconventional, highly efficient communications channel. Because the Sui network boasts exceptionally fast confirmation times and negligible transaction costs, it functioned smoothly as a low-latency message bus for the thieves. Socket successfully traced multiple concrete examples of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the subsequent, catastrophic loss of assets. While the actual thefts ultimately occurred off-chain—primarily on Ethereum or other layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the robberies were hidden entirely in plain sight.
Before releasing the final version that managed to secure a coveted spot among Chrome’s top wallet search results, the publisher likely tested the underlying methodology in private environments. Digital evidence uncovered during the investigation suggests that earlier, preliminary builds experimented with much simpler data leakage techniques before the Sui-based encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough automated and organic installations to reach Chrome’s official "trending" tier, which only served to amplify its visibility and attract even more victims. Industry tracking reports confirmed that the Safery wallet persistently occupied top positions for "Ethereum wallet" searches even as reports of suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged directly on the specific mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm heavily weights factors such as exact keyword matches, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden, sharp burst of user activity, particularly within specialized or niche categories, can climb search rankings rapidly if their more thoroughly vetted competitors are not updated with equal frequency. In this particular instance, Safery benefited from a name that scored exceptionally well for common search queries, a coordinated blitz of positive reviews that relied heavily on templated or duplicated text, and a very fresh upload date.
Available records show no evidence that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy subjects most newly submitted extensions to little more than a brief automated scan and fundamental static code analysis. Extensions typically undergo much deeper, manual scrutiny only when they explicitly request highly elevated permissions, such as deep access to browser tabs, the system clipboard, local file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter flags by carefully operating within isolated iframes or utilizing standard, approved application programming interfaces. Safery strictly remained within those permissible operational bounds.
Even when vigilant users began raising serious concerns and reporting the extension, the lag time between the initial reports and the eventual takedown stretched on long enough for extensive financial damage to occur. Part of this vulnerability is structural: the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of abuse or known malware signatures match the code. In this scenario, the payload consisted of heavily obfuscated JavaScript that relied entirely on legitimate blockchain infrastructure rather than external, malicious hosts, meaning traditional malware detection mechanisms failed to catch it.
This incident is far from the first time browser extensions have been weaponized to steal cryptocurrency from unwary users. Previous historical scams have involved fake Ledger Live application listings that prompted users to enter their recovery phrases directly, or instances where legitimate, established extensions were hijacked to allow attackers access to the original developer’s publishing keys.
What truly distinguished Safery from previous campaigns was the remarkable smoothness of its facade and the near-total absence of traditional backend infrastructure. There was no phishing website that authorities could easily take down, and no command server to block; there was merely a single, functional extension quietly moving secrets onto a public blockchain and walking away.
Impacted users retained very limited recourse. For those who acted with extreme speed, limiting their ongoing exposure required immediately rotating their seed phrases and revoking all prior token approvals connected to their wallets. Socket and other prominent security firms quickly published comprehensive triage steps for anyone who had mistakenly installed the extension: uninstall the software immediately, revoke any outstanding token approvals, sweep remaining digital assets to a brand-new wallet generated on a completely clean device, and continuously monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who stored large amounts of capital directly in vulnerable hot wallets, asset recovery remained virtually impossible.
Industry researchers and independent developers are now urgently calling for much stronger heuristics and automated safeguards from Google itself. One frequently proposed solution involves automatically flagging and blocking any extension that includes user interface elements prompting for a 12- or 24-word recovery phrase. Another suggested approach is to mandate publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase associated with a recognized wallet brand. Additionally, experts are pushing for much tighter regulatory inspection of wallet-related permissions, even in cases where those permissions do not explicitly trigger dangerous access patterns.
For everyday end users, security firms continue to stress the importance of rigorous personal verification habits. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s history, verify concrete associations with known and trusted development projects, carefully inspect review patterns for obvious signs of manipulation or bursts of identical text, check for legitimate website links backed by public GitHub repositories, and carefully scan the permissions tab for vague or sweeping system access. As the Safery incident clearly demonstrates, a clean name, minimalist design, and high star rating are simply no longer enough to guarantee safety in the Web3 space.
