For a few critical days last November, a sophisticated and malicious Chrome extension managed to climb the ranks of the Chrome Web Store, briefly securing the fourth spot for the highly competitive search query "Ethereum wallet."
The application, deceptively named "Safery: Ethereum Wallet," was engineered with enough visual polish and attention to detail to easily pass as a legitimate piece of Web3 software. It featured a clean, professional icon, a generic yet security-adjacent name, a massive influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a decentralized finance tool.
Beneath this convincing frontend, however, lay a purpose-built attack mechanism designed specifically to harvest user seed phrases and systematically empty unsuspecting victims’ wallets. Rather than relying on traditional methods of data theft, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain, bypassing standard security monitoring tools entirely.
The threat was uncovered and subsequently analyzed in depth by Socket, a security tooling company that focuses heavily on open-source software supply chains. Security researchers at the firm installed and examined the extension to understand how "Safery" managed to completely evade detection, rapidly climb the Chrome Store search rankings, and exfiltrate sensitive seed phrases without raising immediate alarms. Their subsequent technical report functions as both a detailed postmortem of the security failure and a stark warning that browser extensions continue to represent a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular case so notable to cybersecurity professionals is that the hackers behind the operation did not rely on traditional spoofing tactics. Imitating an existing, trusted wallet brand—such as creating a MetaMask lookalike or deploying a recycled phishing domain—is an unfortunately well-trodden and heavily monitored territory in the crypto threat landscape. Instead, Safery invented an entirely new identity from scratch, utilized bought or botted fake reviews to manipulate search algorithms, and successfully launched itself as a fresh, legitimate wallet option.
Because of this unique approach, the store listing presented virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious or overly broad permissions requested upfront, and no redirection attempts to shady external domains. Furthermore, the Chrome Web Store publisher page had no prior history of complaints or violations, and its designated support URL led directly to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s analysis.
Given its polished appearance and professional presentation, the average user would have had little reason to hesitate before clicking the "Add to Chrome" button. The extension requested permission to run on all websites, which is a completely standard and necessary requirement for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, it refrained from prompting users for extra, unusual permissions and avoided injecting content scripts that might have triggered Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the accompanying website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—behavior that is entirely standard for the industry.
The Seed Heist, Broadcast Over Sui
The true damage of the operation began the moment a user entered their recovery seed phrase. Instead of storing the phrase locally within the browser storage or encrypting it for legitimate user access, the extension silently split the recovery phrase into discrete fragments and encoded them to look like random, innocuous wallet addresses.
Socket’s comprehensive research revealed that these hidden fragments were systematically inserted directly into Sui blockchain transactions. Specifically, the malicious extension executed tiny SUI token transfers—minuscule amounts of cryptocurrency designed to draw zero attention from users or automated trackers—and sent them to wallet addresses completely controlled by the attacker.
Hidden securely inside those transactions, either embedded within memo fields or obfuscated directly within the transaction addresses, were the critical pieces of the victim’s seed phrase. This tactical approach provided major advantages for the hackers. Because the data was transmitted as part of a blockchain transaction, the extension did not need to send outbound network requests to malicious command-and-control servers. There were no suspicious HTTP beacons or outbound WebSockets connections that a browser security extension or traditional antivirus software might easily flag and intercept.
Instead, the payload left the user’s device disguised as a completely normal, everyday blockchain transaction routed through a widely used, low-fee blockchain network. Once successfully logged on-chain, the data became publicly accessible, allowing the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and sweep connected wallets clean without ever needing to touch the user’s device a second time.
In effect, the sophisticated scam utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network boasts fast confirmation times and negligible transaction costs, it functioned efficiently like a low-latency message bus for the bad actors. Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts occurred off-chain—primarily on Ethereum or other Layer 1 networks where the victims’ wallets held substantial funds—the precise instructions required to carry them out were hidden entirely in plain sight.
Before releasing the specific version that ultimately landed in Chrome’s top wallet search results, the publisher likely tested the methodology in private development environments. Digital evidence uncovered during the investigation shows that earlier, preliminary builds experimented with much simpler data leakage techniques before the Sui blockchain encoding method was fully refined. By the time the active, malicious extension was finally flagged and reviewed, it had accumulated enough artificial installs to reach Chrome’s coveted "trending" tier, which further boosted its public visibility and victim acquisition rate. Reports from industry outlets confirmed that the Safery wallet remained prominently positioned among the top results for Ethereum wallet searches even as initial warnings and reports of suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged directly on the specific ranking logic utilized by the Chrome Web Store search algorithm. The algorithm heavily weighs factors such as keyword matching, total install counts, review velocity, average user ratings, and the recency of updates.
Browser extensions that experience a sudden burst of activity, particularly within niche categories like cryptocurrency, can climb search rankings rapidly if their more thoroughly vetted competitors are not updated with high frequency. In this specific scenario, Safery combined a keyword-optimized name that scored exceptionally well for common user searches, a coordinated blitz of positive reviews featuring templated or duplicated text, and a very fresh upload date to game the system.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to its publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief automated scan and fundamental static analysis rather than intensive human review.
Deeper scrutiny is generally only triggered when extensions request elevated permissions, such as deep access to browser tabs, the user’s clipboard, local file systems, or browsing history. Wallet extensions frequently manage to avoid these aggressive security flags by operating safely within iframes or utilizing standard, approved application programming interfaces. Safery strictly stayed within those permissible operational bounds.
Even after concerned users began raising alarms and reporting the extension, the time lag between the initial reports and the eventual store takedown stretched on long enough for significant financial damage to occur. Part of that delay is structural; the Chrome Web Store does not act on flagged extensions instantly unless there is an overwhelming consensus of abuse or known, signature-matched malware detected. In this case, because the malicious payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external hosting servers, traditional malware detection signatures failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency from unwary users. Previous prominent scams have included fake Ledger Live companion apps that prompted users to enter their secret recovery phrases, or the compromise of legitimate, long-standing extensions through hijacked developer publishing keys.
What fundamentally sets the Safery incident apart is the exceptional smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no conventional phishing website to take down, and no centralized command server to block—just a single extension quietly moving private secrets onto a public blockchain and walking away.
Impacted users had limited recourse, but those who acted with extreme speed could occasionally limit their overall exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various protocols. Security firms including Socket published urgent triage steps for anyone who had installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets to an entirely fresh wallet using a clean, uncompromised device, and closely monitor all associated addresses. For everyday users who failed to notice the silent exfiltration in time, or who stored large amounts of capital in hot wallets, full asset recovery remained highly unlikely.
Security researchers, developers, and industry advocates are now calling for significantly stronger heuristics directly from Google and the Chrome team. Among the most prominent proposals is a system that would automatically flag and block any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another widely discussed approach involves requiring mandatory publisher attestation for all wallet-related extensions, providing verifiable, cryptographic proof that a given publisher officially controls the underlying codebase behind a known wallet brand. Industry experts are also pushing for much tighter inspection of wallet-related permissions, even in cases where those permissions do not explicitly include dangerous access patterns.
For end users navigating the Web3 space, security firms continue to emphasize the importance of rigorous due diligence. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s history, independently verify their official association with a known and trusted project, inspect review patterns for artificial bursts of identical text, check for real website links backed by public code repositories like GitHub, and carefully scan the permissions tab for vague or sweeping access requests. A clean name and a high star rating are simply no longer enough to guarantee safety in the modern browser environment.
This high-profile incident raises broader, fundamental questions about the role that web browsers play within the broader cryptocurrency ecosystem. Browser-based wallets originally gained massive popularity due to their unparalleled accessibility and ease of use, allowing everyday users to interact smoothly with complex decentralized applications without needing to switch platforms or download separate, standalone desktop applications.
However, that supreme accessibility has come at a severe cost regarding security and exposure. The modern web browser functions as a high-risk operational environment subject to extension manipulation, session hijacking, clipboard scrapers, and now covert blockchain exfiltration techniques.
As a result, wallet developers are increasingly likely to rethink their primary distribution models entirely. Some development teams already actively discourage Chrome Web Store installations, preferring to steer users toward dedicated mobile applications or standalone desktop binaries. Others may soon implement built-in warnings for users attempting to install software from unverified sources.
The core challenge remains that software distribution in the browser ecosystem is heavily fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a legitimate wallet from a polished, malicious clone. The Safery extension demonstrated that attackers no longer need to mimic established brands like MetaMask or Phantom to succeed; they can simply manufacture their own trusted identity, seed artificial trust signals, and construct an invisible digital backdoor that uses a public blockchain as a courier.
