For a critical window of time last November, a sophisticated malicious Chrome extension managed to climb the ranks of the Chrome Web Store, securing the fourth position for the heavily searched keyword “Ethereum wallet.” Disguised under the name “Safery: Ethereum Wallet,” the application was engineered with a level of polish and visual deception that allowed it to blend seamlessly among legitimate tools in the crowded Web3 ecosystem. It featured a clean, professional icon, a generic yet comforting nomenclature adjacent to industry security language, a rapid influx of five-star reviews, and standard onboarding descriptions that are instantly familiar to anyone who has ever ventured into decentralized finance.
However, beneath this benign and polished frontend lay a purpose-built attack mechanism. The extension was designed to systematically steal user seed phrases and completely drain associated wallets by encoding the stolen cryptographic secrets directly into micro-transactions on the Sui blockchain. The threat was brought to light only after security tooling company Socket, which specializes in open-source software supply chains, installed and deeply analyzed the extension following its discovery in the wild.
Socket’s investigation aimed to uncover the mechanics behind how “Safery” successfully bypassed Google’s automated detection systems, manipulated the Chrome Store’s internal search rankings, and exfiltrated sensitive seed phrases without triggering immediate alarms. Furthermore, the security firm sought to provide actionable insights into how everyday users could spot similar threats in the future. The resulting technical report serves as both a detailed postmortem of the security breach and a stark warning that browser-based extensions remain a dangerously overlooked blind spot in the broader cryptocurrency landscape.
What makes this particular incident stand out among the countless security breaches plaguing the industry is that the malicious actors behind Safery did not rely on the well-trodden territory of brand spoofing. Unlike historical phishing attempts or malware campaigns that routinely imitate established wallet giants like MetaMask, or redirect users to malicious domain lookalikes, Safery forged an entirely original identity. The creators invented a brand new wallet option from scratch, utilizing automated bots or purchased feedback loops to flood the listing with positive reviews, thereby manufacturing artificial trust and rapidly scaling the search rankings as a brand new contender.
This calculated approach ensured that the extension’s store listing remained entirely devoid of immediate red flags. There was no broken English or awkward grammar in the descriptions, no suspicious or overly broad permissions requested upfront, and no redirect links pointing toward shady, blacklisted domains. Furthermore, the Chrome Web Store publisher page associated with the extension had a pristine history free of prior complaints, and its designated support URL led to an off-platform website that security trackers had not yet flagged at the time of Socket’s analysis.
Given this veneer of absolute legitimacy, the average cryptocurrency user would have felt little to no hesitation before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites"—a ubiquitous request for crypto wallets that require seamless interaction with various decentralized applications across the web. Crucially, the extension avoided prompting for extra, highly sensitive permissions or attempting to inject complex content scripts that typically trigger Chrome’s more aggressive security warnings. The overall branding was minimalist, the accompanying website mirrored the extension’s exact name, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one, mimicking standard industry behavior down to the smallest detail.
The Seed Heist, Broadcasted Over the Sui Blockchain
The true destructive payload of the extension activated the moment a user inputted their sensitive recovery seed phrase. Rather than storing the phrase locally within the browser’s storage or encrypting it for convenient user access, the extension silently and instantly fractured the recovery phrase into discrete fragments. It then cunningly encoded these hidden pieces into what appeared to ordinary onlookers to be completely random, innocuous wallet addresses.
According to Socket’s comprehensive research, these fragmented pieces of data were injected directly into transactions executed on the Sui blockchain. Specifically, the malicious extension systematically issued minuscule SUI token transfers—amounts so negligible that they would never draw the attention of automated monitoring tools or the user—to wallet addresses directly controlled by the attackers. Embedded deep within those seemingly routine transactions, tucked away inside memo fields or hidden via obfuscated address parameters, were the exact cryptographic components of the victim’s seed phrase.
This clever methodology provided the attackers with significant tactical advantages. By leveraging the blockchain itself, the extension completely eliminated the need to send outbound network requests to external, malicious command-and-control servers. There was no suspicious HTTP exfiltration beacon or external WebSocket connection that an antivirus program or a browser security extension might catch and flag. Instead, the malicious payload left the user’s device disguised as a completely normal, legitimate-looking blockchain transaction, routed smoothly through a widely utilized, low-fee blockchain network.
Once successfully broadcasted on-chain, the data became permanently and publicly accessible. This allowed the attackers to quietly retrieve the information at their leisure, reconstruct the complete seed phrase, and sweep the victims’ assets across various layer-1 networks without ever needing to interact with the compromised user’s device a second time. In effect, the scammers repurposed the Sui blockchain infrastructure to function as a covert, low-latency communications channel. Because the Sui network boasts exceptionally fast confirmation times alongside practically negligible transaction costs, it operated with the efficiency of an invisible message bus.
Socket successfully traced multiple instances of these unique seed-fragment transactions, definitively confirming the direct causal link between the entry of a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts of cryptocurrency occurred off-chain—typically on Ethereum or other major layer-1 networks where the unsuspecting victims held substantial fund balances—the operational instructions required to execute the thefts were hidden entirely in plain sight.
Evidence uncovered during the analysis indicates that the publisher likely tested this novel exfiltration method in private environments before releasing the final version that ultimately captured a top spot in Chrome’s wallet search results. Earlier, discarded builds showed experimentation with simpler, less sophisticated data leaks before the Sui encoding mechanism was thoroughly refined. By the time the active, malicious extension was finally exposed and flagged, it had already accumulated enough installs to secure a coveted spot in Chrome’s "trending" tier, giving it an extra layer of visibility and legitimacy. Reports from outlets like Brave New Coin confirmed that the Safery wallet remained perched prominently among the top results for "Ethereum wallet" searches even as mounting warnings about suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Allowed the Scam to Flourish
The operational success of the Safery extension relied heavily on the underlying ranking logic of the Chrome Web Store search algorithm. The store’s algorithm typically weighs a combination of factors, including exact keyword matching, total install counts, review velocity, average user ratings, and the recency of the last update. Extensions that experience a sudden, sharp burst of user activity—particularly within niche categories where long-standing, well-vetted competitors are not updated frequently—can climb search results at an alarming pace. In this instance, Safery combined a highly optimized name that scored well for frequent user queries, an aggressive blitz of positive reviews that often featured templated or duplicated text, and a freshly minted upload date.
There is no evidence to suggest that Google manually reviewed the Safery listing prior to its public publication. The Chrome Web Store policy typically subjects newly submitted extensions to a brief automated scan alongside fundamental static analysis. Deeper, manual scrutiny is generally reserved for extensions that request explicitly elevated and dangerous permissions, such as widespread access to user tabs, system clipboards, local file systems, or browsing history. Because crypto wallets frequently bypass these specific warning flags by operating securely within localized iframes or utilizing standard approved application programming interfaces, Safery managed to stay neatly within acceptable boundaries.
Even when vigilant users began to raise alarms and report the suspicious behavior, the lag time between the initial reporting and the eventual takedown by platform administrators stretched out long enough for extensive financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not automatically disable or remove flagged extensions instantaneously unless there is an overwhelming consensus of reports or a recognized, definitive malware signature. Because the extension’s payload relied on obfuscated JavaScript interacting directly with public blockchain infrastructure rather than contacting known malicious external hosts, traditional signature-based malware detection methods completely failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to target cryptocurrency holders. Previous security scams have ranged from fraudulent Ledger Live web applications that tricked users into typing out their recovery phrases, to compromised legitimate extensions where external attackers managed to hijack the original developer’s publishing keys. However, what fundamentally distinguished the Safery campaign was the remarkable smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website to dismantle, and no external command server to block—just a single browser extension quietly parsing secrets onto a public ledger and walking away.
For users who fell victim to the scheme, recovery options were exceptionally narrow and heavily dependent on rapid action. Those who acted immediately could limit their overall exposure by quickly generating new seed phrases, rotating their assets, and systematically revoking outstanding transaction approvals across various protocols. Socket and other collaborating security firms published urgent triage steps for anyone who had installed the extension: uninstall the application immediately, revoke all active token approvals, sweep remaining digital assets to a freshly initialized wallet using an entirely clean and unaffected device, and closely monitor all associated addresses. For users who failed to notice the silent exfiltration in time, or for those who maintained large asset balances within vulnerable hot wallets, financial recovery remained virtually impossible.
The Broader Implications for Web3 Security
In the wake of the incident, security researchers, developers, and industry analysts have ramped up calls for stronger heuristics and proactive safeguards from Google and other browser manufacturers. Among the most prominent proposals is the implementation of automated flagging systems that would immediately intercept and scrutinize any browser extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another widely discussed solution involves mandating strict publisher attestation protocols for all wallet-related extensions. This would provide verifiable, cryptographic proof that a specific developer officially controls the underlying codebase associated with a recognized wallet brand. Furthermore, industry experts are advocating for much tighter inspections of wallet-related permissions, arguing that regulatory oversight should catch subtle risks even when extensions avoid requesting traditionally dangerous access patterns.
For end users navigating the complex Web3 space, Socket published a practical checklist designed to improve extension management hygiene. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s historical track record, verify official associations with known and trusted projects, carefully inspect review patterns for obvious anomalies like bursts of identical five-star ratings, cross-reference real website links with public GitHub repositories, and scrutinize the permissions tab for vague or overly sweeping access demands. A clean product name and a high aggregate rating are no longer sufficient guarantees of safety.
This disturbing case inevitably raises broader, systemic questions regarding the browser’s central role in the modern cryptocurrency experience. Browser-based wallets exploded in popularity primarily due to their accessibility and frictionless user experience, enabling individuals to interact seamlessly with decentralized finance applications without needing to switch operating platforms or download standalone desktop software.
However, that crucial accessibility has come at the severe cost of heightened exposure. The modern web browser remains a notoriously high-risk environment subject to constant threats, including extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based exfiltration. As a result, wallet developers are increasingly likely to rethink their long-term distribution models. Some prominent development teams already actively discourage Chrome Web Store installations, preferring instead to steer users toward dedicated mobile applications or standalone desktop binaries. Others may soon introduce mandatory in-app warnings whenever users attempt to install software from unverified or newly minted sources.
Ultimately, the core structural problem persists: software distribution remains heavily fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a legitimate, highly secure self-custody wallet from a meticulously polished clone.
The Safery extension proved conclusively that malicious actors no longer need to impersonate established giants like MetaMask or Phantom to succeed. By engineering a completely novel brand, artificially seeding trust signals, and constructing an invisible backdoor that utilized the Sui blockchain itself as a courier, the attackers bypassed traditional security paradigms. This reality demands a profound rethinking of how trust is established within cryptocurrency user interfaces, and how close to the underlying operating system even casual tools like browser extensions truly operate. Crypto users frequently operate under the foundational assumption that Web3 technology inherently guarantees digital sovereignty and absolute self-custody. Yet, in the wrong hands, an unvetted browser wallet ceases to function as a secure vault—instead transforming into an open port. And as the Safery incident demonstrates, browser platforms will not always issue a warning before something slips quietly through.
