For a brief and alarming window in November, a malicious browser extension masquerading as a crypto management tool managed to climb the ranks of the Chrome Web Store, briefly seizing the fourth position for the heavily trafficked search term "Ethereum wallet."
The application, baptised under the deceptive moniker "Safery: Ethereum Wallet," was engineered with enough technical polish and aesthetic deception to easily pass as a legitimate piece of software to the average web user. It featured a crisp, professional icon, a generic name carefully chosen to sit adjacent to security-oriented language, a rapid influx of five-star reviews, and standard boilerplate descriptions that are instantly familiar to anyone who has ever downloaded a decentralized finance tool.
Beneath that clean frontend, however, lay a purpose-built attack mechanism. The extension was designed to silently harvest seed phrases and systematically empty user wallets by cleverly encoding stolen secrets into micro-transactions routed across the Sui blockchain.
The threat was brought to light and thoroughly dissected by Socket, a prominent security tooling company specializing in the safety of open-source software supply chains. Researchers at the firm installed and examined the extension shortly after its discovery to understand how "Safery" managed to completely evade automated detection systems, manipulate the Chrome Store ranking algorithm, and exfiltrate sensitive credentials without raising immediate red flags. Their subsequent technical report serves simultaneously as a forensic postmortem and a stark warning that browser extensions remain a critically vulnerable blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident stand out to cybersecurity experts is that the threat actors behind the scheme did not rely on the well-trodden tactics of spoofing an existing, trusted wallet brand. It was neither a fraudulent MetaMask clone nor a recycled phishing domain designed to trick users through typo-squatting. Instead, the creators invented an entirely new digital identity, purchased or generated bot-driven fake reviews to artificially boost their search rankings, and launched the software as a novel, independent wallet option.
This calculated approach meant the store listing was virtually devoid of the glaring red flags that security-conscious users typically look for. There was no broken grammar in the descriptions, no requests for bizarre or excessive permissions, and no suspicious redirections to shady external domains. The official Chrome Web Store publisher page carried no prior complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket’s analysis.
Given its convincing exterior, the vast majority of web users would have experienced little hesitation before clicking the "Add to Chrome" button. Upon installation, the extension requested permission to run across "all websites"—a ubiquitous request for crypto wallets that must interact seamlessly with a wide variety of decentralized applications. Notably, the software did not prompt users for elevated permissions or attempt to inject content scripts that might have triggered Chrome’s more aggressive security warnings. Its branding remained minimalist, the accompanying website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a new wallet or import an existing one, mimicking entirely standard industry behavior.
The Seed Heist, Broadcast Over Sui
The true financial damage began almost immediately once a victim entered their private seed phrase. Rather than storing the recovery phrase locally or attempting to encrypt it for legitimate user access, the malicious extension silently fragmented the phrase into smaller pieces. It then encoded these fragments into data fields that resembled completely random, innocuous blockchain addresses.
Socket’s detailed research revealed that these broken-down fragments were systematically inserted into Sui blockchain transactions. Specifically, the extension initiated tiny, minuscule transfers of SUI tokens—amounts so negligible that they would never draw the attention of the account holder—directed toward wallet addresses entirely controlled by the attacker. Hidden safely inside those transactions, tucked away either within memo fields or obfuscated recipient addresses, were the individual pieces of the user’s private seed phrase.
This tactical execution provided significant advantages for the hackers. Because the payload was smuggled out via standard network operations, the extension did not need to send outbound HTTP or WebSocket requests to malicious command-and-control servers. There was no obvious beaconing activity that traditional antivirus software or browser monitoring tools could easily flag as anomalous.
Instead, the stolen payload left the user’s device disguised as a completely normal-looking blockchain transaction, routed securely through a widely utilized and low-fee layer-one network. Once successfully published on-chain, the data became publicly accessible, allowing the attacker to retrieve the fragments at their leisure, reconstruct the seed phrase in full, and sweep the victim’s assets clean without ever needing to touch the user’s device again.
In effect, the scam repurposed the Sui blockchain itself to act as an encrypted, low-latency communications channel. Because the Sui network boasts rapid transaction confirmation times and virtually non-existent transaction costs, it functioned as an ideal message bus for data exfiltration. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct link between entering a seed phrase into the fake extension and the subsequent loss of funds. While the actual thefts of assets occurred off-chain—typically on Ethereum or other layer-one networks where the victims’ wallets held their primary capital—the operational instructions for carrying out the heists were hidden entirely in plain sight.
Evidence uncovered during the analysis indicates that the publisher likely tested this novel exfiltration method in private before deploying the version that ultimately landed in Chrome’s top search results. Earlier, discarded builds experimented with simpler data leaks before the Sui encoding scheme was fully refined. By the time the active extension was officially flagged by the security community, it had accumulated enough installations to secure a coveted spot in Chrome’s "trending" tier, further amplifying its visibility. Industry reports confirmed that the "Safery" wallet remained stubbornly positioned among the top results for "Ethereum wallet" searches even as urgent warnings regarding its malicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" scam relied heavily on the underlying mechanics of Chrome’s search ranking logic. The Web Store search algorithm continuously weighs multiple factors, including keyword matches, overall install counts, review velocity, average ratings, and the recency of the last software update.
Extensions that experience a sudden burst of activity, particularly within specialized or niche categories, can climb search rankings rapidly if their more thoroughly vetted competitors fail to update frequently. In this specific scenario, "Safery" capitalized on a name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, highly recent upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to publication. The automated infrastructure of the Chrome Web Store typically subjects new extensions to a brief automated scan alongside fundamental static code analysis. Deeper scrutiny is generally reserved for extensions that request explicitly elevated permissions, such as direct access to browser tabs, the user’s system clipboard, local file systems, or browsing history.
Because legitimate wallet extensions routinely learn to operate safely within iframes or by utilizing approved application programming interfaces, "Safery" managed to carefully stay within those permitted operational bounds. Even when vigilant users began raising concerns and reporting the extension, the lag time between initial reporting and eventual store takedown stretched out long enough for substantial financial damage to occur.
Part of that persistent delay is structural: the Chrome ecosystem does not act on flagged extensions instantaneously unless there is an overwhelming consensus from safety partners or a match with known malware signatures. In this instance, because the malicious payload consisted of obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external hosting servers, traditional malware detection signatures failed to catch it in time.
While this incident is part of a long lineage of browser extensions being weaponized to steal cryptocurrency—ranging from fake desktop app lookalikes to hijacked publisher accounts—"Safery" distinguished itself through the sheer smoothness of its facade and the total absence of traditional backend infrastructure. There was no central phishing website to dismantle, and no rogue server IP address to block; there was merely a single browser extension quietly moving secrets onto a public blockchain and walking away cleanly.
For affected users, available countermeasures were narrow and required immediate action. Security firms rushed to publish triage guidelines advising anyone who had installed the extension to uninstall it immediately, revoke existing token approvals, transfer remaining assets to a fresh wallet generated on a completely clean device, and monitor associated addresses closely. For unsuspecting individuals who failed to notice the silent exfiltration or who kept substantial balances stored within vulnerable hot wallets, recovery of lost funds remained highly unlikely.
Security researchers and independent developers are now increasing pressure on platform operators to implement stronger protective heuristics. Among the proposed industry solutions is the automatic flagging of any browser extension that includes user interface elements prompting for standard recovery phrases. Other recommendations include mandatory publisher attestation requirements for wallet extensions—providing verifiable cryptographic proof that a given publisher genuinely controls the codebase behind an established wallet brand—alongside tighter regulatory inspections of wallet-related permissions, even when those permissions avoid traditional red flags.
For the end user, navigating the Web Store requires heightened skepticism. Industry analysts stress that a clean name, a minimalist interface, and a high star rating are no longer sufficient guarantees of safety. As browser-based tools continue to serve as a primary gateway to the decentralized web, the inherent risks of extension manipulation, session hijacking, and covert blockchain data exfiltration underline the urgent need for a fundamental reevaluation of how trust is established in cryptocurrency user experiences.
