For a few tense days last November, a sophisticated malicious Chrome extension managed to climb its way to the fourth position in search results for the term “Ethereum wallet” on the official Chrome Web Store.
The extension, deceptively named “Safery: Ethereum Wallet,” was meticulously engineered to project an aura of complete legitimacy. It featured a crisp, professional icon, a generic yet reassuring name adjacent to established security terminology, a flood of enthusiastic five-star reviews, and boilerplate descriptions that instantly feel familiar to anyone who has ever navigated the world of decentralized finance and downloaded a digital asset manager.
Beneath that polished frontend, however, lay a purpose-built attack mechanism specifically designed to harvest seed phrases and systematically empty user wallets. Rather than relying on traditional, easily trackable methods of data exfiltration, the malware ingeniously encoded stolen secrets directly into micro-transactions routed across the Sui blockchain.
The threat was uncovered and subsequently analyzed by Socket, a prominent security tooling company dedicated to monitoring and protecting open-source software supply chains. After discovering the fraudulent listing, Socket’s security researchers installed and dissected the extension to understand how “Safery” managed to bypass automated detection systems, game the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without triggering immediate alarms. Their comprehensive postmortem serves as both an alarming case study and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy within the annals of digital security breaches is that the hackers behind Safery did not rely on the well-trodden territory of brand spoofing. They did not attempt to impersonate an existing, trusted wallet brand, nor did they disguise themselves as a MetaMask lookalike or set up a recycled phishing domain. Instead, they invented an entirely new identity from scratch, purchased or generated a wave of botted fake reviews to artificially inflate their search ranking, and launched as a seemingly fresh, alternative wallet option in a crowded marketplace.
This calculated approach meant that the store listing displayed virtually none of the classic red flags that savvy users have learned to spot. There was no broken English or awkward grammar in the descriptions, no suspicious or overly broad permissions requested upfront, and no redirection to obscure or shady external domains. The Chrome Web Store publisher page carried no prior user complaints or warning flags, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket’s analysis.
Given its professional appearance and seamless user interface, the average digital asset holder would have had little reason to hesitate before clicking the “Add to Chrome” button. Like many legitimate tools of its kind, the extension requested permission to run on “all websites,” a standard and necessary functional requirement for crypto wallets that need to interact dynamically with decentralized applications across the web.
Crucially, it refrained from prompting users for extra, suspicious permissions or attempting to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding throughout the application was minimalist and clean, the companion website aligned perfectly with the extension’s stated name, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one—standard, expected behavior for any newly installed digital vault.
The Seed Heist, Broadcast Over Sui
The true architecture of the scam swung into motion the moment a user entered their critical recovery seed phrase. Instead of storing the phrase locally on the device or attempting to encrypt it for legitimate user access, the malicious extension quietly intercepted the information, fragmented the recovery words, and encoded them to resemble random, innocuous wallet addresses.
Socket’s deep-dive research revealed that these data fragments were deliberately inserted directly into transactions executed on the Sui blockchain. Specifically, the extension initiated tiny, negligible transfers of SUI tokens—minuscule financial amounts designed to blend seamlessly into the blockchain’s background noise and draw zero attention from victims or observers—sending them to addresses completely controlled by the malicious actors.
Hidden expertly inside those routine-looking blockchain transactions, either tucked away within memo fields or obfuscated directly within the structure of the recipient addresses, were the broken pieces of the user’s secret seed phrase.
This tactical maneuver offered profound operational advantages for the attackers. Because the malicious payload was transmitted as part of a native blockchain transaction, the extension did not need to make outbound network requests to known malicious command-and-control servers. There was no suspicious HTTP or WebSocket beaconing that a modern web browser, corporate firewall, or local antivirus program could flag as abnormal outbound activity.
Instead, the payload left the user’s infected device disguised as an entirely normal-looking cryptocurrency transaction, routed naturally through a widely adopted, high-speed, and low-fee layer-1 blockchain. Once safely recorded on-chain, the data became publicly accessible yet entirely obscure to the casual observer, allowing the attackers to quietly retrieve the information at their leisure, reconstruct the complete seed phrase, and sweep the victim’s assets from afar without ever needing to touch the user’s local device again.
In effect, the sophisticated scam transformed the Sui blockchain itself into a covert communications channel. Because the Sui network boasts exceptionally fast confirmation times alongside virtually negligible transaction costs, it functioned with the efficiency of a low-latency message bus ideally suited for clandestine data exfiltration.
Socket successfully traced multiple historical instances of these peculiar seed-fragment transactions, definitively confirming the direct causal link between the entry of a recovery phrase into the extension and the subsequent, often devastating loss of digital assets. While the actual thefts took place off-chain—typically targeting Ethereum or other major layer-1 networks where the victims’ primary balances were safely stored—the operational instructions required to execute the thefts were hiding entirely in plain sight.
Before deploying the refined version that ultimately surged into the Chrome store’s top results, the publisher appears to have tested the methodology through private experimentation. Digital forensics indicate that earlier builds of the extension experimented with far simpler data leaks before the Sui encoding technique was successfully perfected.
By the time the active, malicious extension was finally brought to the attention of security analysts, it had already accumulated enough installations to secure a coveted spot in Chrome’s “trending” tier, exponentially increasing its visibility and reach. Reports from industry observers confirmed that the Safery wallet remained prominently featured among the top search results for Ethereum wallets even as frustrated users began circulating warnings about suspicious behaviors on community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The alarming success of the Safery extension was fundamentally enabled by the mechanics of Chrome’s internal search ranking logic. The Web Store algorithm evaluates a complex matrix of signals, including keyword matching, total install counts, review velocity, average ratings, and the recency of updates.
Extensions that experience a sudden, concentrated burst of user activity—particularly within niche or specialized categories where established, well-vetted competitors are not updated with high frequency—can climb the visibility ladder at an astonishing pace. In this particular instance, Safery benefited from a title optimized for high-volume search queries, a coordinated blitz of positive reviews that relied heavily on templated or duplicated text, and a pristine, recently published timestamp.
There is no indication that Google conducted a manual human review of the listing prior to publication. Standard protocol for the Chrome Web Store subjects most newly submitted extensions to a brief automated scan and foundational static code analysis.
Under standard guidelines, extensions undergo deeper, more rigorous scrutiny only when they request elevated, potentially dangerous permissions, such as direct access to browser tabs, the clipboard, the local file system, or browsing history. Wallet extensions frequently manage to sidestep these rigid review flags by operating safely within isolated iframes or leveraging officially approved browser APIs. Safery carefully stayed within those permitted operational boundaries.
Even after concerned users began raising alarms and reporting the suspicious application, the critical window of time between initial reporting and eventual store takedown stretched out long enough for substantial financial damage to occur. Part of this lag is structural and institutional: the Chrome ecosystem does not act on flagged extensions instantaneously unless there is an overwhelming consensus of reports or a match against known, cataloged malware signatures.
In this case, the underlying payload consisted of heavily obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than external, blockable web hosts, neatly bypassing traditional malware detection methodologies.
This incident is far from an isolated event in the ongoing security challenges facing browser environments. Previous waves of malicious campaigns have utilized fake Ledger Live applications designed to trick users into divulging recovery phrases, or involved the hijacking of legitimate, long-standing extensions to compromise developer publishing keys.
What distinguished Safery from its predecessors was the remarkable smoothness of its frontend facade and the total absence of traditional backend infrastructure. There was no centralized phishing website to shut down, no malicious server IP to block, and no command post to raid—just a single browser extension quietly translating secrets into blockchain transactions and walking away.
For impacted users, avenues of recourse were painfully narrow. Those who recognized the compromise rapidly enough could limit their ongoing exposure by immediately rotating their seed phrases and revoking outstanding token approvals across their accounts.
Security firms including Socket quickly published emergency triage steps for anyone who had installed the application: uninstall the extension immediately, revoke all active token approvals, sweep remaining digital assets to a freshly generated wallet created on a completely clean and trusted device, and continuously monitor associated blockchain addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who maintained substantial balances in vulnerable hot wallets, asset recovery remained an impossibility.
The incident has predictably reignited urgent calls from developers and security researchers for much stronger heuristic evaluations built directly into the core architecture of the Chrome browser. Among the primary proposals is the implementation of automated flagging systems designed to immediately freeze any extension that incorporates user interface elements prompting for a standard 12- or 24-word recovery phrase.
Additional proposals include mandatory publisher attestation requirements for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase associated with a recognized wallet brand. Industry voices are also advocating for much tighter, more conservative inspection of wallet-related permissions, even when those permissions do not explicitly invoke traditionally dangerous access patterns.
For everyday end users, security advocates continue to stress the vital importance of rigorous pre-installation vetting. Before introducing any crypto-related extension to a browser environment, users are urged to thoroughly research the publisher’s history, verify concrete associations with known and trusted development teams, inspect review patterns for unnatural bursts of identical feedback, and cross-reference official website links with public code repositories.
As the digital asset landscape continues to evolve, the Safery incident exposes fundamental vulnerabilities in how users interact with decentralized finance through everyday web browsers. What began as a convenient gateway for exploring the decentralized web has increasingly revealed itself as a high-risk operational environment, leaving users to navigate a complex labyrinth where a clean interface and a high rating are no longer enough to guarantee safety.
