For a few critical days last November, a sophisticated and malicious browser extension managed to secure the fourth spot in search results for the term "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively named "Safery: Ethereum Wallet," was engineered to look polished enough to pass as entirely legitimate to even cautious users. Featuring a clean icon, a generic name cleverly adjacent to security-related terminology, a sudden and massive flood of five-star reviews, and boilerplate descriptions immediately familiar to anyone who has ever downloaded a cryptocurrency wallet, the application hid a sinister purpose beneath its professional frontend.
Behind the user-friendly interface lay a purpose-built attack designed specifically to steal seed phrases and completely empty user wallets. Rather than relying on traditional methods of data exfiltration, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light after security tooling company Socket, which focuses heavily on open-source software supply chains, installed and closely analyzed the extension following its discovery. The primary aim of their investigation was to understand how "Safery" managed to successfully evade automated detection systems, steadily climb the Chrome Store search rankings, and covertly transmit stolen seed phrases without raising immediate security alarms. Furthermore, the researchers sought to determine what everyday users could do to spot similar threats in the future. The resulting security report walks through the attacker’s approach step by step, serving simultaneously as a forensic postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the hackers behind the scheme did not simply spoof an existing, well-known wallet brand. Unfortunately, the recycling of established brand identities, such as MetaMask lookalikes or recycled phishing domains, is well-trodden territory in the crypto threat landscape. Instead, Safery invented an entirely new identity from scratch. The perpetrators bought or generated artificial, bot-driven reviews to rapidly climb search rankings and successfully launched the software as a completely "new" wallet option on the platform.
Because of this novel approach, the listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no bizarre or overly broad permissions requested upfront, and no suspicious redirection to shady external domains. The Chrome Web Store publisher page showed no prior complaints or warning flags, and its designated support URL led directly to an off-platform website that had not yet been flagged by third-party security trackers at the time of Socket’s analysis.
Given its polished appearance and professional presentation, most everyday users would not have hesitated for a single moment before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a standard and common operational request for legitimate crypto wallets that genuinely need to interact seamlessly with a wide variety of decentralized applications. Notably, it did not prompt for extra, unusual permissions or attempt to inject malicious content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding was minimalist, the accompanying support website precisely matched the extension’s exact name, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one—again, completely standard behavior for the category.
The Seed Heist, Broadcast Over Sui
The real, irreversible damage began the exact moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or securely encrypting it for user access as a legitimate wallet would, the malicious extension silently split the recovery words into fragmented pieces. It then cleverly encoded these fragments to look precisely like random, ordinary cryptocurrency wallet addresses.
Detailed analysis from Socket’s research team revealed that these fragmented pieces of data were directly inserted into active Sui blockchain transactions. Specifically, the extension autonomously issued tiny SUI token transfers—minuscule amounts of cryptocurrency that would never draw the attention of casual observers or automated balance monitors—to various addresses directly controlled by the attacker. Hidden deep inside those low-value transactions, either neatly tucked away within memo fields or cleverly obfuscated directly inside the transaction addresses themselves, were the fractured components of the victim’s private seed phrase.
This calculated approach provided substantial tactical advantages to the threat actors. Crucially, it meant the extension did not need to send outbound network requests to malicious, centralized command-and-control servers. There was no suspicious beacon pinging a remote server or covert exfiltration happening over standard HTTP or WebSockets protocols—methods that modern browsers, firewalls, or local antivirus software are routinely programmed to flag and block.
Instead, the payload seamlessly left the user’s compromised device disguised as a completely normal, everyday blockchain transaction, skillfully routed through a widely used, low-fee layer-1 chain. Once the data successfully landed on-chain, it was publicly accessible to anyone, allowing the attacker to retrieve the transaction details at their leisure, reconstruct the complete seed phrase, and systematically sweep all available funds from the victim’s wallets without ever needing to touch the user’s device a second time.
In effect, the sophisticated scam weaponized the Sui blockchain itself, using it as an alternative communications channel. Because the Sui network boasts remarkably fast confirmation times and negligible transaction fees, it functioned flawlessly as a low-latency message bus for the hackers.
Socket successfully traced multiple historical examples of these seed-fragment transactions on-chain and definitively confirmed the direct causal link between seed entry and the subsequent loss of assets. While the actual thefts occurred off-chain—predominantly on Ethereum or other major layer-1 networks where the victims’ wallets conveniently held valuable funds—the explicit instructions required to carry out the thefts were hidden entirely in plain sight.
Before finally releasing the polished version that eventually landed in Chrome’s top wallet search results, the publisher almost certainly tested the underlying methodology in private environments. Digital evidence uncovered during the investigation shows that earlier, preliminary builds had experimented with simpler, less efficient data leaks before the Sui encoding technique was thoroughly refined.
By the time the active, malicious extension was finally flagged and reported by security researchers, it had accumulated enough installs to comfortably reach Chrome’s coveted "trending" tier, which further boosted its public visibility and credibility. Industry reports confirmed that the Safery wallet persistently sat among the very top results for "Ethereum wallet" searches even as mounting reports of highly suspicious wallet behavior began circulating across public forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged primarily on the inner workings of Chrome’s internal search and ranking logic. The Web Store search algorithm heavily weighs factors such as precise keyword matching, total install counts, review velocity, average user ratings, and overall update recency.
Extensions that experience a sudden, manufactured burst of activity, particularly within specialized or niche categories like cryptocurrency tools, can climb search rankings rapidly if their more established, better-vetted competitors are not updated frequently. In this particular case, Safery possessed a title that scored exceptionally well for common user queries, a coordinated blitz of positive reviews—many of which were clearly templated or duplicated—and a remarkably fresh upload date.
There is currently no concrete evidence to suggest that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most new software submissions to a brief automated scan and fundamental static code analysis rather than rigorous human vetting.
Extensions typically undergo much deeper scrutiny only when they request heavily elevated permissions, such as explicit access to active browser tabs, system clipboards, local file systems, or browsing history. Because legitimate crypto wallet extensions frequently manage to avoid these specific warning flags by operating securely within iframes or utilizing standard approved APIs, Safery carefully stayed well within those acceptable structural bounds.
Even when vigilant users began raising urgent concerns and reporting the extension, the critical time gap between the initial reports and the eventual takedown by platform administrators stretched on long enough for extensive financial damage to occur. Part of that persistent lag is structural: the Chrome Web Store does not act on flagged extensions instantaneously unless there is an overwhelming consensus of reports or definitively recognized malware signatures present in the code.
In this instance, the malicious payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external host servers. Traditional malware detection methods simply failed to catch it.
This security failure is far from the first time browser extensions have been weaponized to steal cryptocurrency from unwary users. Previous high-profile scams have included fake Ledger Live apps that prompted users to input their sensitive recovery phrases, or hijacked legitimate developer accounts that allowed malicious actors to push unauthorized updates to long-standing extensions.
What fundamentally set Safery apart, however, was the remarkable smoothness of its digital facade and the complete absence of traditional backend infrastructure. There was no vulnerable phishing website to shut down, no malicious server IP address to block, and no centralized command post to dismantle—just a single browser extension quietly moving secret data onto a public blockchain and walking away cleanly.
For affected users, recourse was severely limited, though some could still minimize their losses by acting with extreme speed. Security firms including Socket quickly published emergency triage steps for anyone who had mistakenly installed the extension: uninstall the application immediately, systematically revoke all active token approvals, sweep any remaining assets to a completely new wallet generated on a clean, uncompromised device, and closely monitor associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time or who stored significant amounts of capital in vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers, developers, and industry experts are now aggressively calling for much stronger heuristic checks directly from Google Chrome itself. One widely proposed solution involves automatically flagging and blocking any extension that includes user interface elements prompting individuals to input a 12- or 24-word recovery phrase.
Another prominent approach advocates for mandatory publisher attestation for all wallet-related extensions, providing cryptographically verifiable proof that a specific publisher legitimately controls the codebase behind a known wallet brand. Additional calls have been made for tighter, more rigorous inspections of wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday end users, Socket published a practical checklist for safe extension management moving forward. Before installing any cryptocurrency extension, users are strongly advised to thoroughly review the publisher’s history, verify concrete associations with well-known and trusted projects, carefully inspect review patterns for suspicious bursts of identical or templated text, cross-reference real website links with public GitHub repositories, and scrutinize the permissions tab for vague or sweeping access requests. A clean name, a professional presentation, and a high rating are simply no longer enough to guarantee safety.
This alarming case inevitably raises broader questions regarding the fundamental role of the web browser in the modern cryptocurrency landscape. Browser-based wallets originally gained widespread popularity primarily due to their accessibility and ease of use, enabling everyday users to interact seamlessly with decentralized applications without needing to switch platforms or download separate desktop software.
However, that unprecedented convenience has come at a severe cost to user security. The modern web browser is an inherently high-risk environment subject to persistent threats, including malicious extension manipulation, active session hijacking, background clipboard scrapers, and now, covert blockchain exfiltration.
As a result, wallet developers are increasingly likely to rethink their long-term distribution models. Some forward-thinking development teams already strongly discourage Chrome Web Store installations altogether, preferring to steer users toward dedicated mobile applications or standalone desktop binaries. Other projects may soon implement native warnings for users attempting to install wallet software from unverified sources.
The core underlying problem remains frustratingly persistent: software distribution across modern web ecosystems is heavily fragmented, and the vast majority of everyday users simply do not possess the technical expertise required to distinguish a legitimate, secure wallet from a polished, malicious clone.
The Safery extension did not need to impersonate MetaMask or masquerade as Phantom to succeed. Instead, it successfully created its own independent brand, seeded artificial trust signals, and constructed an invisible digital backdoor that cleverly utilized the Sui blockchain as an efficient courier. That reality should force a thorough industry-wide rethink of how trust is established within cryptocurrency user experiences, and just how close to the metal even casual everyday tools like browser extensions truly operate. Crypto users frequently operate under the comforting assumption that Web3 technology inherently guarantees sovereignty and self-custody. But in the wrong hands, a compromised browser wallet functions less like a secure digital vault and more like an open port—and Chrome will not always warn you before something slips right through.
