For a brief yet alarming window in November, a malicious browser extension managed to climb through the algorithmic ranks of the Chrome Web Store, positioning itself as the fourth organic result for the high-value search query “Ethereum wallet.”
Disguised under the name “Safery: Ethereum Wallet,” the fraudulent software presented an exterior polished enough to easily fool unsuspecting cryptocurrency users. It featured a crisp, professional icon, a generic nomenclature adjacent to vital security language, a rapid influx of five-star reviews, and standard boilerplate descriptions that closely mirror legitimate cryptographic software.
Beneath this deceptive frontend, however, lay a purpose-built attack mechanism engineered to capture seed phrases and systematically drain user funds. Rather than utilizing traditional, easily tracked command-and-server infrastructures, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light and thoroughly dissected by Socket, a security tooling company specializing in the safety of open-source software supply chains. Security researchers at Socket installed and analyzed the extension immediately after its discovery to determine how “Safery” successfully bypassed detection systems, climbed the Chrome Store search rankings, and exfiltrated sensitive seed phrases without triggering immediate security alerts. Their comprehensive technical report serves simultaneously as a detailed postmortem of the attack and a stark warning that browser extensions remain a persistent, high-risk blind spot within the broader cryptocurrency ecosystem.
What sets this particular incident apart from routine digital heists is that the threat actors behind Safery avoided spoofing any established wallet brand. It was neither a crude MetaMask lookalike nor a recycled phishing domain designed to catch typos. Instead, the attackers invented an entirely original identity, manufactured fake or botted reviews to rapidly manipulate search rankings, and launched the application as a brand-new, independent wallet option.
Because of this original-identity approach, the store listing displayed virtually none of the classic red flags that users have been trained to look out for. There was no broken grammar in the description, no unusual or overly aggressive permission requests, and no suspicious redirection links pointing to obscure external domains. The Chrome Web Store publisher page carried zero prior complaints, and its designated support URL led to an off-platform website that security trackers had not yet flagged at the time of Socket’s analysis.
Given its highly convincing and professional appearance, the average user would likely experience no hesitation before clicking the “Add to Chrome” button. The extension requested permission to run on all websites—a standard, expected requirement for crypto wallets that need seamless integration with various decentralized applications across the web. Crucially, it did not prompt for extra, unauthorized permissions or attempt to inject intrusive content scripts that would typically provoke Chrome’s more aggressive automated warnings. Its branding remained minimalist, its companion website accurately matched the extension’s name, and its initial setup screen followed industry standards by prompting users to either create a new wallet or import an existing one.
The Seed Heist, Broadcast Over Sui
The true damage of the operation began the moment a user entered their private seed phrase into the interface. Rather than storing the recovery phrase locally or employing encryption for user access, the extension silently partitioned the sensitive phrase into smaller fragments. It then systematically encoded these fragments to masquerade as seemingly random, innocuous wallet addresses.
Socket’s forensic research revealed that these data fragments were embedded directly into low-level Sui blockchain transactions. Specifically, the malicious extension executed minuscule SUI token transfers—amounts so negligible that they would never draw the attention of casual observers or automated account monitors—sending them to addresses directly controlled by the attackers. Embedded within these micro-transactions, either hidden cleverly inside memo fields or obfuscated within the transaction parameters, were the exact pieces of the victim’s seed phrase.
This tactical design choice offered substantial advantages to the hackers. Because the payload was routed through standard blockchain mechanics, the extension did not need to dispatch outbound network requests to malicious remote servers. There was no detectable command-and-control beacon, nor was there any data exfiltration over standard HTTP or WebSockets protocols that modern browsers, firewalls, or local antivirus solutions might flag and block.
Instead, the stolen payload left the user’s device disguised as an entirely normal-looking blockchain transaction, seamlessly routed through a widely utilized, low-fee layer-1 blockchain network. Once successfully logged on-chain, the data became publicly accessible, enabling the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to interact with the victim’s device a second time.
In practice, the scammers repurposed the Sui blockchain itself to function as a clandestine communications channel. Because the Sui network boasts exceptionally fast transaction confirmation times alongside negligible network fees, it operated with the efficiency of a low-latency message bus.
Socket successfully traced multiple instances of these anomalous seed-fragment transactions, definitively confirming the direct causal link between the entry of a seed phrase into the extension and the eventual loss of digital assets. While the actual asset thefts occurred off-chain—predominantly on Ethereum or other foundational layer-1 networks where the victims’ wallets stored meaningful capital—the precise operational instructions required to execute the thefts were hidden entirely in plain sight.
Before releasing the polished version that eventually conquered Chrome’s top wallet search results, the publisher likely tested the methodology in private environments. Digital evidence indicates that earlier, unindexed builds experimented with much simpler data leaks before the Sui encoding architecture was successfully refined. By the time the active, malicious extension was finally flagged and investigated, it had accumulated enough automated installations to break into Chrome’s “trending” tier, exponentially increasing its visibility. Industry reporting confirmed that the Safery wallet maintained a prominent position among the top results for Ethereum wallet searches even as panicked users began circulating warnings of suspicious behavior across platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery scam relied heavily on the underlying ranking logic of the Chrome Web Store search algorithm. The platform’s algorithm evaluates a combination of direct keyword matches, total install counts, review velocity, average user ratings, and update recency.
Extensions that experience a sudden, unnatural burst of activity, particularly within specialized or niche categories, can ascend rapidly if more established, thoroughly vetted competitors fail to update their software frequently. In this instance, Safery benefited greatly from a keyword-optimized name, a coordinated blitz of positive reviews that relied on templated or duplicated text, and a fresh upload timestamp.
Available evidence indicates that Google did not subject the listing to manual human review prior to publication. Chrome Web Store policies dictate that the vast majority of newly submitted extensions undergo only a brief automated scan alongside fundamental static analysis.
Deeper scrutiny is generally reserved for extensions that request explicitly elevated permissions, such as extensive access to active browser tabs, clipboard data, local file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter flags by operating safely within isolated iframes or utilizing standard, approved application programming interfaces. Safery strictly operated within these acceptable bounds.
Even after concerned users began raising alarms and reporting the extension, the operational lag between the initial reports and the eventual store takedown stretched on long enough for substantial financial damage to occur. Part of this vulnerability is structural; the Chrome ecosystem rarely acts on flagged extensions instantly unless there is an overwhelming consensus of abuse or the presence of already-cataloged malware signatures. Because the payload in this case consisted entirely of obfuscated JavaScript interacting directly with public blockchain infrastructure rather than external servers, traditional malware detection routines failed to identify it.
This incident is far from an isolated event within the history of browser-based cryptocurrency thefts. Previous security breaches have involved fake Ledger Live applications prompting users to enter recovery phrases, or legitimate developer accounts being hijacked to push malicious updates. However, what distinguished Safery from its predecessors was the remarkable smoothness of its user interface facade and the complete absence of traditional backend infrastructure. There was no vulnerable phishing website to shut down and no centralized server to block—just a single browser extension quietly depositing stolen secrets onto a public blockchain network.
Security experts and engineers are now intensifying calls for stronger heuristic analysis directly from the browser platform itself. Among the proposed technological remedies is the implementation of automatic flagging systems designed to detect any extension whose user interface elements prompt individuals to input a standard 12- or 24-word recovery phrase.
Additional recommendations include mandating strict publisher attestation for all wallet extensions, which would provide verifiable cryptographic proof that a specific developer officially controls the codebase behind a recognized wallet brand. Furthermore, industry stakeholders are advocating for more rigorous inspection of wallet-related permissions, ensuring that even benign-looking access patterns receive closer regulatory scrutiny.
For end users, security firms have reiterated the importance of rigorous software management. Before installing any cryptographic extension, users are advised to carefully review the publisher’s history, verify authentic associations with recognized projects, inspect review patterns for suspicious bursts of identical text, confirm the presence of real organizational websites paired with public source repositories, and closely audit the permissions tab for sweeping or vaguely defined access capabilities. A clean aesthetic, a professional name, and a high star rating are no longer sufficient guarantees of safety.
