For a few critical days last November, a sophisticated and malicious browser extension managed to secure the fourth spot in search results for the term "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively named "Safery: Ethereum Wallet," was engineered with enough technical polish and visual finesse to easily pass as a legitimate tool for cryptocurrency users. Featuring a clean, professional icon, a generic name cleverly positioned alongside security-focused terminology, a massive influx of five-star reviews, and boilerplate descriptions immediately familiar to anyone who has ever downloaded a digital asset manager, the extension looked entirely trustworthy on the surface.
However, behind that polished frontend lay a purpose-built attack mechanism designed specifically to harvest user seed phrases and systematically drain cryptocurrency wallets. Rather than relying on traditional methods of data exfiltration, the extension covertly encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
The security tooling company Socket, which specializes in open-source software supply chains, installed and closely analyzed the extension immediately after its discovery. Their primary objective was to understand how "Safery" managed to completely evade automated detection, climb the competitive Chrome Store search rankings, and exfiltrate sensitive seed phrases without ever raising security alarms. Furthermore, the security team sought to determine what everyday users could do to spot and defend against similar threats in the future. The resulting technical report walks readers through the attacker’s innovative approach, serving as both a postmortem of the incident and a stark warning that browser extensions continue to represent a dangerous, overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case especially noteworthy is that the malicious actors did not simply resort to stealing seed phrases through conventional means—a problem that is, unfortunately, already well-trodden territory in the crypto sector. Instead, Safery broke new ground by avoiding the traditional trap of spoofing an existing, established wallet brand. It was not a MetaMask lookalike, nor was it hosted on a recycled phishing domain designed to catch typos. Instead, the creators invented an entirely new identity from scratch, purchased or deployed automated bot networks to generate fake reviews that artificially inflated its search rankings, and launched the software as a completely "new" wallet option in the marketplace.
This calculated approach meant that the extension’s listing displayed virtually no immediate red flags to prospective users or automated filters. There was no broken grammar in the descriptions, no requests for odd or excessive permissions, and no suspicious redirection to shady external domains. The Chrome Web Store publisher page carried no prior user complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s initial analysis.
Given its highly professional and polished appearance, the average user would likely not have hesitated for a single second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites"—a remarkably common and practically necessary request for legitimate crypto wallets that must interact seamlessly with a wide variety of decentralized applications across the web. Notably, the software did not prompt for extra, intrusive permissions, nor did it attempt to inject complex content scripts that might have triggered Chrome’s more aggressive security warnings. The overall branding was minimalist, the accompanying website closely mirrored the extension’s name and aesthetic, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one, mimicking standard industry behavior.
The Seed Heist, Broadcasted Over the Sui Network
The real damage began the moment an unsuspecting user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or encrypting it for user access as a legitimate application would, the malicious extension silently split the text into discrete fragments. It then cunningly encoded these fragments so that they appeared to be nothing more than random, ordinary wallet addresses.
Detailed research conducted by Socket revealed that these hidden fragments were deliberately inserted into active Sui blockchain transactions. Specifically, the extension issued tiny, almost imperceptible transfers of SUI tokens—minuscule amounts of value that would never draw the attention of a user or automated monitoring tool—to various addresses controlled directly by the attacker. Hidden safely inside those innocuous transactions, either tucked away within memo fields or disguised as obfuscated destination addresses, were the broken pieces of the user’s private seed phrase.
This tactical approach offered significant advantages to the cybercriminals. Because the data was bundled into normal blockchain activity, the extension did not need to send outbound network requests to external malicious servers. There was no traditional command-and-control beacon communicating over HTTP or WebSockets, which means typical browser monitors and antivirus programs had nothing anomalous to flag.
The payload successfully left the user’s local device disguised as a completely normal-looking blockchain transaction, routed smoothly through a widely used, low-fee layer-1 chain. Once the data landed on-chain, it was publicly accessible, permitting the attacker to retrieve it at their leisure, reconstruct the full seed phrase, and systematically sweep the victim’s assets without ever needing to touch the user’s device a second time.
In effect, the scam creatively utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network features remarkably fast confirmation times and negligible transaction costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple historical examples of these seed-fragment transactions, definitively confirming the direct causal link between the initial entry of the seed phrase and the eventual loss of digital assets. While the actual thefts ultimately occurred off-chain—either on Ethereum or other layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before finally releasing the version that ultimately landed in Chrome’s top wallet search results, the publisher likely tested the underlying methodology in private environments. Digital forensics and historical data show that earlier, preliminary builds experimented with much simpler data leaks before the Sui encoding technique was fully refined and optimized.
By the time the active, weaponized extension was finally flagged and investigated, it had accumulated enough installations to break into Chrome’s coveted "trending" tier, which served to further boost its public visibility and credibility. Reports indicated that the "Safery" wallet sat comfortably among the top organic results for "Ethereum wallet" searches even as mounting reports of suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Allowed the Scam to Thrive
The ultimate success of the "Safery" extension hinged heavily on the underlying mechanics of Chrome’s search and ranking algorithm. The Web Store search algorithm continuously weighs a variety of factors, including keyword matching, total install counts, review velocity, average user ratings, and the recency of software updates.
Browser extensions that experience a sudden, sharp burst of user activity, particularly within specialized or niche categories, can climb rapidly through the search results if better-vetted, older competitors are not updated with matching frequency. In this particular instance, "Safery" benefited from a name that scored exceptionally well for common search queries, a coordinated blitz of positive reviews that often featured templated or duplicated text, and a fresh upload date that signaled active maintenance.
To date, there is no evidence indicating that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy typically subjects most new extension submissions to a brief automated scan alongside fundamental static code analysis.
Extensions generally undergo deeper, more rigorous manual scrutiny only when they explicitly request elevated permissions, such as widespread access to user tabs, the system clipboard, local file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating safely within iframes or by utilizing standard, pre-approved APIs. "Safery" carefully stayed within those permitted operational bounds.
Even when vigilant users raised concerns and submitted reports, the operational lag between initial reporting and eventual store takedown stretched on long enough for significant financial damage to occur. Part of that delay is structural: the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of abuse or easily identifiable, known malware signatures.
In this case, the payload consisted of heavily obfuscated JavaScript that leaned entirely on external blockchain infrastructure rather than external command servers, meaning traditional signature-based malware detection methods simply failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency from unwary users. Previous notable scams have included fraudulent Ledger Live companion apps that prompted users to enter their recovery phrases directly into web pages, or instances where legitimate, established extensions were hijacked after attackers compromised the original developer’s publishing credentials.
What truly sets "Safery" apart from these historical precedents is the remarkable smoothness of its professional facade and the total absence of traditional backend infrastructure. There was no classic phishing website to take down, no malicious server IP address to block, and no centralized database to raid—just a single extension quietly moving secret data onto a public blockchain and walking away.
Impacted users still retained limited avenues for recourse, provided they acted with extreme urgency. Those who realized what was happening quickly enough could limit their exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized finance protocols.
Security firms like Socket quickly published practical triage steps for anyone who had accidentally installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets to a brand-new wallet using a completely clean and uncompromised device, and closely monitor all associated wallet addresses. For users who failed to notice the silent data exfiltration in time, or for those who stored large amounts of capital in vulnerable hot wallets, asset recovery remained an impossibility.
The Broader Implications for Web3 Security
In the wake of the incident, security researchers, developers, and industry analysts have begun calling for much stronger heuristics and safety checks directly from Google within the Chrome Web Store. One prominent proposal involves automatically flagging and holding any extension that includes user interface elements or code patterns prompting individuals to enter a 12- or 24-word recovery phrase.
Another suggested approach is to mandate publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the underlying codebase behind a recognized wallet brand. There are also growing demands for much tighter inspection of wallet-related permissions, even in cases where those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday cryptocurrency users, security firms continue to emphasize practical checklists for safe extension management. Before installing any crypto-related browser extension, users are advised to thoroughly review the publisher’s history, verify explicit associations with known and trusted projects, inspect review patterns for obvious anomalies like sudden bursts of identical text, check for real website links backed by public GitHub repositories, and carefully scan the permissions tab for vague or sweeping access requests.
A clean name, professional design, and high star rating are simply no longer sufficient guarantees of safety.
This high-profile security failure raises broader, systemic questions about the browser’s enduring role as a primary gateway for cryptocurrency management. Browser-based wallets originally gained immense popularity due to their high accessibility and ease of use, allowing everyday people to interact effortlessly with decentralized applications without needing to switch computing platforms or download standalone desktop applications.
However, that unmatched accessibility has come at a severe cost regarding exposure and attack surface. The modern web browser remains a notoriously high-risk environment subject to constant threats, including extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As a result of these persistent vulnerabilities, wallet developers are increasingly likely to rethink their long-term distribution models. Some proactive development teams already actively discourage Chrome Web Store installations, preferring to steer users toward standalone mobile applications or verified desktop binaries. Other teams may soon implement automated warnings within their applications whenever users attempt to install companion software from unverified or suspicious sources.
Ultimately, the core problem persists: software distribution remains heavily fragmented, and the vast majority of everyday users lack the technical expertise required to reliably distinguish a legitimate, secure wallet from a polished, malicious clone. The "Safery" extension proved conclusively that attackers no longer need to mimic established giants like MetaMask or Phantom to succeed; they can simply invent their own credible brand, seed artificial trust signals, and construct an invisible digital backdoor that uses a public blockchain as an undetectable courier.
This reality demands a profound rethinking of how trust is established in cryptocurrency user experiences, and how close to the underlying operating system casual tools like browser extensions truly operate. Crypto users frequently operate under the foundational assumption that Web3 technology inherently guarantees digital sovereignty and absolute self-custody. Yet, in the wrong hands, a standard browser-based wallet functions less like a secure financial vault and more like an open port—and the browser will not always warn you before something slips through.
