For a few critical days in November, a polished and malicious browser extension managed to rank as the fourth organic result for the search term "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively named "Safery: Ethereum Wallet," presented a veneer of legitimacy that easily fooled casual users and bypassed standard automated safety checks. Featuring a clean, professional icon, a generic title paired with reassuring security language, a sudden influx of five-star reviews, and boilerplate descriptions familiar to anyone active in the cryptocurrency space, the application looked entirely indistinguishable from dozens of other Web3 onboarding tools.
However, beneath its carefully crafted frontend lay a sophisticated, purpose-built attack mechanism. Instead of relying on traditional web servers or external command-and-control infrastructure, the extension was engineered to silently harvest user seed phrases, chop them into discrete fragments, and encode those stolen secrets directly into micro-transactions on the Sui blockchain.
The security tooling firm Socket, which specializes in open-source software supply chains, downloaded and conducted a deep technical analysis of the extension shortly after its malicious nature was uncovered. The firm’s primary objective was to understand how "Safery" managed to completely evade initial detection, aggressively climb the Chrome Web Store search rankings, and exfiltrate sensitive recovery phrases without raising immediate alarms. Their subsequent incident report serves as both a detailed postmortem of the attack and a stark warning to the broader digital asset community that browser extensions continue to represent a dangerous, largely unmonitored blind spot in cryptocurrency security.
What makes this particular incident stand out among digital asset heists is that the threat actors behind it bypassed standard phishing tactics. They did not attempt to spoof an existing, high-profile wallet brand. It was neither a crude MetaMask lookalike nor a recycled, typo-squatted phishing domain designed to catch distracted users off guard. Instead, the attackers chose to invent an entirely new identity from scratch. They bought or deployed networks of bot-driven fake reviews to artificially inflate the extension’s search visibility, successfully launching their creation into the marketplace as a completely "new" independent wallet option.
This calculated strategy meant that the listing displayed virtually no immediate red flags that experienced users might look for. There was no broken English or awkward grammar in the descriptions, no requests for bizarre or excessive browser permissions, and no suspicious redirections to shady external domains. Furthermore, the Chrome Web Store publisher page carried no prior consumer complaints, and its designated support URL directed visitors to an off-platform website that had not yet been flagged by major security trackers at the time of Socket’s investigation.
Given its highly polished appearance and professional presentation, the average user would have felt little hesitation before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a standard, ubiquitous requirement for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, it refrained from prompting for additional, highly invasive permissions and avoided injecting content scripts that would typically trip Chrome’s more aggressive automated warnings. The branding maintained a minimalist aesthetic, the official website matched the exact name of the extension, and the initial setup screen guided users through standard workflows such as creating a brand-new wallet or importing an existing one.
The Seed Heist, Broadcast Over Sui
The true damage of the exploit was triggered the moment a user inputted their sensitive recovery seed phrase. Rather than storing the phrase locally within secure browser storage or encrypting it for user accessibility, the extension executed a silent routine that broke the phrase into small fragments. It then systematically encoded these fragments to masquerade as seemingly random, ordinary wallet addresses.
Socket’s rigorous research revealed that these data fragments were covertly embedded directly into live transactions on the Sui blockchain. Specifically, the extension issued microscopic SUI token transfers—minuscule amounts of value designed to draw zero attention from victims or automated blockchain monitors—to various addresses directly controlled by the malicious actors. Hidden intricately inside those transactions, either tucked away within memo fields or obfuscated directly within the destination addresses themselves, were the vital pieces of the user’s seed phrase.
This tactical approach provided the attackers with significant operational advantages. Because the data left the victim’s device formatted as a normal-looking, legitimate blockchain transaction routed through a widely used and low-fee network, the extension did not need to send outbound HTTP requests or establish WebSockets with malicious external servers. Consequently, there was no command-and-control beacon or suspicious exfiltration pattern for local antivirus software or browser security systems to flag.
Once the data successfully reached the public blockchain, it was permanently and publicly accessible. This allowed the attackers to quietly retrieve the pieces at their convenience, reconstruct the complete seed phrases, and comprehensively sweep the victims’ assets across Ethereum and other layer-1 networks without ever needing to touch the user’s device a second time.
In effect, the operation weaponized the Sui blockchain itself, turning it into an encrypted communications channel. Because the Sui network boasts remarkably fast confirmation times and negligible transaction fees, it functioned essentially as a low-latency message bus for the cybercriminals. Socket successfully traced multiple instances of these unique seed-fragment transactions, definitively confirming the direct correlation between seed entry in the fraudulent extension and the subsequent loss of funds. While the asset thefts ultimately occurred off-chain—typically on Ethereum or other foundational layer-1 chains where the victims held their actual cryptocurrency balances—the instructions required to execute the thefts were delivered out in the open.
Evidence suggests that before releasing the finalized version that ultimately conquered Chrome’s top wallet search results, the publisher tested the methodology in private settings. Earlier, more rudimentary builds experimented with simpler data leaks before the Sui encoding architecture was fully perfected. By the time the active, malicious extension was finally caught and reported, it had accumulated enough fraudulent installs to secure a coveted spot in Chrome’s "trending" tier, which further amplified its visibility to unsuspecting users. Reports confirmed that the "Safery" wallet maintained its prominent placement near the top of "Ethereum wallet" search results even as early warnings and panicked user reports began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The explosive success of the "Safery" extension hinged almost entirely on the mechanics of Chrome’s internal ranking algorithm. The Web Store search logic heavily weighs several key metrics, including keyword matches, overall install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden, manufactured burst of activity—particularly within specialized, niche categories like financial tools—can climb the search charts with alarming speed if established, well-vetted competitors fail to push frequent updates. In this specific scenario, "Safery" paired a high-value search term with a blitz of positive reviews, many of which were visibly templated or duplicated, alongside a very fresh upload date.
Public records show no evidence that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan and basic static code analysis. Deeper, manual scrutiny is typically reserved for extensions that request heavily elevated permissions, such as direct access to user tabs, system clipboards, local file systems, or browsing history. Because cryptocurrency wallet extensions frequently bypass these specific flags by operating within isolated iframes or leveraging standard, approved developer APIs, "Safery" managed to stay comfortably within permitted operational bounds.
Even after concerned users began noticing anomalous behavior and raising alarms, the lag time between initial reporting and the eventual takedown of the extension stretched on long enough for substantial financial damage to occur. Part of this delay is structural; the Chrome ecosystem rarely acts on flagged extensions instantly unless there is an overwhelming consensus of abuse or a match against known malware signatures. Because the extension relied on obfuscated JavaScript interacting directly with legitimate public blockchain infrastructure rather than hosting malicious payloads on external web servers, traditional automated malware detection tools failed to intercept it in time.
This incident is far from the first time browser extensions have been leveraged as a vector for cryptocurrency theft. Previous waves of attacks have involved sophisticated fake Ledger Live applications prompting users to input their master recovery phrases, or instances where legitimate, established extensions were hijacked after attackers compromised the original developer’s publishing keys.
What fundamentally separated "Safery" from previous campaigns was the exceptional smoothness of its user-facing facade and the complete absence of traditional backend infrastructure. There was no easily blockable phishing website to take down and no command server to neutralize; there was simply a single browser extension quietly translating secrets into blockchain data packets and walking away.
For users who fell victim to the scheme, immediate action was the only recourse to limit further exposure. Security researchers, including the team at Socket, quickly published emergency triage steps for anyone who had installed the fraudulent application: uninstall the extension immediately, revoke any active token approvals associated with the compromised wallets, swiftly sweep remaining digital assets to a completely new wallet created on a clean device, and closely monitor all associated addresses. For those who failed to notice the silent data exfiltration or who maintained large capital reserves in hot wallets without taking defensive measures, financial recovery remained highly unlikely.
The fallout from the incident has prompted cybersecurity experts and independent developers to demand significantly stronger security heuristics from Google’s engineering teams. Among the primary proposals is the implementation of automated flags that instantly quarantine any browser extension incorporating user interface elements designed to prompt for standard 12-word or 24-word recovery phrases.
Additional recommendations include enforcing mandatory publisher attestation for all wallet-related extensions, which would provide verifiable proof that a publishing entity genuinely controls the authentic codebase behind an established crypto brand. Industry advocates are also calling for much tighter scrutiny surrounding wallet-related permissions, even when those applications do not explicitly request traditionally dangerous access patterns.
For the everyday end user, security firms continue to emphasize rigorous pre-installation checks. Before downloading any cryptocurrency-related browser extension, users are advised to thoroughly research the publisher’s history, verify concrete associations with recognized open-source projects, carefully inspect review patterns for telltale bursts of identical or templated feedback, cross-reference official website links with public code repositories, and scrutinize the permissions tab for sweeping system access. As the "Safery" incident starkly demonstrates, a clean aesthetic and high user ratings are no longer reliable indicators of safety.
The event ultimately casts a wider lens on the inherent vulnerabilities of relying on web browsers as primary gateways for decentralized finance. Browser-based wallets originally surged in popularity due to their unmatched accessibility and convenience, allowing users to interact smoothly with complex decentralized applications without requiring dedicated desktop installations or platform switching.
However, that convenience has introduced profound security trade-offs. The modern web browser remains a high-risk operating environment uniquely vulnerable to extension manipulation, session hijacking, clipboard scraping, and now, covert blockchain-based exfiltration. As long as distribution channels remain fragmented and average users struggle to separate polished clones from legitimate tools, the ecosystem will remain exposed to novel attacks that treat the browser not as a secure vault, but as an open port.
