For a few critical days in November, a malicious Chrome extension managed to climb the ranks of the Chrome Web Store, securing the fourth position for the heavily trafficked search term "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," was designed with enough polished craftsmanship to easily pass as a legitimate tool for cryptocurrency users. It featured a clean, professional icon, a generic yet reassuring name adjacent to security-oriented language, a sudden and massive flood of five-star reviews, and boilerplate interface descriptions that are entirely familiar to anyone who has ever downloaded a crypto wallet extension.
However, beneath that pristine frontend lay a purpose-built cyberattack mechanism. The extension was engineered to steal seed phrases and systematically empty user wallets by cleverly encoding stolen secrets into micro-transactions broadcasted directly onto the Sui blockchain.
Socket, a prominent security tooling company focused on open-source software supply chains, installed and deeply analyzed the extension shortly after its malicious nature was discovered by the security community. Their primary aim was to understand how "Safery" managed to completely evade early detection, aggressively climb the Chrome Store search rankings, and exfiltrate sensitive seed phrases without ever raising alarms, as well as what everyday users could do to spot similar emerging threats. The resulting analytical report walks through the attacker’s sophisticated approach, serving as both a postmortem of the security failure and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular case is notably significant because the malicious actors did not rely on the well-trodden territory of simply spoofing an existing, trusted wallet brand. It was not a MetaMask lookalike or a recycled phishing domain designed to trick unwary users through typosquatting. Instead, the creators of Safery invented an entirely new digital identity, bought or systematically botted fake reviews to manipulate search rankings, and launched the application cleanly as a brand-new wallet option.
This calculated approach ensured that the store listing showed virtually no immediate red flags to prospective victims: there was no broken grammar in the descriptions, no obviously odd or dangerous permissions requested upfront, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page displayed no prior consumer complaints, and its designated support URL led directly to an off-platform website that had not yet been flagged by automated security trackers at the time Socket performed its analysis.
Given its highly polished and professional appearance, the vast majority of web users would not have hesitated for even a single second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a standard, ubiquitous requirement for crypto wallets that need to interact seamlessly with various decentralized applications across the web.
Notably, the extension did not prompt users for extra, suspicious permissions or attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the accompanying support website matched the extension’s name precisely, and the initial setup screen simply prompted users to create or import a wallet—once again, completely standard behavior for legitimate software in this category.
The Seed Heist, Broadcast Over Sui
The real, irreversible damage began the exact moment a user entered their sensitive seed phrase. Instead of storing the recovery phrase locally or securely encrypting it for user access as a legitimate wallet would, the extension silently fragmented the phrase into smaller pieces and encoded them to look like random, harmless wallet addresses.
Socket’s rigorous technical research shows that these fragmented pieces were subsequently inserted directly into Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—such exceptionally small amounts of cryptocurrency that they would never draw attention—to addresses directly controlled by the attacker.
Hidden securely inside those seemingly innocuous transactions, embedded either within memo fields or obfuscated destination addresses, were the exact recovery components of the user’s seed phrase.
This ingenious approach provided distinct tactical advantages to the malicious actors. It entirely eliminated the need for the extension to send suspicious outbound network requests to malicious external servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration conducted over standard HTTP or WebSockets protocols that a modern browser or antivirus program might easily flag and block.
Instead, the payload left the user’s device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee blockchain network. Once successfully stored on-chain, the sensitive data was publicly accessible, allowing the attacker to retrieve it at their convenience, reconstruct the full seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s compromised device again.
In effect, the scam utilized the Sui blockchain itself as an alternative communications channel. And because the Sui network features remarkably fast transaction confirmation times and negligible gas costs, it functioned smoothly as a low-latency message bus for the hackers.
Socket successfully traced multiple historical examples of these seed-fragment transactions and definitively confirmed the direct link between the initial entry of a seed phrase and the eventual, devastating loss of assets. While the actual thefts occurred off-chain—typically on Ethereum or other Layer-1 networks where the victims’ wallets conveniently held valuable funds—the explicit instructions required to carry them out were hidden entirely in plain sight.
Before finally releasing the polished version that managed to land squarely in Chrome’s top wallet search results, the publisher likely tested this novel method thoroughly in private. Digital evidence indicates that earlier, unreleased builds experimented with much simpler data leaks before the Sui encoding technique was fully refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough legitimate-looking installations to reach Chrome’s coveted "trending" tier, which further boosted its visibility to unsuspecting web users. Reports from industry outlets confirmed that the Safery wallet remained perched prominently among the top results for Ethereum wallet searches even as urgent reports of suspicious wallet behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying mechanics of Chrome’s store ranking logic. The Web Store search algorithm constantly weighs variables such as keyword matching, total install counts, review velocity, average user ratings, and the recency of software updates.
Browser extensions that experience a sudden, sharp burst of activity—especially within niche categories where competition is sparse—can climb rapidly through the directory if better-vetted, established competitors are not updated with high frequency. In this specific scenario, Safery benefited from a name that scored exceptionally well for common user queries, a blitz of positive user reviews consisting largely of templated or duplicated text, and a very fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific store listing prior to its public publication. Chrome Web Store policies typically subject most new extension submissions to a brief automated scan and fundamental static code analysis rather than rigorous human vetting.
Extensions generally undergo deeper, more manual scrutiny when they request highly elevated permissions, such as continuous access to browser tabs, the user’s clipboard, local file systems, or browsing history. Crypto wallet extensions frequently manage to avoid triggering these strict flags by operating carefully within isolated iframes or by utilizing standard, approved application programming interfaces. Safery strictly stayed within those safe operational bounds.
Even when concerned users raised red flags, the lag time between initial reporting and the eventual administrative takedown stretched out long enough for severe financial damage to occur. Part of that frustrating delay is structural: the Chrome platform typically does not act on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or clearly identified malware signatures.
In this instance, the underlying payload consisted of obfuscated JavaScript code that cleverly relied entirely on external blockchain infrastructure rather than traditional malicious hosting servers. Consequently, traditional malware detection methods failed to catch it in time.
This security incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency from unwary consumers. Previous notable scams have included fake Ledger Live companion apps that prompted users to enter their master recovery phrases, or hijacked legitimate extensions where attackers managed to gain unauthorized access to the original developer’s publishing keys.
What fundamentally differentiated Safery from past incidents was the remarkable smoothness of its frontend facade and the total absence of traditional backend cybercrime infrastructure. There was no fraudulent phishing website to take down, and no centralized command server to block; there was simply a single browser extension quietly moving secrets onto a public blockchain network and walking away without a trace.
Affected users still possessed some limited avenues of recourse. If they managed to act with extreme speed, they could successfully limit their overall exposure by rotating their seed phrases and immediately revoking outstanding transaction approvals across various decentralized applications.
Socket and other cybersecurity entities rapidly published clear triage steps for anyone who had inadvertently installed the extension: uninstall the software immediately, thoroughly revoke any active token approvals, securely sweep remaining digital assets to a brand-new wallet using an entirely clean device, and carefully monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent data exfiltration in time or who stored massive amounts of capital directly in vulnerable hot wallets, financial recovery remained highly unlikely.
Security researchers and independent software developers are now calling for much stronger automated heuristics directly from Google and the Chrome platform itself. One prominent proposed solution is to implement automatic flagging systems for any extension that includes user interface elements explicitly prompting individuals to input a 12-word or 24-word recovery phrase.
Another widely discussed approach is to require mandatory publisher attestation for all wallet-related extensions, providing verifiable, cryptographic proof that a given publisher genuinely controls the official codebase behind a known wallet brand. Industry voices are also pushing for significantly tighter inspection protocols concerning wallet-related permissions, even in instances where those permissions do not explicitly include traditional dangerous access patterns.
For everyday cryptocurrency users, Socket published a practical checklist for safer extension management moving forward. Before installing any crypto-related extension, users are advised to thoroughly review the publisher’s history, verify authentic associations with known and trusted projects, inspect review patterns closely for suspicious bursts of identical or templated feedback, check for real website links backed by public GitHub software repositories, and carefully scan the permissions tab for vague or sweeping access requests.
A clean product name and a high star rating are simply no longer enough to guarantee safety in the modern web environment.
This troubling case raises much broader, systemic questions regarding the browser’s expanding role within the cryptocurrency landscape. Browser-based wallets originally gained immense popularity primarily due to their accessibility and ease of use, allowing everyday users to interact smoothly with complex decentralized applications without needing to switch platforms or download separate desktop software.
However, that vital accessibility has come at a severe cost to overall security exposure. The modern web browser remains an inherently high-risk operating environment that is frequently subjected to extension manipulation, session hijacking, clipboard scraping scripts, and now, covert blockchain-based data exfiltration.
Cryptocurrency wallet developers are now very likely to rethink their long-term distribution models. Some prominent development teams already strongly discourage Chrome Web Store installations altogether, preferring instead to direct users toward secure standalone mobile applications or native desktop binaries. Other projects may soon build automated warnings into their interfaces for users who attempt to download software from unverified sources.
The core underlying problem persists: software distribution remains heavily fragmented, and the average consumer simply does not possess the technical expertise required to easily distinguish a legitimate, secure wallet from a highly polished clone.
The Safery extension did not need to successfully mimic MetaMask or masquerade as Phantom to achieve its goals. It simply created its own brand, seeded artificial trust signals into the marketplace, and constructed an invisible digital backdoor that utilized the Sui blockchain network as a silent courier.
That reality should force a much-needed industry-wide rethink of how trust is established within cryptocurrency user experiences, and just how close to the underlying metal even casual tools like browser extensions really operate. Crypto users frequently assume that Web3 technology inherently guarantees digital sovereignty and true self-custody. But in the wrong hands, an unsecured browser wallet is not a digital vault—it is an open port. And the browser will not always warn you before something dangerous slips right through.
