For a few critical days in November, a deceptive and malicious Google Chrome extension managed to secure the fourth position in search results for the term “Ethereum wallet” on the official Chrome Web Store. The application, marketed under the seemingly innocuous name “Safery: Ethereum Wallet,” was crafted with enough professional polish to easily pass as a legitimate financial tool to the average web user. It featured a clean, modern icon, a generic title coupled with security-adjacent terminology, a heavy influx of five-star ratings, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a digital asset management tool.
Beneath this polished frontend, however, lay a purpose-built cyberattack mechanism. The extension was engineered to intercept, capture, and exfiltrate user seed phrases, systematically emptying victim wallets by encoding the stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light and thoroughly examined by Socket, a prominent security tooling company that specializes in monitoring and securing open-source software supply chains. Researchers at Socket installed and analyzed the extension shortly after its discovery to determine how “Safery” managed to evade automated detection systems, successfully climb the competitive Chrome Store rankings, and exfiltrate sensitive recovery phrases without immediately raising alarms among users or security software. Their subsequent technical report functions simultaneously as a postmortem of the security failure and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident notably distinct is that the threat actors behind the scheme did not rely on the well-trodden territory of brand spoofing. Unlike countless previous attacks that attempted to mimic established names like MetaMask or recycle defunct phishing domains, Safery invented an entirely new brand identity from scratch. The perpetrators purchased or generated automated bot reviews to artificially inflate its search rankings and launched the software as a fresh, legitimate wallet option within the marketplace.
Because of this original-identity approach, the store listing presented virtually no immediate red flags to casual browsers. There was no broken grammar in the descriptions, no requests for excessive or unusual permissions, and no sudden redirections to shady external domains. The official Chrome Web Store publisher page contained no prior user complaints, and its designated support URL directed traffic to an off-platform website that security tracking firms had not yet flagged at the time of Socket’s analysis.
Given its convincing appearance, most prospective users would have felt little hesitation before clicking the "Add to Chrome" button. The extension requested permission to run on all websites, which is a standard, ubiquitous requirement for cryptocurrency wallets that need to interact seamlessly with various decentralized applications across the web. Notably, it refrained from prompting users for extra permissions or attempting to inject complex content scripts that typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the accompanying website matched the exact name of the extension, and the initial setup screen simply prompted users to either create a brand-new wallet or import an existing one—standard behaviors for any legitimate digital currency tool.
The Seed Heist, Broadcast Over Sui
The true damage of the operation began the moment a user inputted their sensitive recovery seed phrase into the interface. Rather than storing the phrase locally or securely encrypting it for user-controlled access, the extension silently fragmented the phrase into smaller pieces. It then cleverly encoded these fragments to masquerade as seemingly random wallet addresses.
According to Socket’s detailed research, these fragmented pieces were embedded directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so negligible that they would never draw attention—to specific wallet addresses completely controlled by the attacker. Hidden safely inside those transactions, tucked away either within memo fields or obfuscated recipient addresses, were the broken-down components of the user’s secret seed phrase.
This tactical approach offered significant advantages to the hackers. It entirely eliminated the need for the extension to send outbound network requests to external, malicious command-and-control servers. There was no persistent beaconing or data exfiltration over standard HTTP protocols or WebSockets that a traditional web browser or commercial antivirus software might easily flag.
Instead, the payload departed the victim’s local device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used and low-fee blockchain network. Once successfully published on-chain, the data remained publicly accessible, granting the attacker the freedom to retrieve it at their convenience, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the operation utilized the Sui blockchain itself as a covert communications channel. Because the Sui network boasts exceptionally fast confirmation times alongside negligible transaction costs, it functioned effectively as a low-latency message bus for the thieves. Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between entering a recovery phrase into the extension and the subsequent loss of digital assets. While the actual thefts occurred off-chain—primarily on Ethereum or other Layer 1 networks where the victims’ wallets stored their actual capital—the explicit instructions required to execute those thefts were hidden completely in plain sight on an entirely different blockchain.
Before releasing the polished version that eventually landed in Chrome’s top wallet search results, the publisher likely tested the methodology in private environments. Digital forensics indicate that earlier, unreleased builds experimented with much simpler data leakage techniques before the Sui encoding strategy was fully refined. By the time the active, malicious extension was finally identified and flagged, it had accumulated enough total installations to surge into Chrome’s coveted "trending" tier, which further amplified its visibility to unsuspecting web users. Outlets like Brave New Coin reported that the Safery wallet remained prominently featured among the top results for Ethereum wallet searches even as growing reports of suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying mechanics of Chrome’s search ranking logic. The Web Store search algorithm continuously weighs multiple factors, including keyword matching, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden, concentrated burst of activity, particularly within specialized or niche categories, can climb search rankings rapidly if their more thoroughly vetted competitors are not updated with equivalent frequency. In this specific scenario, Safery combined a keyword-optimized name that scored exceptionally well for common search queries, a coordinated blitz of positive reviews that often featured duplicated or templated language, and a very fresh upload timestamp.
There is currently no public evidence indicating that Google manually reviewed the listing prior to its automated publication. Standard policy for the Chrome Web Store subjects most new extensions to a brief automated security scan alongside fundamental static analysis.
Deeper scrutiny is typically reserved for extensions that request heavily elevated permissions, such as wide-ranging access to user tabs, system clipboards, local file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating carefully within isolated iframes or utilizing officially approved application programming interfaces. Safery strictly remained within those permitted boundaries.
Even when vigilant users raised initial concerns, the lag time between reporting a malicious asset and its eventual takedown stretched out long enough for substantial financial damage to occur. Part of this delay is structural, as the Chrome platform rarely acts on flagged extensions instantly unless there is an overwhelming consensus of reports or a match with known malware signatures. In this case, the payload consisted entirely of obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than external hosting servers, rendering traditional malware detection methods ineffective.
This security incident is far from an isolated event; previous scams have targeted browser users via fake Ledger Live applications prompting recovery phrases or hijacked legitimate extensions that granted attackers access to developer publishing keys. However, the Safery incident stands out due to the remarkable smoothness of its frontend facade and the absolute absence of traditional backend infrastructure. There was no external phishing website to take down, and no rogue server to block—just a single browser extension quietly moving secrets onto a public blockchain before walking away.
Impacted users had limited avenues for recourse. Those who acted with extreme urgency could occasionally mitigate their exposure by rapidly rotating their seed phrases and revoking active smart contract approvals. Security firms like Socket published clear triage steps for anyone who had installed the extension, recommending immediate uninstallation, the revocation of all token approvals, sweeping remaining assets to a fresh wallet using an entirely clean device, and closely monitoring associated addresses. For users who failed to notice the silent exfiltration or those who kept large balances within vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers and developers are now renewing calls for stronger heuristics directly within the Chrome platform. Proposed defensive measures include automatically flagging any extension that features user interface elements prompting for standard 12- or 24-word recovery phrases. Additional recommendations include mandating strict publisher attestation for all wallet extensions to provide verifiable cryptographic proof that a given publisher genuinely controls the codebase behind an established brand name.
As the cryptocurrency community reassesses the inherent risks of browser-based financial tools, the incident serves as a powerful reminder that convenience often comes at the steep price of heightened exposure. The browser remains a complex, high-risk environment vulnerable to extension manipulation, session hijacking, and covert blockchain exfiltration, proving that even casual utility software can transform a digital vault into an open port.
