For a few critical days last November, a deceptive and malicious Chrome extension managed to climb the ranks of the Chrome Web Store to secure the fourth position for the heavily searched query “Ethereum wallet.” Disguised under the name “Safery: Ethereum Wallet,” the application was engineered with a level of polish that easily allowed it to pass as a legitimate tool for cryptocurrency users. It featured a clean, professional icon, a generic yet reassuring name adjacent to security-oriented language, a flood of glowing five-star reviews, and boilerplate descriptions that instantly look familiar to anyone who has ever downloaded a digital asset manager.
However, behind this sophisticated frontend interface lay a purpose-built cyberattack. The extension was designed specifically to intercept, steal, and exfiltrate user seed phrases, systematically emptying victim wallets by encoding the stolen secrets directly into micro-transactions routed through the Sui blockchain. The scheme went largely unnoticed until security tooling company Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its initial discovery in the wild.
Socket’s primary objective was to dissect how “Safery” managed to evade automated detection systems, successfully manipulate the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without triggering immediate security alarms. Furthermore, the researchers sought to understand what everyday users could do to spot similar threats in an environment where browser extensions remain a persistent, high-risk blind spot for the broader cryptocurrency ecosystem. The resulting security report serves simultaneously as a forensic postmortem of the attack and a stark warning about the vulnerabilities inherent in browser-based crypto infrastructure.
What makes this particular incident especially noteworthy for cybersecurity experts and digital asset holders alike is that the hackers did not merely resort to well-trodden territory by spoofing an existing, trusted wallet brand. It was not a clumsy MetaMask lookalike or a recycled phishing domain designed to catch careless traders off guard. Instead, the threat actors invented an entirely new identity, artificially inflating its visibility by purchasing or generating bot-driven fake reviews to climb search algorithms, and launched the application as a completely "new" wallet option on the market.
This calculated approach meant that the extension’s listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no obviously suspicious permissions requested during the installation phase, and no redirection to shady, blacklisted domains. The Chrome Web Store publisher page was completely clean of prior complaints, and its designated support URL led to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket’s investigation.
Given its remarkably polished appearance, the average user would likely not have hesitated for a single moment before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, the application did not prompt for extra, unusual permissions or attempt to inject aggressive content scripts that would typically trigger Chrome’s more stringent security warnings. The overall branding was minimalist, the accompanying website mirrored the extension’s exact name, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—behavior that mimics legitimate software down to the smallest detail.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally on the machine or properly encrypting it for user access, the malicious extension silently split the recovery words into fragmented pieces. It then ingeniously encoded these fragments to look like completely random, innocuous wallet addresses.
Socket’s rigorous research revealed that these data fragments were covertly inserted directly into Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—amounts so small they would never draw the attention of a user or automated monitoring tool—to various addresses directly controlled by the attacker. Hidden deep inside those blockchain transactions, either embedded within memo fields or obfuscated directly within the transaction addresses themselves, were the discrete pieces of the victim’s seed phrase.
This tactical methodology provided the attackers with significant operational advantages. Because the data was transmitted on-chain, the extension did not require any outbound network requests to malicious command-and-control servers. There was no suspicious beaconing activity, nor was there any data exfiltration over traditional HTTP or WebSockets that a standard browser extension monitor or local antivirus program might easily flag.
Instead, the payload seamlessly left the user’s local device disguised as an entirely normal-looking blockchain transaction, routed securely through a widely used, low-fee layer-1 chain. Once permanently recorded on-chain, the fragmented data was publicly accessible, permitting the attacker to retrieve it at their leisure, reconstruct the complete seed phrase offline, and systematically sweep funds from the victims’ wallets without ever needing to touch the user’s device a second time.
In effect, the scam creatively utilized the Sui blockchain itself as an unconventional communications channel. Because the Sui network boasts fast confirmation times and negligible transaction costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple historical examples of these seed-fragment transactions, definitively confirming the direct causal link between the entry of a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts of cryptocurrency occurred off-chain—typically on Ethereum or other major layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the thefts were hidden in plain sight on an entirely different blockchain.
Before releasing the final version that successfully landed in Chrome’s top search results, the publisher almost certainly tested this clandestine method in private environments. Forensic evidence indicates that earlier, unreleased builds experimented with much simpler data leaks before the Sui encoding mechanism was fully refined and optimized. By the time the active, malicious extension was finally flagged by the security community, it had accumulated enough installations to reach the Chrome Web Store’s coveted "trending" tier, which further amplified its visibility. Reports from industry observers confirmed that the "Safery" wallet managed to sit comfortably among the top search results for Ethereum wallets even as early warnings and reports of suspicious account behavior began circulating across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged entirely on the underlying mechanics of Chrome’s search and ranking logic. The Web Store search algorithm continually weighs a complex combination of factors, including keyword matches, total install counts, review velocity, average user ratings, and the recency of updates.
Extensions that experience a sudden burst of activity—especially within niche categories like finance and security—can climb the rankings rapidly if better-vetted competitors are not updated frequently enough to maintain algorithm relevance. In this specific case, "Safery" benefited from a name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, fresh upload date.
There is currently no evidence to suggest that Google manually reviewed the listing prior to its publication. The standard Chrome Web Store policy subjects most new extension submissions to a brief automated scan alongside fundamental static analysis. Extensions typically undergo much deeper scrutiny only when they request highly elevated permissions, such as direct access to browser tabs, the system clipboard, local file systems, or browsing history. Wallet extensions routinely manage to bypass these stricter flags by operating carefully within iframes or utilizing officially approved developer APIs, and "Safery" strictly stayed within those allowable bounds.
Even after concerned users began raising alarms, the critical window of time between the initial reporting and the eventual takedown of the extension stretched on long enough for extensive financial damage to occur. Part of this vulnerability is structural: the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or recognized malware signatures matching known databases.
In this instance, the payload consisted of heavily obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than external, blockable hosts, rendering traditional malware detection methods utterly ineffective. This incident is far from an isolated event, as previous security breaches have involved fake Ledger Live apps prompting users for recovery phrases or hijacked legitimate extensions that granted attackers access to developer publishing keys.
What fundamentally set "Safery" apart, however, was the seamless professionalism of its facade and the complete absence of traditional backend infrastructure. There was no external phishing website to take down and no command server to block—just a single browser extension quietly depositing secrets onto a public blockchain and walking away.
Users affected by the breach still retained limited avenues for recourse. Those who acted rapidly could mitigate their exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized applications. Security firms like Socket promptly published triage steps for anyone who had installed the software: uninstall the extension immediately, revoke token approvals, sweep remaining assets to a freshly generated wallet created on a clean, uncompromised device, and closely monitor associated addresses. For users who failed to notice the silent exfiltration in time, or for those who stored large amounts of capital in vulnerable hot wallets, asset recovery remained an impossibility.
The incident has intensified calls from security researchers and software developers urging Google to implement stronger heuristics within the Chrome browser itself. Among the proposed solutions is the automated flagging of any extension that includes user interface elements prompting for standard 12-word or 24-word recovery phrases.
Another prominent recommendation involves requiring mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the codebase behind a recognized wallet brand. Industry advocates are also pressing for tighter, more rigorous inspections of wallet-related permissions, even when those applications do not explicitly request dangerous system access patterns.
For end users, security analysts continue to emphasize the importance of rigorous due diligence before interacting with new software. Before installing any crypto-related browser extension, users are advised to thoroughly review the publisher’s history, verify authentic associations with known and trusted projects, inspect review patterns for artificial bursts of identical text, confirm the existence of real organizational websites paired with public code repositories, and carefully check the permissions tab for vague or sweeping access requests. Ultimately, a clean name and a high star rating are no longer sufficient guarantees of safety.
The situation raises broader, uncomfortable questions regarding the browser’s expanding role as a primary gateway for decentralized finance. Browser wallets initially gained immense popularity due to their high accessibility and ease of use, allowing everyday users to interact seamlessly with decentralized applications without the friction of switching platforms or downloading standalone desktop applications.
Yet that very convenience has come at the severe cost of heightened exposure. The modern web browser remains an inherently high-risk computing environment subject to extension manipulation, session hijacking, clipboard scrapers, and now covert, blockchain-based exfiltration.
As developers grapple with these persistent vulnerabilities, many are likely to fundamentally rethink traditional distribution models. Some crypto teams already actively discourage Chrome Web Store installations, preferring secure mobile applications or standalone desktop binaries. Others may soon introduce native warnings within their ecosystems for users attempting to interact with unverified browser sources.
The core dilemma remains stubbornly unresolved: software distribution is deeply fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a legitimate financial tool from a polished, malicious clone. The "Safery" extension proved that attackers no longer need to mimic established brands like MetaMask or Phantom; they can successfully fabricate their own trust signals and build an invisible digital backdoor that treats a public blockchain as a courier.
This reality demands a profound reassessment of how trust is established within cryptocurrency user experiences, and how closely integrated casual tools like browser extensions truly are to the underlying assets they protect. Crypto users inherently assume that Web3 technology guarantees absolute digital sovereignty and self-custody. However, in the wrong hands, a compromised browser wallet ceases to function as a secure vault and instead operates as an open port—and the browser will not always warn users before something slips through.
