For a few critical days in November, a sophisticated malicious Chrome extension managed to climb the ranks of the Chrome Web Store, positioning itself as the fourth organic search result for the high-volume query "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," was engineered with a level of polish that allowed it to easily pass as a legitimate tool to unsuspecting users. It featured a clean, professional icon, a generic name cleverly positioned adjacent to security-focused terminology, a massive influx of five-star reviews, and boilerplate descriptions that are instantly familiar to anyone who has ever ventured into downloading a decentralized cryptocurrency wallet.
Beneath this polished and deceptive frontend, however, lay a purpose-built attack mechanism. The extension was designed to silently capture seed phrases, fragment them, and empty user wallets by cleverly encoding the stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light and thoroughly analyzed by Socket, a prominent security tooling company specializing in open-source software supply chains. After discovering the rogue extension in the store, Socket’s security researchers installed and dissected the software to understand the anatomy of the attack. Their primary goal was to uncover how "Safery" managed to completely evade automated detection, rapidly climb the competitive Chrome Store search rankings, and exfiltrate sensitive seed phrases without raising immediate alarms, while also providing crucial insights into how users can better spot and defend against similar threats in the future. The resulting technical report serves simultaneously as a forensic postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy within the cybersecurity and blockchain communities is that the malicious actors behind it did not rely on traditional, heavily recycled tactics. Stealing seed phrases is, unfortunately, a well-trodden and frequently encountered territory in the world of crypto crime. However, Safery distinguished itself by avoiding the common playbook of spoofing an existing, trusted wallet brand. It was not a clumsy MetaMask lookalike, nor was it hosted on a recycled or typo-squatted phishing domain. Instead, the creators invented an entirely new identity from scratch, purchased or generated a wave of botted fake reviews to artificially inflate its search rankings, and launched the software cleanly as a brand-new, independent wallet option.
This calculated approach meant that the listing page presented virtually no immediate red flags to casual observers or automated scanners. There was no broken grammar, no request for bizarre or excessively invasive permissions, and no suspicious redirection to shady, unverified external domains. The Chrome Web Store publisher page itself had zero prior complaints or flags, and the provided support URL directed visitors to an off-platform website that had not yet been flagged by security trackers or threat intelligence feeds at the time of Socket’s analysis.
Given its sleek and professional appearance, the average user would have felt little to no hesitation before clicking the "Add to Chrome" button. Like many standard web3 tools, the extension requested permission to run on all websites—a necessary and common request for crypto wallets that need to seamlessly interact with various decentralized applications across the web. Notably, it refrained from prompting users for extra, high-risk permissions and avoided attempting to inject content scripts that would typically trigger Chrome’s more aggressive security warnings. The branding was minimalist, the accompanying website mirrored the extension’s name precisely, and the initial setup screen guided users through the standard, expected behavior of creating a brand-new wallet or importing an existing one.
The Seed Heist, Broadcast Over Sui
The true damage of the operation began the moment a user entered their sensitive seed phrase into the interface. Rather than storing the recovery phrase locally or attempting to encrypt it for legitimate user access, the extension silently dissected the phrase into smaller fragments. It then systematically encoded these fragments to look like completely random, innocuous wallet addresses.
Socket’s rigorous research revealed that these cryptographic and textual fragments were systematically inserted into genuine transactions on the Sui blockchain. Specifically, the malicious extension executed minuscule SUI token transfers—amounts so vanishingly small that they would never draw the attention of a casual observer or automated balance tracker—sending them to various addresses directly controlled by the attackers. Embedded deep inside those seemingly routine transactions, tucked away safely within memo fields or obfuscated recipient addresses, were the broken-down pieces of the victim’s master seed phrase.
This tactical execution offered profound advantages to the hackers. Because the data was smuggled out via legitimate network operations, the extension did not need to send outbound network requests to malicious, external servers. There was no traditional command-and-control beacon operating in the background, and no suspicious data exfiltration occurring over HTTP or WebSockets that a modern web browser or local antivirus software might flag and intercept.
Instead, the payload left the user’s personal device disguised as an ordinary, everyday blockchain transaction, routed smoothly through a widely utilized, low-fee blockchain network. Once successfully published on-chain, the data was publicly accessible, permitting the attackers to retrieve the pieces at their leisure, reconstruct the master seed phrase, and systematically sweep the victims’ assets clean across various chains without ever needing to touch the user’s compromised device a second time.
In effect, the operation weaponized the Sui blockchain itself, turning it into a covert communications channel. Because the Sui network boasts exceptionally fast confirmation times alongside practically negligible transaction costs, it functioned flawlessly as a low-latency message bus for the thieves.
Socket successfully traced multiple historical examples of these seed-fragment transactions on-chain, definitively confirming the direct correlation between seed entry within the fake extension and the eventual loss of digital assets. While the actual thefts of cryptocurrency occurred off-chain—taking place on Ethereum or other Layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Evidence uncovered during the analysis indicates that the publisher likely tested this novel method extensively in private before releasing the polished version that eventually conquered Chrome’s top wallet search results. Earlier, discarded builds experimented with far simpler data leaks before the sophisticated Sui encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough fraudulent installs to secure a coveted spot in Chrome’s "trending" tier, which further amplified its visibility and reach. Reports from industry outlets confirmed that the Safery wallet comfortably maintained its position among the top results for "Ethereum wallet" searches even as growing warnings and complaints began circulating openly within communities on Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged almost entirely on the specific mechanics of Chrome’s internal search ranking algorithm. The Web Store search logic heavily weighs factors such as keyword matching, total install counts, review velocity, overall average ratings, and the recency of the last software update.
Extensions that experience a sudden, concentrated burst of user activity—particularly within niche or high-demand categories—can climb the charts rapidly, especially if better-vetted, established competitors fail to update their listings frequently. In this instance, Safery benefited from a title that optimized perfectly for common user search queries, a blitz of positive reviews that relied on duplicated templates, and a fresh upload timestamp.
Available evidence indicates that Google did not subject this specific listing to rigorous manual human review prior to publication. Standard Chrome Web Store policy subjects most new software submissions to a brief, automated security scan alongside fundamental static analysis.
Extensions typically undergo deeper, more intrusive scrutiny only when they request explicitly elevated permissions, such as gaining sweeping access to user tabs, system clipboards, local file systems, or browsing history. Wallet extensions frequently manage to sidestep these heavier automated flags by operating strictly within isolated iframes or by leveraging standard, approved browser APIs. Safery carefully stayed well within those permissible bounds.
Even after concerned users began raising alarms and reporting the extension, the lag time stretching between initial reports and the eventual takedown by platform administrators proved more than long enough for significant financial damage to occur. Part of that delay is structural; the Chrome ecosystem rarely acts on flagged extensions instantaneously unless there is an overwhelming consensus of reports or a definitive match with known malware signatures.
In this scenario, however, the payload consisted of heavily obfuscated JavaScript that relied exclusively on legitimate blockchain infrastructure rather than external host servers. Traditional malware detection models simply failed to catch it.
This incident is far from the first time browser extensions have been weaponized to pilfer cryptocurrency from unsuspecting holders. Previous high-profile scams have included fraudulent Ledger Live applications prompting users to enter recovery phrases, or the hijacking of legitimate, long-standing extensions to grant unauthorized attackers access to a developer’s private publishing keys.
What fundamentally set Safery apart was the sheer smoothness of its facade and the complete absence of traditional backend infrastructure. There was no classical phishing website to seize and take down, and no malicious command server to block—just a single browser extension quietly depositing hidden secrets onto a public blockchain network and walking away.
For those who fell victim, potential recourse remained exceedingly narrow. Users who acted with extreme swiftness could occasionally limit their overall exposure by immediately rotating their seed phrases and revoking active smart contract transaction approvals.
Security researchers swiftly published triage steps for anyone who had mistakenly installed the extension: uninstall the software immediately, revoke all existing token approvals, safely sweep remaining digital assets to a brand-new wallet generated on an entirely clean device, and closely monitor all associated addresses. For users who failed to notice the silent exfiltration in time, or for those who maintained substantial holdings in vulnerable hot wallets, asset recovery remained virtually impossible.
Industry developers and security experts are now calling for significantly stronger heuristics directly from Google and the Chrome team. Among the most prominent proposals is the implementation of automated flags for any browser extension that introduces user interface elements explicitly prompting for standard 12- or 24-word recovery phrases.
Additional recommendations include mandating rigorous publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a specific publisher genuinely controls the underlying codebase of a recognized wallet brand. Calls have also intensified for much tighter regulatory and technical inspection of wallet-related permissions, even in instances where those permissions do not explicitly trigger dangerous access patterns.
For everyday end users, security firms continue to advocate for practical checklists when managing browser extensions. Before installing any software interacting with cryptocurrency, users are advised to thoroughly research the publisher’s historical background, verify direct associations with known development teams, carefully inspect review patterns for artificial bursts of identical text, cross-reference official website links with public code repositories, and scrutinize the permissions tab for sweeping or vaguely defined access. A clean name and a high star rating are no longer sufficient guarantees of safety.
This troubling episode raises much broader, systemic questions regarding the fundamental role the modern web browser plays within the cryptocurrency landscape. Browser-based wallets originally soared in popularity due to their unmatched accessibility and user-friendly nature, allowing individuals to interact effortlessly with decentralized applications without switching computing environments or installing standalone desktop applications.
However, that profound accessibility has come at a severe cost to security. The web browser remains an inherently high-risk environment, perpetually vulnerable to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based exfiltration.
As a result, professional wallet developers are increasingly likely to rethink their primary distribution models. Some forward-thinking teams already actively discourage Chrome Web Store installations, preferring to steer users toward standalone mobile applications or verified desktop binaries. Others may soon introduce proactive warnings for users attempting to install wallet software from unverified or newly minted publisher accounts.
The core underlying challenge persists: software distribution remains heavily fragmented, and the vast majority of retail users lack the technical expertise required to easily distinguish a legitimate, secure wallet from a polished clone.
The Safery extension proved that attackers no longer need to successfully impersonate industry giants like MetaMask or Phantom to succeed. By engineering an original brand, manufacturing artificial trust signals, and constructing an invisible backdoor that utilized a public blockchain as its courier, the attackers bypassed traditional defenses entirely.
The incident forces a critical re-evaluation of how trust is established within cryptocurrency user experiences, and demonstrates just how deeply integrated everyday browser tools have become with the foundational infrastructure of digital finance. Crypto users have long operated under the foundational assumption that Web3 technology inherently guarantees sovereignty and self-custody. Yet, in the hands of sophisticated malicious actors, a standard browser wallet ceases to function as a secure vault, transforming instead into an open port—and the browser will not always issue a warning before something slips right through.
