For a critical few days last November, a cleverly disguised malicious cryptocurrency extension managed to secure the fourth position in the search rankings for “Ethereum wallet” on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was crafted with enough polish and professional design to easily pass as a completely legitimate financial tool. It featured a clean, modern icon, a generic name cleverly positioned alongside security-related terminology, a sudden and overwhelming influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a decentralized finance tool or a standard cryptocurrency wallet.
However, hiding directly behind that polished frontend was a purpose-built, highly targeted attack designed to systematically steal user seed phrases and completely empty user wallets. Instead of relying on traditional, easily flagged methods of data theft, the creators of Safery engineered a novel exfiltration technique that encoded stolen secrets into tiny micro-transactions executed directly on the Sui blockchain.
Security tooling company Socket, which focuses heavily on open-source software supply chains, quickly installed and thoroughly analyzed the extension shortly after its malicious nature was discovered by the broader cybersecurity community. Their primary investigative goal was to understand precisely how Safery managed to evade initial detection mechanisms, successfully climbed the competitive Chrome Store rankings, and exfiltrated sensitive seed phrases without raising automated alarms. Furthermore, the security team wanted to determine what everyday users could do to spot remarkably similar threats in the future. The resulting technical report walks through the attacker’s sophisticated approach, serving simultaneously as a postmortem analysis and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular security incident is noteworthy because the malicious actors behind it did not simply rely on stealing seed phrases through standard, well-trodden phishing techniques. While stealing recovery phrases is, unfortunately, a common occurrence in the cryptocurrency space, Safery broke new ground in its distribution strategy. The extension did not attempt to spoof an existing, highly trusted wallet brand. It was not disguised as a MetaMask lookalike or hosted on a recycled, suspicious phishing domain. Instead, it manufactured an entirely new identity from scratch, purchased or deployed automated bot networks to generate fake reviews to rapidly climb search result rankings, and launched itself cleanly as a seemingly brand-new wallet option.
This calculated approach meant that the extension’s store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no requests for excessive or suspicious browser permissions, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page associated with the listing had no prior complaints or warning flags, and its designated support URL directed users to an off-platform website that had not yet been flagged by security trackers at the time of Socket’s comprehensive analysis.
Given its highly polished appearance and lack of visible warning signs, most casual users would not have hesitated for a single moment before clicking the "Add to Chrome" button. The extension requested permission to run across "all websites," which is a standard, everyday request for crypto wallets that need active integration with various decentralized applications. Notably, Safery did not prompt users for extra, intrusive permissions or attempt to inject content scripts that would typically trigger Chrome’s more aggressive automated security warnings. Its branding remained entirely minimalist, the official website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—again, completely standard behavior for a modern software wallet.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment an unsuspecting user entered their private seed phrase into the extension. Instead of storing the sensitive phrase locally on the device or encrypting it securely for user access, the extension silently split the recovery phrase into small fragments. It then encoded these fragments into what appeared to be completely random, harmless blockchain addresses.
Socket’s intensive research revealed that these data fragments were deliberately inserted into active Sui blockchain transactions. Specifically, the extension issued tiny SUI token transfers—minuscule monetary amounts designed to draw zero attention from automated monitoring systems—to external addresses controlled entirely by the malicious actors. Hidden meticulously inside those seemingly innocuous transactions, either tucked away inside memo fields or obfuscated directly within the structure of the addresses, were the critical pieces of the user’s private seed phrase.
This tactical approach provided the attackers with significant operational advantages. Because the data was transmitted through normal blockchain interactions, the extension did not require any outbound network requests to malicious, external servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration over standard HTTP or WebSockets channels that a modern browser or antivirus program might readily flag and block.
Instead, the payload successfully left the user’s device disguised as a completely normal-looking blockchain transaction, routed seamlessly through a widely used, low-fee layer-1 chain. Once successfully recorded on-chain, the data became publicly accessible, allowing the attacker to quietly retrieve it at their convenience, reconstruct the full seed phrase, and systematically sweep connected wallets clean without ever needing to touch the user’s device again.
In practical terms, the scam ingeniously utilized the Sui blockchain itself as a covert communications channel. Because the Sui network boasts extremely fast confirmation times and negligible transaction costs, it functioned effectively as a low-latency message bus for the thieves.
Socket successfully traced multiple historical examples of these seed-fragment transactions and definitively confirmed the direct link between the initial entry of a seed phrase and the eventual, devastating loss of digital assets. While the actual thefts occurred off-chain—typically on Ethereum or other layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry them out were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher likely tested this novel method in private development environments. Digital evidence uncovered during the investigation shows that earlier, experimental builds had tested simpler data leaks before the Sui encoding mechanism was fully refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installs to comfortably reach Chrome’s "trending" tier, which further boosted its overall visibility and credibility. Industry reports confirmed that the Safery wallet sat prominently among the top results for "Ethereum wallet" searches even as mounting reports of suspicious account drains began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged directly on the underlying mechanics of Chrome’s search and ranking logic. The official Web Store search algorithm heavily weighs factors such as keyword matching, total install counts, review velocity, average user ratings, and the recency of software updates.
Extensions that experience a sudden, manufactured burst of activity, particularly within specialized or niche categories, can climb rapidly through the directory rankings if better-vetted, legitimate competitors are not updated frequently enough. In this specific case, Safery benefited from a strategically chosen name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews—many of which were clearly templated or duplicated—and a very fresh upload date.
There is currently no evidence indicating that Google manually reviewed this specific listing prior to its publication. Standard Chrome Web Store policies typically process most new extension submissions through a brief automated scan and fundamental static analysis rather than intensive human review.
Extensions generally undergo deeper, manual scrutiny only when they request elevated, potentially dangerous permissions, such as broad access to browser tabs, local clipboards, file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter flags by operating safely within isolated iframes or by utilizing standard, approved application programming interfaces. Safery strictly adhered to these technical boundaries to avoid raising alarms.
Even when vigilant users raised serious concerns and began reporting the suspicious activity, the critical time gap between the initial reports and the eventual takedown of the extension stretched on long enough for significant financial damage to occur. Part of that operational lag is structural: the Chrome Web Store does not act on flagged extensions instantaneously unless there is an overwhelming community consensus or known malware signatures that match existing databases.
In this particular case, the malicious payload consisted of obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than external, blockable hosting servers. Traditional malware detection methods simply failed to catch it.
This incident is not an isolated event; historically, browser extensions have repeatedly been weaponized to target cryptocurrency users. Previous notable scams have included fake Ledger Live applications that deceptively prompted users to enter their sensitive recovery phrases, or hijacked legitimate, pre-existing extensions that allowed attackers to successfully access the original developer’s publishing keys.
What ultimately sets Safery apart from these older threats is the sheer smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no classic phishing website to take down, and no centralized server IP address to block—just a single extension quietly moving private secrets onto a public blockchain and walking away.
Impactful recovery options for victims remained painfully narrow. Users who acted with extreme swiftness could occasionally limit their overall exposure by immediately rotating their seed phrases and revoking active smart contract transaction approvals.
Security researchers and prominent developers are now calling for significantly stronger heuristics from Google and the Chrome ecosystem. One heavily proposed technical solution involves automatically flagging and restricting any browser extension that includes user interface elements prompting individuals to input a 12- or 24-word recovery phrase.
Another widely discussed approach requires mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the underlying codebase behind an established, recognized wallet brand. Furthermore, industry experts are urging tighter, more rigorous inspections of wallet-related permissions, ensuring that even seemingly benign extensions undergo heightened scrutiny.
For end users navigating this high-risk landscape, security analysts have published practical checklists for comprehensive extension management. Before installing any cryptocurrency-related extension, users are strongly advised to thoroughly review the publisher’s historical track record, verify official associations with recognized blockchain projects, inspect review patterns for artificial bursts of identical feedback, check for legitimate website links backed by active public code repositories, and carefully scan the permissions tab for vague or sweeping system access.
A clean, professional name and a high star rating are simply no longer enough to guarantee safety in the digital asset space. This alarming incident raises much broader, systemic questions regarding the browser’s expanding role as a primary gateway to decentralized finance. Browser-based wallets originally gained widespread popularity due to their unmatched accessibility and ease of use, allowing everyday users to interact seamlessly with complex decentralized applications without needing to switch platforms or download separate, standalone desktop applications.
However, that vital accessibility has come at a severe cost to overall security exposure. The modern web browser remains a fundamentally high-risk environment that is continually subjected to malicious extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As the industry grapples with these evolving threats, wallet developers are likely to fundamentally rethink traditional distribution models. Some dedicated development teams already actively discourage Chrome Web Store installations, preferring safer native mobile applications or secure desktop binaries instead. Others may soon implement built-in browser warnings for users attempting to install wallet software from unverified, third-party sources.
The core underlying problem remains stubbornly persistent: software distribution across the web is deeply fragmented, and the vast majority of everyday users lack the technical expertise required to easily distinguish a legitimate financial wallet from a polished, malicious clone.
The Safery extension did not need to successfully mimic MetaMask or masquerade as Phantom to achieve its goals. It simply engineered its own independent brand, cultivated artificial trust signals through fake reviews, and constructed an invisible digital backdoor that leveraged an active blockchain network as a courier for stolen assets.
That harsh reality should force a comprehensive rethink of how digital trust is established within cryptocurrency user experiences, and how close to the underlying operating system even casual tools like browser extensions truly operate. Cryptocurrency users often enter the Web3 space assuming that decentralization guarantees absolute financial sovereignty and self-custody. Yet, in the wrong hands, an unsecured browser-based wallet functions less like a secure digital vault and more like an open port—and the browser will not always warn you before something slips silently through.
