For a few critical days in November, a malicious Google Chrome extension managed to climb the ranks and secure the fourth position for the search query "Ethereum wallet" on the official Chrome Web Store. The deceptive application, operating under the seemingly innocuous moniker "Safery: Ethereum Wallet," was designed with enough visual and functional polish to effortlessly pass as a legitimate piece of cryptographic software. It featured a clean, professional icon, a generic title that played on security-conscious terminology, a heavy influx of five-star user reviews, and standard descriptive text that would look entirely familiar to anyone who has ever downloaded a digital asset management tool.
Behind this meticulously crafted frontend, however, lay a sophisticated, purpose-built cyberattack. The extension was engineered to steal critical user credentials—specifically seed phrases—and systematically empty victim wallets by subtly encoding the pilfered secrets into micro-transactions executed on the Sui blockchain.
The threat was brought to light and thoroughly dissected by Socket, an enterprise security tooling company that specializes in monitoring open-source software supply chains. Shortly after the extension was flagged within the ecosystem, Socket’s security researchers installed and analyzed the software to understand the mechanics behind its operation. Their primary objective was to uncover how "Safery" managed to evade automated detection systems, successfully manipulate the Chrome Store search rankings, and exfiltrate sensitive seed phrases without raising immediate security alarms. Furthermore, the analysis aimed to provide actionable insights for users trying to spot similar threats in the wild. The resulting technical report functions simultaneously as a detailed postmortem of the incident and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency security landscape.
What makes this particular incident especially noteworthy within cybersecurity circles is that the malicious actors behind the scheme did not rely on the well-trodden tactics typically observed in crypto-related thefts. Historically, threat actors frequently resort to spoofing existing, trusted wallet brands by creating convincing MetaMask lookalikes or deploying recycled phishing domains designed to trick unsuspecting visitors. Safery, by contrast, forged an entirely independent identity. It invented a brand from scratch, utilized bought or botted fake reviews to artificially inflate its search rankings, and launched itself quietly as a seemingly brand-new, legitimate wallet alternative.
This calculated approach ensured that the extension’s store listing displayed virtually no immediate red flags. There was no broken grammatical syntax, no demand for suspicious or out-of-the-ordinary browser permissions, and no automated redirection to shady, unverified external domains. The publisher page on the Chrome Web Store featured no prior complaints from users, and its designated support URL directed traffic to an external website that had not yet been flagged by security trackers at the time of Socket’s investigation.
Given its remarkably polished presentation, the average user would likely experience no hesitation before clicking the "Add to Chrome" button. The extension requested permission to run across "all websites," which is a standard, ubiquitous requirement for cryptocurrency wallets that need deep functional integration with various decentralized applications across the web. Notably, it refrained from prompting users for extra, high-risk permissions or attempting to inject complex content scripts that would typically trip Chrome’s more aggressive automated security warnings. The overall branding was kept minimal and clean, the accompanying support website matched the exact name of the extension, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—behavior that mimics standard, legitimate industry practices.
The Seed Heist, Broadcasted Over Sui
The real financial damage began the moment an unsuspecting user entered their recovery seed phrase into the interface. Rather than securely storing the phrase locally or encrypting it for authorized user access, the malicious extension silently fractured the seed phrase into smaller pieces. It then ingeniously encoded these fragments so that they appeared to be entirely random, innocuous wallet addresses.
Socket’s comprehensive research indicates that these broken fragments were subsequently embedded directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—such negligible, fractional amounts that they would never draw the attention of automated monitoring systems or human observers—directed toward wallet addresses under the direct control of the attackers.
Hidden discreetly inside the structure of those transactions, either tucked away within internal memo fields or disguised within obfuscated recipient addresses, were the broken-down pieces of the user’s private seed phrase.
This tactical execution offered significant strategic advantages to the threat actors. Crucially, it meant the extension did not need to make any suspicious outbound network requests to malicious, centralized command-and-control servers. There was no traditional HTTP or WebSocket exfiltration beacon that a standard browser security monitor or antivirus program might readily flag and block.
Instead, the stolen payload departed the victim’s local device disguised as a completely normal-looking blockchain transaction, seamlessly routed through a widely adopted, low-fee blockchain network. Once successfully logged on-chain, the encoded data remained publicly accessible, granting the attacker the luxury of retrieving it at their convenience, reconstructing the complete seed phrase, and systematically sweeping the victim’s assets clean without ever needing to touch the user’s local device a second time.
In effect, the operation leveraged the Sui blockchain itself as an unconventional, covert communications channel. Because the Sui network boasts remarkably fast confirmation times alongside virtually negligible transaction costs, it functioned precisely like a low-latency message bus for the hackers.
Socket successfully traced multiple historical examples of these seed-fragment transactions on-chain, definitively confirming the direct correlation between seed entry within the fake extension and the subsequent loss of funds. While the actual asset thefts occurred off-chain—predominantly on Ethereum or other Layer 1 blockchain networks where the victims’ compromised wallets held substantial funds—the instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the polished version that eventually conquered Chrome’s top wallet search results, the publisher almost certainly tested the underlying methodology in a private environment. Evidence uncovered by researchers suggests that earlier, preliminary builds experimented with simpler data-leak mechanisms before the developers refined the Sui blockchain encoding technique.
By the time the active iteration of the extension was finally flagged and reported, it had accumulated a sufficient number of installations to secure a coveted spot in Chrome’s "trending" tier, which further amplified its visibility to prospective victims. Reports confirmed that the Safery wallet managed to maintain its prominent position among the top search results for Ethereum wallets even as early warnings regarding its suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery scam hinged heavily on the inherent ranking logic governing the Chrome Web Store. The internal search algorithm heavily weighs factors such as keyword matching, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden, sharp burst of activity—particularly within niche categories where established competitors are not updated frequently—can climb search rankings with alarming speed. In this specific case, Safery benefited from a title that scored exceptionally well against common user queries, a rapid blitz of positive reviews (many of which were clearly templated or duplicated), and a remarkably fresh upload timestamp.
There is currently no evidence indicating that Google manually reviewed this specific listing prior to its public publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated security scan accompanied by fundamental static analysis.
Extensions typically undergo deeper manual scrutiny only when they request explicitly elevated permissions, such as broad access to user tabs, system clipboards, local file systems, or browsing history. Wallet extensions frequently manage to bypass these aggressive flags by operating securely within isolated iframes or leveraging officially approved APIs. Safery carefully stayed well within those acceptable operational boundaries.
Even after concerned users began raising alarms, the critical window of time stretching from the initial reports to the eventual takedown by platform administrators was long enough for substantial financial damage to occur. Part of this persistent lag is structural: the Chrome ecosystem does not automatically disable or remove flagged extensions instantly unless there is an overwhelming consensus of abuse or a match against known malware signatures.
In this scenario, however, the payload consisted of heavily obfuscated JavaScript that cleverly relied entirely on third-party blockchain infrastructure rather than external, centralized hosts. Consequently, traditional malware detection signatures failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to target cryptocurrency users. Previous historical scams have involved fake Ledger Live application clones that prompted users to input their sensitive recovery phrases, or instances where legitimate, established extensions were hijacked by attackers who gained unauthorized access to the original developer’s publishing cryptographic keys.
What fundamentally sets the Safery incident apart is the extreme smoothness of its user-facing facade and the total absence of traditional backend infrastructure. There was no conventional phishing website to take down, no rogue server to block or seize—just a single browser extension quietly moving confidential secrets onto a public blockchain network and walking away without a trace.
Impactful recourse for affected users remained narrow. Those who acted with exceptional speed could limit their overall exposure by immediately rotating their seed phrases and revoking any active transaction approvals they had previously granted.
Security firms like Socket quickly published practical triage steps for anyone who realized they had installed the rogue extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets to a brand-new wallet using a completely clean and uncompromised device, and closely monitor all associated addresses for unauthorized activity. For users who failed to notice the silent exfiltration in time, or for those who stored large amounts of capital in vulnerable hot wallets, asset recovery remained an impossibility.
Security researchers and independent developers are now intensifying calls for stronger heuristic safeguards directly within the Chrome platform itself. One prominent proposal involves automatically flagging and quarantining any extension that includes user interface elements specifically prompting for standard 12-word or 24-word recovery phrases.
Another suggested defensive measure is the implementation of mandatory publisher attestation for all wallet-related extensions, which would provide cryptographically verifiable proof that a listed publisher genuinely controls the underlying codebase associated with a known, trusted wallet brand. Industry experts are also advocating for much tighter, more rigorous inspections of wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday end users, Socket released a practical checklist designed to improve extension management hygiene. Before installing any cryptocurrency-related browser extension, users are advised to thoroughly review the publisher’s historical track record, verify direct associations with known and reputable projects, carefully inspect review patterns for suspicious bursts of identical or templated feedback, check for legitimate website links backed by public GitHub repositories, and scrutinize the permissions tab for vague or overly sweeping system access.
As this incident clearly demonstrates, a clean interface name and a high star rating are simply no longer enough to guarantee safety in the Web3 era.
The episode raises broader, systemic questions regarding the browser’s expanding role as a financial gateway. Browser-based wallets originally gained widespread popularity due to their accessibility and sheer ease of use, enabling individuals to interact seamlessly with decentralized applications without the friction of switching platforms or downloading standalone desktop applications.
That vital accessibility, however, has come at a steep security cost. The modern web browser remains a fundamentally high-risk environment subject to constant threats, including extension manipulation, session hijacking, clipboard scraping, and now, covert blockchain-based data exfiltration.
Cryptocurrency wallet developers are now expected to seriously rethink their distribution models. Some proactive development teams already actively discourage Chrome Web Store installations, preferring to steer users toward dedicated mobile applications or standalone desktop binaries. Others may soon implement native warnings within their ecosystems whenever users attempt to install software from unverified sources.
The core vulnerability persists: software distribution remains heavily fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a genuinely legitimate wallet from a polished, malicious clone.
The Safery extension proved conclusively that attackers no longer need to successfully impersonate industry giants like MetaMask or Phantom. By forging an independent brand, seeding artificial trust signals, and constructing an invisible backdoor that utilized the Sui blockchain as a courier, the attackers bypassed traditional defenses entirely.
This development forces a fundamental reassessment of how trust is established within cryptocurrency user experiences, and just how close to the metal even casual utility tools like browser extensions really operate. Crypto users frequently operate under the assumption that Web3 technology inherently guarantees sovereignty and self-custody. Yet in the wrong hands, a browser-based wallet ceases to function as a secure vault and instead behaves like an open port—and the browser will not always warn you before something slips right through.
