For a few days in November, a malicious Chrome extension managed to secure the fourth position for the search query “Ethereum wallet” on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was polished enough to easily pass as a legitimate tool for cryptocurrency users. Featuring a clean, professional icon, a generic name paired with security-related terminology, a sudden flood of five-star reviews, and standard boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a crypto wallet, the application looked entirely benign on the surface.
Beneath that polished frontend, however, lay a purpose-built cyberattack designed explicitly to harvest seed phrases and empty user wallets. The extension achieved this by cleverly encoding stolen confidential data into micro-transactions executed on the Sui blockchain. Security tooling company Socket, which focuses heavily on open-source software supply chains, installed and closely analyzed the extension immediately after its malicious nature was uncovered.
Their objective was to understand how "Safery" managed to evade automated detection, steadily climb the Chrome Store search rankings, and exfiltrate sensitive seed phrases without raising immediate alarms, as well as to determine what practical steps users could take to spot similar threats. The resulting security report walks through the attacker’s sophisticated approach, serving simultaneously as a postmortem analysis and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
This particular case is especially noteworthy because the malicious actors did not rely on the conventional tactic of spoofing an existing, established wallet brand. Unfortunately, brand impersonation has long been well-trodden territory in the crypto threat landscape. What sets Safery apart is that it did not attempt to mimic MetaMask, nor did it operate through a recycled phishing domain. Instead, it successfully invented an entirely new identity, utilized purchased or automated bot reviews to artificially boost its search ranking, and launched itself as a seemingly fresh, innovative wallet option.
This strategic approach ensured that the store listing displayed virtually no immediate red flags. There was no broken grammar, no suspicious or overreaching permissions requested upfront, and no redirection to shady, unverified external domains. Furthermore, the Chrome Web Store publisher page carried no prior complaints from users, and its provided support URL led to an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s analysis.
Given its highly polished appearance and professional presentation, the average user would likely not have hesitated for a single moment before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for crypto wallets that need to interact seamlessly with various decentralized applications across the web.
Crucially, it did not prompt users for extra, unnecessary permissions, nor did it attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive security warnings. The branding throughout the extension was minimalist, the accompanying website perfectly matched the extension’s name, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—again, behavior that is entirely standard for legitimate software.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their confidential seed phrase into the extension. Instead of storing the phrase locally on the device or properly encrypting it for user access, the extension silently fractured the phrase into multiple smaller fragments. It then encoded these fragments to look precisely like random, ordinary wallet addresses.
Socket’s comprehensive research indicates that these precise fragments were quietly inserted into live Sui blockchain transactions. Specifically, the extension executed tiny, minuscule SUI token transfers—amounts so negligible that they would never draw attention or suspicion—to various addresses controlled directly by the attacker. Hidden cleverly inside those transactions, either embedded within memo fields or obfuscated directly within the transaction addresses, were the critical pieces of the user’s seed phrase.
This calculated approach provided substantial tactical advantages for the hackers. It completely eliminated the need for the extension to send outbound network requests to malicious command-and-control servers. There was no suspicious beaconing or data exfiltration over standard HTTP protocols or WebSockets that a traditional web browser or local antivirus software might flag and block.
Instead, the malicious payload left the user’s local device disguised as a completely normal-looking, legitimate blockchain transaction, neatly routed through a widely used, low-fee blockchain network. Once successfully recorded on-chain, the data was publicly accessible, permitting the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep the victims’ funds without ever needing to interact with the user’s device a second time.
In effect, the scam creatively weaponized the Sui blockchain itself to serve as an encrypted communications channel. Because the Sui network boasts exceptionally fast transaction confirmation times and virtually negligible transaction costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple distinct examples of these seed-fragment transactions and definitively confirmed the direct link between seed entry and the subsequent loss of assets. While the actual thefts occurred off-chain—primarily on Ethereum or other Layer-1 networks where the victims’ wallets conveniently held valuable funds—the explicit instructions required to carry them out were hidden safely in plain sight on an entirely different chain.
Before releasing the final version that ultimately landed in Chrome’s prominent top wallet results, the publisher likely tested this novel method in a private environment. Digital evidence indicates that earlier, preliminary builds experimented with much simpler data leaks before the Sui encoding technique was fully refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated a sufficient number of installations to break into Chrome’s coveted "trending" tier, which only served to further boost its visibility and attract more victims. Industry reports confirmed that the Safery wallet comfortably sat among the top search results for "Ethereum wallet" even as growing reports of suspicious behavior and asset theft began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm continuously weighs multiple factors, including keyword matches, total install counts, review velocity, average user ratings, and the recency of software updates.
Extensions that experience a sudden, sharp burst of activity—especially within specialized or niche categories—can climb the rankings rapidly if their more rigorously vetted competitors are not updated with equal frequency. In this particular instance, Safery benefited from a name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews (many of which were clearly templated or duplicated), and a very fresh upload date.
There is currently no evidence indicating that Google manually reviewed this specific listing prior to its publication. Standard Chrome Web Store policies dictate that most new extensions undergo only a brief automated scan alongside fundamental static analysis.
Extensions typically undergo much deeper scrutiny only when they explicitly request elevated permissions, such as broad access to browser tabs, the system clipboard, local file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter flags by carefully operating within isolated iframes or utilizing standard, pre-approved browser APIs. Safery carefully stayed well within those permitted bounds.
Even when vigilant users raised early concerns and submitted reports, the structural time lag between initial reporting and eventual takedown stretched on long enough for significant financial damage to occur. Part of that lag is entirely structural by design: the Chrome ecosystem does not automatically act on flagged extensions instantly unless there is an overwhelming consensus of reports or the presence of known, signature-based malware.
In this scenario, the payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than traditional external web hosts. Consequently, conventional malware detection methodologies failed to catch it in time.
This unfortunate incident is far from the first time that browser extensions have been maliciously exploited to steal cryptocurrency from unsuspecting users. Previous high-profile scams have included fake Ledger Live companion apps that prompted users to enter their master recovery phrases, or the compromise of legitimate, long-standing extensions that allowed attackers to hijack the original developer’s publishing keys.
What distinctly differentiated Safery from these past incidents was the remarkable smoothness of its frontend facade and the absolute absence of traditional backend infrastructure. There was no malicious phishing website to take down, and no centralized server infrastructure to block; there was simply a single browser extension quietly moving classified secrets onto a public blockchain and walking away cleanly.
Affected users still had limited recourse if they acted with extreme urgency. By moving quickly, they could minimize their exposure by rotating their seed phrases and immediately revoking active smart contract transaction approvals.
Security firms like Socket quickly published practical triage steps for anyone who realized they had installed the extension: uninstall the software immediately, revoke all outstanding token approvals, safely sweep remaining digital assets to a brand-new wallet using a completely clean device, and closely monitor all associated addresses. For those users who failed to notice the silent exfiltration in time, or who unfortunately stored substantial amounts of capital in vulnerable hot wallets, asset recovery remained highly unlikely.
The Real Trouble Begins Before the Wallet Ever Loads
In the wake of this security breach, independent researchers, software developers, and cybersecurity firms are strongly advocating for the implementation of much stronger heuristics directly within the Chrome Web Store infrastructure. One prominent solution being proposed is the automated flagging and immediate review of any browser extension that includes user interface elements explicitly prompting for a standard 12-word or 24-word recovery phrase.
Another recommended approach involves requiring mandatory publisher attestation for all applications categorized under crypto wallets. This would provide verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase associated with a recognized, legitimate wallet brand. Furthermore, there are growing calls for much tighter, more rigorous inspections of wallet-related permissions, even in instances where those permissions do not explicitly invoke traditional dangerous access patterns.
For end users navigating the complex Web3 landscape, security advocates continue to emphasize the importance of thorough due diligence. Before installing any cryptocurrency extension, users are advised to carefully review the publisher’s historical track record, verify a genuine association with a well-known development project, inspect review patterns for suspicious bursts of identical or templated feedback, check for real website links backed by public code repositories on platforms like GitHub, and meticulously scan the permissions tab for vague or overly sweeping system access.
A clean name and a high star rating are simply no longer sufficient guarantees of safety. This recurring security failure raises much broader, systemic questions regarding the browser’s expanding role within the cryptocurrency ecosystem as a whole. Browser-based wallets originally gained widespread popularity primarily due to their accessibility and sheer ease of use, allowing everyday users to interact seamlessly with decentralized applications without being forced to switch platforms or download separate desktop applications.
However, that unprecedented accessibility has come at a severe cost regarding user security and exposure. The modern web browser remains a fundamentally high-risk environment that is continually subject to extension manipulation, session hijacking, invisible clipboard scrapers, and now, covert blockchain-based data exfiltration.
As these threats evolve, wallet developers will likely be forced to fundamentally rethink their software distribution models. Some forward-thinking development teams already actively discourage Chrome Web Store installations altogether, preferring instead to direct their users toward dedicated mobile applications or standalone desktop binaries. Other projects may soon introduce built-in safety warnings for users attempting to install wallet software from unverified sources.
The core underlying problem persists: software distribution remains heavily fragmented, and the vast majority of everyday users simply do not possess the technical expertise required to reliably distinguish a legitimate, secure wallet from a professionally polished clone.
The Safery extension proved conclusively that malicious actors no longer need to successfully imitate established giants like MetaMask or Phantom to steal funds. By simply inventing an entirely novel brand, seeding artificial trust signals, and constructing an invisible backdoor that utilized an alternative blockchain as an operational courier, the attackers successfully bypassed traditional security mentalities.
This incident should force a comprehensive industry-wide reassessment of how trust is established within cryptocurrency user experience design, and how dangerously close to the underlying metal even casual tools like browser extensions really operate. Crypto users frequently operate under the comforting assumption that Web3 technology inherently guarantees digital sovereignty and absolute self-custody. Yet, in the wrong hands and within an unvetted environment, a browser wallet ceases to function as a secure vault and instead behaves like an open port—and the browser will not always warn you before something dangerous slips right through.
