For a few critical days in November, a malicious software extension masquerading as a legitimate crypto utility managed to secure the fourth organic search result for the phrase “Ethereum wallet” on the official Chrome Web Store.
The extension, deceptively titled “Safery: Ethereum Wallet,” was crafted with enough visual polish and user-interface sophistication to easily pass as a genuine product to unsuspecting cryptocurrency enthusiasts. It featured a clean, modern icon, a generic yet comforting name adjacent to security terminology, a sudden influx of five-star user reviews, and boilerplate descriptions that are thoroughly familiar to anyone who has ever downloaded a digital asset management tool.
However, behind that polished frontend lay a purpose-built cyberattack mechanism. The extension was engineered to steal sensitive seed phrases and completely empty user wallets by silently encoding stolen credentials into micro-transactions executed on the Sui blockchain.
The security tooling company Socket, which focuses heavily on open-source software supply chains, installed and closely analyzed the extension immediately after its malicious nature was discovered. Their primary objective was to understand how “Safery” successfully evaded automated security detection, climbed rapidly through the Chrome Store search rankings, and exfiltrated sensitive seed phrases without triggering browser-level alarms, while also determining what users could do to identify and mitigate similar threats. The resulting security report walks through the attacker’s technical approach, serving simultaneously as a postmortem investigation and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the hackers behind the operation did not simply resort to spoofing an established wallet brand. That specific tactic—such as creating MetaMask lookalikes or deploying recycled phishing domains—is, unfortunately, well-trodden territory in the history of crypto scams. Instead, Safery took a more insidious path: it invented an entirely new identity from scratch, purchased or deployed automated bot networks to generate fake reviews that artificially inflated its search rankings, and launched itself into the marketplace as a completely "new" independent wallet option.
This calculated approach meant that the listing showed virtually no immediate red flags to casual observers. There was no broken English or awkward grammar in the description, no obviously dangerous or unusual permissions requested during installation, and no suspicious redirection to shady external web domains. Furthermore, the Chrome Web Store publisher page had no prior complaints or history of infractions, and its designated support URL led to an off-platform website that had not yet been flagged by external security trackers at the time of Socket’s technical analysis.
Given its highly polished appearance and professional presentation, the average user would likely not have hesitated for even a moment before clicking the “Add to Chrome” button. Like many legitimate crypto tools, the extension requested permission to run on “all websites,” which is a standard operational requirement for browser wallets that must interact seamlessly with various decentralized applications across the web. Notably, it did not prompt users for extra, high-risk permissions or attempt to inject malicious content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the companion website matched the exact name of the extension, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one—behavior that is entirely standard across the industry.
The Seed Heist, Broadcast Over Sui
The real and irreversible damage began the moment a user entered their recovery seed phrase. Instead of storing the phrase locally within encrypted browser storage or handling it for legitimate user recovery purposes, the extension silently fragmented the sensitive string of words and systematically encoded them into what appeared to be completely random, innocuous wallet addresses.
Socket’s forensic research indicates that these extracted seed fragments were subsequently inserted directly into Sui blockchain transactions. Specifically, the malicious extension executed tiny, minuscule transfers of SUI tokens—amounts so infinitesimally small that they would never draw attention from automated monitors or users—to destination addresses directly controlled by the attacker. Hidden deep inside those routine-looking blockchain transactions, either tucked away within memo fields or obfuscated directly inside the recipient addresses, were the broken-down pieces of the victim’s master seed phrase.
This clever approach provided the attackers with significant tactical advantages. Crucially, it meant the extension did not need to send outbound network requests to malicious, centralized command-and-control servers. There was no telltale beacon or data exfiltration over standard HTTP protocols or WebSockets that a modern web browser, firewall, or endpoint antivirus program might easily flag and intercept.
Instead, the stolen payload left the user’s device disguised as an entirely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee layer-1 network. Once the data successfully landed on-chain, it was publicly accessible, allowing the perpetrator to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s compromised device a second time.
In effect, the scam repurposed the Sui blockchain itself as an alternative communications channel. Because the Sui network boasts exceptionally fast confirmation times and negligible transaction costs, it functioned flawlessly as a low-latency message bus for the thieves. Socket successfully traced multiple concrete examples of these seed-fragment transactions and definitively confirmed the direct causal link between the entry of a seed phrase into the extension and the eventual loss of digital assets. While the actual financial thefts occurred off-chain—predominantly on Ethereum or other layer-1 networks where the victims’ wallets held substantial funds—the operational instructions required to carry them out were hidden safely in plain sight on an entirely separate ledger.
Before releasing the final version that ultimately landed in Chrome’s prominent wallet search results, the publisher likely tested this novel exfiltration method in private environments. Technical evidence uncovered during the investigation suggests that earlier, preliminary builds experimented with simpler data leaks before the Sui encoding scheme was fully refined. By the time the active, polished extension was finally flagged and reported by vigilant community members, it had accumulated enough installs to comfortably reach Chrome’s coveted “trending” tier, which served to further boost its visibility and attract more victims. Security reports confirmed that the Safery wallet remained perched prominently among the top results for Ethereum wallet searches even as frantic warnings and reports of suspicious asset drainage began circulating widely on platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged directly on the mechanical logic of Chrome’s internal search ranking algorithm. The Web Store search engine heavily weighs factors such as precise keyword matching, total install counts, review velocity, average star ratings, and the recency of software updates.
Extensions that experience a sudden, sharp burst of user activity and engagement—particularly within specialized or niche categories like cryptocurrency—can climb through the rankings with alarming speed if more thoroughly vetted, long-standing competitors are not updated with equal frequency. In this specific case, Safery benefited from a name that scored exceptionally well for common user search queries, a coordinated blitz of positive reviews (many of which were templated or clearly duplicated), and a remarkably fresh upload date.
There is currently no public evidence indicating that Google’s trust and safety team manually reviewed this specific listing prior to its automated publication. Standard Chrome Web Store policy subjects most new software extensions to a brief automated scan and fundamental static analysis. Extensions typically undergo much deeper manual scrutiny only when they explicitly request elevated, high-risk permissions, such as direct access to browser tabs, the user’s clipboard, local file systems, or browsing history.
Because crypto wallet extensions frequently manage to bypass these specific warning flags by operating securely within localized iframes or utilizing officially approved developer APIs, Safery was able to stay comfortably within permitted bounds. Even after concerned users began raising alarms and submitting formal reports, the operational lag between initial reporting and final takedown stretched out over a timeframe long enough for significant financial damage to occur.
Part of that frustrating delay is structural: the Chrome Web Store platform does not automatically act on flagged extensions instantly unless there is an overwhelming consensus of abuse or an exact match with previously identified malware signatures. In this instance, because the malicious payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external, blockable host servers, traditional automated malware detection methods failed to catch it in time.
This unfortunate event is not the first time browser extensions have been weaponized to target cryptocurrency holdings. Previous high-profile scams have involved fraudulent Ledger Live web applications that tricked users into typing their master recovery phrases directly into browser windows, or incidents where attackers hijacked legitimate, established extensions by compromising the original developer’s publishing keys.
What fundamentally sets the Safery incident apart, however, is the sheer smoothness of its front-end facade and the complete absence of traditional backend infrastructure. There was no typical phishing website to take down, no rogue command server to block, and no suspicious web host to report—just a single browser extension quietly translating private secrets into public blockchain transactions and walking away scot-free.
For victims who fell prey to the scheme, recourse was extremely limited and time-sensitive. Cybersecurity firms like Socket quickly published emergency triage steps for anyone who had mistakenly installed the software: uninstall the extension immediately, revoke all active token approvals associated with the wallet, sweep any remaining digital assets to an entirely new wallet using a completely clean device, and closely monitor all compromised addresses. For users who failed to notice the silent exfiltration in time or who stored large volumes of capital in hot wallets connected to the browser, recovery remained virtually impossible.
As the fallout from the incident continues to ripple through the developer and security communities, experts are forcefully calling for much stronger heuristic checks directly from Google. One prominent proposal involves automatically flagging and blocking any browser extension that includes user interface elements prompting for standard 12- or 24-word recovery phrases. Another widely discussed solution is to require mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase of a recognized wallet brand. Additional recommendations include tightening the inspection protocols for wallet permissions, ensuring that even standard requests are subjected to rigorous scrutiny.
For end users navigating the complex Web3 landscape, security analysts emphasize that a clean product name, a professional interface, and a high star rating are simply no longer sufficient guarantees of safety. The incident serves as a sharp reminder that while browser-based wallets gained widespread popularity due to their accessibility and convenience, that accessibility has come at the steep price of heightened exposure. The modern web browser remains a high-risk operational environment subject to extension manipulation, session hijacking, clipboard scrapers, and now covert blockchain exfiltration, forcing both developers and users to fundamentally reevaluate how trust is established in decentralized finance.
