For several days last November, a sophisticated malicious Chrome extension managed to capture the fourth position in search results for the term "Ethereum wallet" on the official Chrome Web Store. Disguised under the name "Safery: Ethereum Wallet," the application was engineered with enough visual polish and functional mimicry to easily pass as a legitimate tool to unsuspecting cryptocurrency users navigating the browser’s extension marketplace.
The application featured a clean and professional icon, a generic title that intentionally incorporated security-adjacent language, an influx of five-star ratings, and boilerplate descriptions that closely mirror the onboarding text familiar to anyone who has ever downloaded a decentralized crypto wallet. However, lurking behind this polished frontend was a purpose-built attack mechanism designed to systematically capture seed phrases and empty user wallets by cleverly encoding stolen secrets into micro-transactions executed on the Sui blockchain.
The threat was brought to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its discovery. The primary objective of Socket’s investigation was to understand how "Safery" successfully evaded automated detection systems, climbed rapidly through the Chrome Store rankings, and exfiltrated sensitive seed phrases without triggering immediate security alarms. Furthermore, the analysis aimed to identify actionable steps users could take to spot and mitigate similar emerging threats. The resulting security report serves as both a detailed postmortem of the incident and a stark warning that browser extensions continue to represent a dangerous and vulnerable blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident notably distinct within the history of crypto exploits is that the malicious actors behind it did not bother to spoof an existing, high-profile wallet brand. Unlike previous attacks that relied on creating MetaMask lookalikes or recycling known phishing domains, Safery invented an entirely new identity from scratch. The perpetrators purchased or utilized automated bot accounts to generate fake reviews, artificially inflating the extension’s search rankings and establishing a veneer of credibility as a "new" and innovative wallet option.
Because the developers chose to build a completely unique brand rather than impersonating an established entity, the listing exhibited virtually no immediate red flags. There was no broken grammar in the descriptions, no obviously malicious or unusual permissions requested, and no immediate redirection to shady external domains. The Chrome Web Store publisher page was entirely clean of prior complaints, and its designated support URL directed users to an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s investigation.
Given its professional appearance and absence of typical warning signs, the average user would have felt little hesitation before clicking the "Add to Chrome" button. Upon installation, the extension requested permission to run on "all websites"—a standard and necessary request for crypto wallet extensions that must interact seamlessly with various decentralized applications across the web. Notably, it did not prompt users for extra, high-risk permissions or attempt to inject content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the supporting website aligned perfectly with the extension’s name, and the initial setup screen guided users through standard wallet creation or importation workflows that looked indistinguishable from legitimate software.
The Seed Heist, Broadcast Over Sui
The true damage of the exploit was initiated the moment a user inputted their seed phrase into the extension interface. Rather than storing the phrase locally on the device or attempting to encrypt it for legitimate user access, the extension silently fragmented the recovery phrase into smaller pieces. It then cleverly encoded these fragments so that they resembled random, innocuous wallet addresses.
According to Socket’s research, these data fragments were systematically embedded directly into Sui blockchain transactions. Specifically, the extension executed tiny, minuscule transfers of SUI tokens—amounts so small that they would entirely evade suspicion—to various addresses directly controlled by the attacker. Hidden deep inside the metadata of those transactions, either within designated memo fields or obfuscated wallet addresses, were the specific pieces of the victim’s seed phrase.
This tactical approach provided the attackers with significant operational advantages. Because the exfiltration relied on standard blockchain interactions, the extension was not required to send outbound network requests to overtly malicious command-and-control servers. There were no suspicious HTTP beacons or WebSocket connections that a modern web browser or traditional antivirus software might flag and block.
Instead, the payload left the user’s device disguised as a completely normal-looking blockchain transaction, which was then seamlessly routed through a widely used, low-fee blockchain network. Once successfully recorded on-chain, the fragmented data became publicly accessible, enabling the attacker to quietly retrieve it at their leisure, reconstruct the complete seed phrase, and drain associated assets from the victim’s wallets without ever needing to touch the user’s device a second time.
In effect, the scam repurposed the Sui blockchain itself as an alternative communications channel. Because the Sui network offers rapid transaction confirmation times and negligible fees, it functioned remarkably well as a low-latency message bus for the bad actors. Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct causal link between seed entry and the subsequent loss of funds. While the actual thefts of assets occurred off-chain—primarily on Ethereum or other Layer 1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the final, polished version that ultimately landed in Chrome’s prominent wallet search results, the publisher likely tested the methodology in private environments. Evidence uncovered by researchers suggests that earlier, simpler builds experimented with rudimentary data leaks before the Sui encoding technique was thoroughly refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to secure a spot in Chrome’s "trending" tier, which further amplified its visibility to potential victims. Reports from industry outlets confirmed that the Safery wallet remained prominently positioned among top results for Ethereum wallet queries even as initial warnings began circulating across platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged primarily on the underlying mechanics of Chrome’s search and ranking logic. The Web Store algorithm evaluates listings based on a combination of keyword relevance, total installation counts, review velocity, average user ratings, and the recency of updates.
Extensions that experience a sudden burst of activity and user acquisition, particularly within specialized or niche categories, can climb search rankings rapidly if their more thoroughly vetted competitors are not updated with equivalent frequency. In this scenario, Safery benefited from an optimal name for common search queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a very fresh upload date.
There is currently no evidence indicating that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief automated scan and fundamental static analysis. Deeper scrutiny is typically reserved for extensions that request heavily elevated permissions, such as direct access to browser tabs, the system clipboard, local file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating safely within iframes or utilizing standard, pre-approved APIs, and Safery carefully stayed well within those structural bounds.
Even when vigilant users raised concerns and submitted reports, the lag time between the initial reporting and the eventual takedown by store administrators stretched on long enough for significant financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not automatically disable or remove flagged extensions instantly unless there is an overwhelming consensus of reports or definitive, known malware signatures detected. Because the payload in this case consisted of obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than external malicious hosts, traditional antivirus and automated malware detection methods failed to catch it.
This incident is far from the first time browser extensions have been weaponized to target cryptocurrency assets. Previous high-profile scams have included fraudulent Ledger Live applications prompting users to input sensitive recovery phrases, as well as incidents where legitimate, trusted extensions were hijacked to allow attackers access to the original developer’s publishing keys.
What distinguished the Safery campaign, however, was the exceptional smoothness of its facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website to take down, and no rogue server IP address to block—just a single browser extension quietly moving user secrets onto a public blockchain network and walking away.
Impacted users retained limited options for recourse. By acting with extreme urgency, victims could mitigate further exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized protocols. Socket and other security entities published clear triage steps for anyone who had installed the extension: uninstall the application immediately, revoke existing token approvals, safely sweep remaining digital assets to a brand-new wallet using an entirely clean device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration or who maintained large capital balances within vulnerable hot wallets, recovery remained highly unlikely.
Security researchers and developers are now renewing calls for stronger heuristics directly from browser operators like Google. One widely discussed proposal involves automatically flagging and quarantining any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another suggested defense mechanism is the implementation of mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the codebase behind a recognized wallet brand. Industry voices are also advocating for much tighter scrutiny of permissions requested by financial extensions, regardless of whether those requests involve traditional dangerous access patterns.
For everyday end users, security firms continue to stress the importance of rigorous due diligence. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s history, verify direct associations with recognized projects, inspect review patterns for anomalies like bursts of identical text, confirm the existence of real official websites backed by public repositories, and carefully evaluate permission tabs for sweeping access. Ultimately, security analysts emphasize that a clean name and a high star rating are simply no longer enough to guarantee safety in the Web3 space.
