For several days last November, a malicious browser extension masquerading as a legitimate crypto management tool climbed to the fourth position in the Chrome Web Store search results for the keyword “Ethereum wallet.”
The application, misleadingly named “Safery: Ethereum Wallet,” was crafted with a level of sophistication that easily allowed it to pass as a genuine product to unsuspecting users. It featured a clean, professional icon, a generic name strategically combined with security-adjacent terminology, a rapid influx of five-star reviews, and boilerplate descriptions that closely mirror those found on authentic cryptocurrency wallet listings across the ecosystem.
Beneath this polished exterior, however, the extension was engineered to execute a targeted and malicious attack. Its sole purpose was to capture user seed phrases and systematically drain associated wallets by encoding the stolen credentials into microscopic transactions executed on the Sui blockchain.
The security tooling firm Socket, which specializes in open-source software supply chains, discovered, installed, and thoroughly analyzed the extension shortly after its fraudulent nature came to light. The firm’s primary objective was to investigate how Safery managed to bypass standard security detections, artificially inflate its ranking within the Chrome Web Store, and exfiltrate sensitive recovery phrases without raising immediate alarms, while also outlining defensive measures for users. The resulting security report serves as both a detailed postmortem of the incident and a stark warning that browser extensions continue to represent a significant and dangerous blind spot within cryptocurrency security architecture.
What makes this particular incident especially noteworthy is the attacker’s methodology. Historically, malicious actors in the crypto space frequently rely on spoofing established brands, creating lookalike MetaMask interfaces, or deploying recycled phishing domains to deceive users. Safery, by contrast, chose to forge an entirely new identity. It manufactured a brand from scratch, utilized purchased or automated bot-generated reviews to artificially climb search engine rankings within the store, and presented itself as a novel, independent wallet option.
This calculated approach meant that the extension’s store listing was completely devoid of the traditional red flags that security-conscious users typically look out for. There was no broken grammar in the descriptions, no suspicious or overreaching permissions requested upfront, and no redirection to sketchy, untrusted external domains. Furthermore, the Chrome Web Store publisher page had no history of prior complaints or violations, while its designated support URL directed traffic to an off-platform website that had not yet been flagged by automated security intelligence trackers at the time of Socket’s analysis.
Given its professional appearance and high search ranking, the vast majority of users would have experienced little hesitation before clicking the “Add to Chrome” button. Like many standard crypto tools, the extension requested permission to run across all websites—a functional necessity for extensions designed to interact seamlessly with decentralized applications. Crucially, it refrained from prompting for unusual or elevated permissions and avoided injecting complex content scripts that might have tripped Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the accompanying website mirrored the extension’s stated name, and the initial setup interface cleanly guided users through the standard process of creating a brand-new wallet or importing an existing one, mimicking authentic software behavior down to the last detail.
The Seed Heist, Broadcast Over Sui
The malicious mechanics of the application were triggered the moment a user entered their recovery seed phrase. Instead of storing the sensitive information locally within the browser or properly encrypting it for authorized user access, the extension silently dissected the phrase into smaller fragments. It then systematically encoded these fragments to resemble random, innocuous wallet addresses.
Socket’s technical investigation revealed that these data fragments were injected directly into Sui blockchain transactions. Specifically, the extension initiated minuscule transfers of SUI tokens—negligible financial amounts deliberately chosen to draw zero attention—to a series of addresses directly controlled by the attacker. Embedded within these micro-transactions, either hidden discreetly inside memo fields or cleverly obfuscated within the transaction parameters, were the distinct pieces of the victim’s seed phrase.
This exfiltration strategy offered tactical advantages to the cybercriminals. By utilizing blockchain transactions as a delivery mechanism, the extension eliminated the need to send traditional outbound requests to malicious external servers. There was no command-and-control beacon communicating over HTTP or WebSockets, which meant there was no network traffic for browser monitors or antivirus software to flag as anomalous.
Instead, the stolen payload departed the user’s device disguised as a completely normal blockchain transaction, routed smoothly through a widely utilized, low-fee decentralized network. Once safely recorded on-chain, the data became publicly accessible, enabling the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep funds from the victim’s wallets without ever needing to interact with the compromised device a second time.
In practice, the scammers effectively turned the Sui blockchain into a covert communications channel. Because the Sui network offers exceptionally fast confirmation times and near-zero transaction costs, it functioned with the efficiency of a low-latency message bus. Socket successfully traced multiple instances of these fragmented seed transactions, definitively establishing the causal link between the entry of recovery phrases within the extension and the subsequent loss of digital assets. While the asset thefts ultimately occurred off-chain—predominantly on Ethereum or other Layer 1 networks where the victims actually held their funds—the operational instructions required to execute the thefts were hidden in plain sight on an entirely separate blockchain.
Before deploying the version that ultimately secured a spot in Chrome’s top search results, the publisher almost certainly tested the underlying architecture in private environments. Digital evidence uncovered during the analysis indicates that earlier, unreleased builds experimented with simpler data-leaking techniques before the Sui encoding mechanism was fully perfected. By the time the active extension was finally identified and flagged by security researchers, it had accumulated enough installations to qualify for Chrome’s “trending” tier, which further amplified its visibility. Industry reports confirmed that the Safery wallet maintained its prominent placement among the top results for Ethereum wallet searches even as initial warnings began circulating publicly across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension depended heavily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm evaluates multiple factors simultaneously, including keyword matching, total installation counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden burst of user activity, particularly within niche categories, can ascend rapidly in visibility if established, well-vetted competitors fail to update their listings frequently. In this instance, Safery benefited from an optimized title that performed exceptionally well for common user queries, a coordinated blitz of positive ratings—many of which utilized repetitive or templated language—and a very recent upload date.
There is no evidence to suggest that Google manually reviewed the listing prior to its publication. Standard Chrome Web Store protocols subject newly submitted extensions to a brief automated scan alongside fundamental static code analysis. Deeper scrutiny is typically reserved for extensions that explicitly request elevated permissions, such as access to browser tabs, local clipboards, file systems, or browsing history. Because crypto wallet extensions frequently bypass these specific warning flags by operating within isolated iframes or utilizing standard, pre-approved APIs, Safery managed to stay entirely within permissible technical bounds.
Even after concerned users began raising alarms, the operational lag between the initial reporting and the eventual removal of the extension stretched on long enough for significant financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not automatically disable flagged extensions instantly unless there is an overwhelming consensus of reports or a positive match against known malware signatures. In this scenario, the payload consisted of obfuscated JavaScript that relied entirely on legitimate blockchain infrastructure rather than external hosting servers, allowing it to evade traditional signature-based malware detection systems.
While malicious actors have frequently targeted browser extensions to steal cryptocurrency in the past—ranging from fake Ledger Live desktop application wrappers that prompted users for recovery phrases to hijacked legitimate extensions where attackers compromised developer publishing keys—Safery stood apart. Its distinction lay in the sheer fluidity of its user-facing facade and the complete absence of traditional backend infrastructure. There was no phishing website to take offline and no malicious command-and-control server to block; there was merely a single browser extension quietly depositing sensitive secrets onto a public blockchain and disappearing.
Victims of the exploit had limited avenues for recourse. Those who acted rapidly could mitigate their overall exposure by immediately rotating their seed phrases and revoking outstanding smart contract transaction approvals. Security firms including Socket published urgent triage steps for anyone who had installed the software: uninstall the extension immediately, revoke all active token approvals, transfer remaining assets to a fresh, secure wallet generated on a completely clean device, and closely monitor the compromised addresses. For users who failed to notice the silent exfiltration in time, or those who maintained substantial capital balances within hot wallets, asset recovery remained highly improbable.
Cybersecurity professionals and independent developers are now urging Google to implement stricter heuristic evaluations within the Chrome ecosystem. Among the proposed solutions is the automated flagging of any extension that incorporates user interface elements prompting for standard 12- or 24-word recovery phrases. Additional recommendations include mandatory publisher identity attestations for wallet-related software, ensuring verifiable cryptographic proof that a given developer actually controls the legitimate codebase behind an established brand name. Calls have also intensified for more rigorous inspections of wallet permissions, even when those permissions do not explicitly trigger traditional high-risk access warnings.
For everyday users, security analysts continue to emphasize the importance of rigorous due diligence. Before installing any browser-based cryptocurrency tool, users are advised to thoroughly research the publisher’s history, verify direct associations with recognized projects, scrutinize review patterns for unnatural bursts of identical feedback, cross-reference official website links with public code repositories like GitHub, and carefully examine the permissions tab for vague or overly broad access requests. Ultimately, a clean visual presentation and a high rating score are no longer sufficient guarantees of safety.
This incident has reignited broader discussions regarding the inherent security trade-offs of relying on web browsers for asset management. Browser-based wallets achieved widespread adoption largely due to their accessibility and convenience, allowing users to interact seamlessly with decentralized applications without the friction of switching platforms or installing standalone desktop software. However, that accessibility has come at the direct expense of heightened exposure. The modern web browser operates as a high-risk environment vulnerable to extension manipulation, session hijacking, clipboard scraping, and now, covert blockchain-based data exfiltration.
As a result, wallet developers are expected to re-evaluate their primary distribution models. While some teams already discourage installation via the Chrome Web Store in favor of dedicated mobile applications or standalone desktop binaries, others are exploring native warnings for users attempting to source software from unverified channels. The core vulnerability persists: software distribution remains fragmented, and the average user lacks the technical expertise required to distinguish a meticulously engineered clone from a genuine financial tool.
The Safery extension demonstrated that malicious actors no longer need to spoof prominent brands like MetaMask or Phantom to succeed. By manufacturing an entirely fictitious identity, seeding artificial trust signals, and weaponizing a public blockchain as an invisible courier network, the creators bypassed traditional security perimeters. This development underscores the urgent need to fundamentally rethink how trust is established within the cryptocurrency user experience, and highlights the sobering reality that a browser extension can function less like a secure digital vault and more like an open door.
