In the fast-paced ecosystem of decentralized finance, where security is constantly pitted against increasingly sophisticated cyber threats, browser extensions have long been recognized as a high-risk vector. However, a recent incident uncovered by open-source security researchers has highlighted an entirely new level of ingenuity among digital thieves. For a brief period in November, a malicious Chrome extension brazenly titled "Safery: Ethereum Wallet" managed to rank as the fourth organic search result for the term "Ethereum wallet" on the official Chrome Web Store, pulling unsuspecting users into a cleverly constructed trap.
The extension was designed to look entirely legitimate, successfully clearing the low-friction automated barriers of Google’s vetting process. It featured a clean, professional icon, a generic name paired with reassuring security terminology, a flood of five-star reviews, and boilerplate descriptions that would look completely familiar to anyone who has ever downloaded a cryptocurrency wallet. Behind this polished frontend, however, lay a purpose-built attack mechanism engineered to steal user seed phrases and systematically drain cryptocurrency wallets. Rather than relying on traditional methods of data exfiltration, the extension covertly encoded stolen secrets into micro-transactions executed directly on the Sui blockchain.
The operation came to light after security tooling company Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its discovery in the wild. The objective of their investigation was to understand how "Safery" managed to evade automated detection, rapidly climb the Chrome Web Store search rankings, and siphon off sensitive seed phrases without immediately raising alarms among users or platform moderators. Their subsequent report serves as both a detailed postmortem of the attack and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency landscape.
What makes this particular incident especially noteworthy is that the hackers behind Safery did not resort to traditional phishing tactics. They did not spoof an existing, well-known wallet brand, create a MetaMask lookalike, or rely on a recycled phishing domain. Instead, they invented an entirely new identity, utilized botting or purchased fake reviews to rapidly manipulate search rankings, and launched the software as a fresh, standalone wallet option.
This calculated approach meant that the listing showed virtually no immediate red flags. There was no broken English in the descriptions, no odd or excessively broad permissions requested upfront, and no suspicious redirection to shady external domains. The Chrome Web Store publisher page carried no prior user complaints, and its designated support URL led to an off-platform website that had not yet been flagged by security trackers at the time Socket conducted its analysis. Given its polished and professional appearance, the average user would have had little reason to hesitate before clicking the "Add to Chrome" button.
Like many legitimate web3 tools, the extension requested permission to run on "all websites," a standard requirement for crypto wallets that need to interact seamlessly with various decentralized applications. Notably, however, it did not prompt for extra, unusual permissions or attempt to inject complex content scripts that might have triggered Chrome’s more aggressive security warnings. The branding was minimalist, the companion website matched the extension’s name precisely, and the initial setup screen simply prompted users to create or import a wallet—behavior that has become entirely normalized across the web3 space.
The Seed Heist, Broadcast Over Sui
The real damage began the moment an unsuspecting user entered their recovery seed phrase into the interface. Rather than storing the phrase locally or securely encrypting it for user access, the malicious extension silently fragmented the sensitive text and encoded the individual pieces into what appeared to be completely random, innocuous wallet addresses.
According to Socket’s technical research, these encoded fragments were subsequently inserted directly into transactions on the Sui blockchain. Specifically, the extension initiated tiny, minuscule transfers of SUI tokens—amounts so small that they would instantly escape the notice of both the user and automated monitoring tools—directed toward addresses controlled directly by the attacker. Hidden deep within those transactions, either tucked away inside memo fields or cleverly obfuscated within the target addresses themselves, were the vital pieces of the user’s seed phrase.
This tactical approach offered significant advantages for the threat actors. Crucially, it eliminated the need for the extension to send outbound network requests to malicious, external servers. There was no traditional command-and-control beacon, and no data exfiltration over standard HTTP or WebSockets protocols that a modern browser or local antivirus software might flag and block.
Instead, the payload left the user’s device disguised as a completely normal-looking blockchain transaction, expertly routed through a widely used, low-fee layer-1 network. Once safely on-chain, the data was publicly accessible, allowing the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the scam repurposed the Sui blockchain itself to act as a covert communications channel. Because the Sui network boasts remarkably fast confirmation times and negligible transaction costs, it functioned flawlessly as a low-latency message bus for the hackers.
Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts occurred off-chain—primarily on Ethereum and other major layer-1 networks where the victims’ wallets held substantial funds—the instructions required to carry them out were hidden entirely in plain sight.
Evidence suggests that before releasing the version that ultimately climbed to the top of Chrome’s wallet search results, the publisher likely tested the methodology in private. Earlier builds appeared to have experimented with simpler data leaks before the Sui encoding technique was successfully refined. By the time the active extension was finally flagged and reviewed, it had accumulated enough installations to secure a coveted spot in Chrome’s "trending" tier, further amplifying its visibility. Industry reports confirmed that the Safery wallet remained prominently positioned among top results for Ethereum wallet searches even as anxious users began circulating warnings of suspicious behavior across Reddit and Telegram communities.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying mechanics of Chrome’s search ranking logic. The Chrome Web Store search algorithm primarily weighs keyword matching, total installation counts, review velocity, average star ratings, and update recency.
Extensions that experience a sudden burst of activity, particularly within niche categories, can climb search rankings rapidly if better-vetted competitors are not updated with equal frequency. In this instance, Safery benefited from a name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, fresh upload date.
There is no evidence to suggest that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most new extensions to little more than a brief automated scan and fundamental static analysis.
Deeper scrutiny is generally reserved for extensions that request overtly elevated permissions, such as access to sensitive user tabs, the system clipboard, file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating safely within iframes or utilizing officially approved application programming interfaces. Safery strictly adhered to those operational bounds.
Even when concerned users attempted to sound the alarm, the time lag between initial reporting and eventual store takedown stretched out long enough for substantial financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus from security researchers or a match with known malware signatures. In this case, because the payload consisted of obfuscated JavaScript relying entirely on existing blockchain infrastructure rather than external host servers, traditional malware detection mechanisms failed to catch it.
This incident is far from the first time browser extensions have been weaponized to steal cryptocurrency. Past security breaches have involved fake Ledger Live applications prompting users to enter recovery phrases, or the hijacking of legitimate extensions to grant attackers access to a developer’s publishing keys.
What made Safery unique, however, was the seamlessness of its facade and the complete absence of traditional backend infrastructure. There was no phishing website to take down, and no malicious server to block—just a single browser extension quietly moving secrets onto a public blockchain and walking away.
For impacted users, recourse remained severely limited. Those who acted with extreme swiftness could occasionally mitigate their exposure by rotating their seed phrases and revoking outstanding smart contract transaction approvals.
Security firms provided urgent triage steps for anyone who had installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining assets to a completely new wallet utilizing a clean and uncompromised device, and closely monitor associated addresses. For users who failed to notice the silent exfiltration or who stored significant wealth in vulnerable hot wallets, recovery remained virtually impossible.
Security researchers and developers are now renewing calls for stronger heuristics from browser operators like Google. One widely discussed proposal involves automatically flagging and restricting any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another suggested defense mechanism is requiring strict publisher attestation for wallet extensions, providing verifiable cryptographic proof that a given publisher officially controls the codebase behind an established wallet brand. Additional proposals advocate for much tighter inspection of wallet-related permissions, even when those permissions do not explicitly trigger dangerous access patterns.
For end users, security advocates continue to stress the importance of rigorous evaluation before installation. Before adding any cryptocurrency extension to a browser, users are advised to thoroughly review the publisher’s history, verify authentic associations with known and trusted projects, carefully inspect review patterns for artificial bursts of identical text, check for legitimate website links backed by public code repositories, and scrutinize the permissions tab for vague or sweeping access requests.
A clean name and a high star rating are simply no longer enough to guarantee safety. The incident ultimately raises broader, systemic questions regarding the browser’s expanding role in the cryptocurrency ecosystem. Browser-based wallets gained immense popularity primarily due to their accessibility and ease of use, allowing individuals to interact effortlessly with decentralized applications without switching platforms or downloading standalone desktop software.
However, that unmatched accessibility has come at the severe cost of heightened exposure. The modern web browser remains a high-risk environment uniquely vulnerable to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain exfiltration.
As a result, wallet developers are increasingly likely to rethink their primary distribution models. Some teams already actively discourage Chrome Web Store installations entirely, preferring secure mobile applications or standalone desktop binaries. Others may soon implement native warnings for users attempting to install extensions from unverified or obscure sources.
The core challenge remains that software distribution is heavily fragmented, and the average user is ill-equipped to distinguish a polished clone from a legitimate financial tool. The Safery extension proved that attackers no longer need to mimic established industry giants to succeed; they can build their own brands from scratch, manufacture artificial trust signals, and construct invisible backdoors that rely on public blockchains as couriers.
This reality demands a fundamental reassessment of how trust is established within the cryptocurrency user experience, and serves as a sharp reminder that a browser wallet is not a secure vault, but rather an open port into the digital world.
