For a few critical days in November, a malicious Chrome extension managed to climb the rankings on the Chrome Web Store, briefly securing the fourth spot for the search query “Ethereum wallet.” The extension, marketed under the deceptive title “Safery: Ethereum Wallet,” was meticulously designed to present a polished, professional facade that easily fooled unsuspecting cryptocurrency users. Featuring a clean, modern icon, a generic security-adjacent name, a heavy influx of five-star reviews, and boilerplate descriptions identical to those found on legitimate crypto tools, the application looked entirely legitimate upon first glance.
However, behind this polished user interface lay a sophisticated, purpose-built cyberattack. The extension was engineered to intercept seed phrases and systematically drain user wallets by encoding stolen sensitive information directly into micro-transactions executed on the Sui blockchain. The scheme came to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and conducted a deep-dive analysis of the extension following its initial discovery in the wild.
The security researchers aimed to uncover how “Safery” successfully evaded automated detection mechanisms, rapidly manipulated the Chrome Store search rankings, and exfiltrated sensitive seed phrases without triggering immediate security alarms. Furthermore, the investigation sought to provide actionable insights into how users can spot similar threats in the future. The resulting report serves as both a postmortem on a deeply concerning security lapse and a stark warning that browser-based extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the malicious actors behind Safery did not rely on the common tactic of spoofing an existing, trusted wallet brand. It was not a MetaMask lookalike or a recycled phishing domain designed to catch typos. Instead, the creators invented an entirely new identity, artificially boosted their search visibility by purchasing or botting fake reviews, and launched the software as a fresh, alternative wallet option on the market.
Because of this original-identity approach, the listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious or overly broad permissions requested upfront, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page carried no prior user complaints or warning flags, and its designated support URL directed traffic to an off-platform website that security trackers had not yet flagged at the time of Socket’s analysis.
Given its professional appearance and seamless presentation, the average user would have felt little hesitation before clicking the “Add to Chrome” button. Like many standard decentralized finance tools, the extension requested permission to run on “all websites,” a necessary function for crypto wallets that need to interact dynamically with various decentralized applications. Crucially, it refrained from prompting for extra, highly unusual permissions or attempting to inject complex content scripts that typically trigger Chrome’s more aggressive security warnings. The branding was minimalist, the accompanying website mirrored the extension’s name precisely, and the initial setup screen guided users through the standard process of either creating a brand-new wallet or importing an existing one.
The Seed Heist, Broadcasted Over the Sui Blockchain
The actual devastation began the moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or encrypting it securely for user access, the extension executed a silent, malicious routine. It fragmented the seed phrase into smaller pieces and cleverly encoded those fragments into what appeared to be entirely random, innocuous wallet addresses.
Socket’s research revealed that these hidden fragments were subsequently inserted directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—such negligible financial amounts that they would never draw scrutiny—sending them straight to blockchain addresses controlled directly by the attackers. Embedded secretly within those routine-looking transactions, hidden away either inside memo fields or obfuscated recipient addresses, were the broken-down pieces of the victim’s seed phrase.
This tactical approach offered significant advantages to the hackers. Because the data was smuggled out via legitimate network traffic, the extension did not need to send outbound HTTP requests or establish WebSockets connection beacons to external, malicious command-and-control servers. As a result, there was no suspicious network activity that a traditional browser monitor or local antivirus program could easily flag.
The payload successfully left the user’s device disguised as a completely normal blockchain transaction, routed smoothly through a widely utilized, low-fee layer-1 network. Once permanently recorded on-chain, the data became publicly accessible, enabling the attackers to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the cybercriminals weaponized the Sui blockchain itself, turning it into a covert communications channel. Because the Sui network boasts fast confirmation times and negligible transaction costs, it functioned as an ideal, low-latency message bus for the operation. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct link between entering a seed phrase into the extension and the subsequent loss of digital assets. While the actual thefts occurred off-chain—predominantly on Ethereum or other layer-1 networks where the victims’ wallets held substantial funds—the precise instructions required to carry them out had been hidden cleanly in plain sight.
Before deploying the finalized version that ultimately surged into the top wallet search results on Chrome, the publishers likely tested their methodology in private. Evidence uncovered by researchers indicates that earlier builds of the software experimented with much simpler data leaks before the Sui encoding technique was fully refined. By the time the active, dangerous extension was finally flagged and reported, it had accumulated enough fraudulent installs to secure a spot in Chrome’s “trending” tier, which further amplified its visibility to unsuspecting web users. Outlets like Brave New Coin reported that the Safery wallet remained prominently featured among the top results for Ethereum wallet searches even as warnings and complaints regarding its suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Facilitated the Breach
The unprecedented success of the Safery extension hinged primarily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm heavily weighs factors such as precise keyword matches, overall install counts, review velocity, average user ratings, and update recency.
Extensions that experience a sudden, concentrated burst of activity, particularly within specialized or niche categories, can climb search rankings rapidly if their more established and better-vetted competitors are not updated frequently. In this instance, Safery benefited from a name optimized for common user queries, a rapid influx of positive reviews that often featured templated or duplicated text, and a fresh upload date that signaled active maintenance.
Available evidence does not indicate that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most new extensions to little more than a brief automated scan and fundamental static analysis. Deeper scrutiny is typically reserved for extensions that request elevated permissions, such as direct access to browser tabs, the system clipboard, local file systems, or browsing history.
Because many legitimate wallet extensions manage to bypass these specific warning triggers by operating securely within iframes or utilizing approved standard APIs, Safery was able to stay safely within those structural bounds. Even after users began noticing abnormal behavior and raising formal concerns, the time lapse between initial reporting and the final store takedown stretched on long enough for extensive financial damage to occur.
Part of this delay is structural: the Chrome ecosystem does not automatically disable or remove flagged extensions instantly unless there is an overwhelming consensus of reports or a match against known malware signatures. In this specific case, because the malicious payload consisted of obfuscated JavaScript relying entirely on legitimate blockchain infrastructure rather than external malicious hosts, traditional automated malware detection methods failed to catch it.
This incident is far from the first time browser extensions have been exploited as vehicles for cryptocurrency theft. Previous waves of scams have involved fake Ledger Live application clones prompting users to input their sensitive recovery phrases, or hijacked legitimate extensions where malicious actors managed to compromise the original developer’s publishing credentials.
However, what set Safery apart was the sheer smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no conventional phishing website to take down, no malicious web server to block, and no command center to dismantle—just a single browser extension quietly translating stolen secrets into public blockchain transactions and slipping away unnoticed.
Affected users retained limited options for recourse. Those who acted with extreme swiftness could occasionally mitigate their exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized finance protocols. Security firms including Socket quickly published emergency triage steps for anyone who had installed the extension: uninstall the application immediately, revoke any active token approvals, rapidly sweep remaining digital assets to a brand-new wallet using a completely clean device, and continuously monitor associated blockchain addresses. For victims who failed to notice the silent exfiltration in time, or those who maintained large balances in vulnerable hot wallets, financial recovery remained highly unlikely.
The unfolding fallout from the Safery incident has intensified pressure from security researchers and software developers urging Google to implement much stronger heuristics within the Chrome browser environment. Among the primary proposals is the implementation of automated flags for any extension that incorporates user interface elements specifically designed to prompt for 12- or 24-word recovery phrases.
Another prominent suggestion involves requiring strict publisher attestation protocols for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the underlying codebase of a recognized wallet brand. Furthermore, industry experts have called for much tighter inspection protocols regarding wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday cryptocurrency users, security analysts continue to emphasize practical checklists for safe extension management. Before installing any digital asset extension, users are strongly advised to thoroughly review the publisher’s history, verify concrete associations with known, reputable development projects, carefully inspect review patterns for obvious anomalies like sudden bursts of identical text, check for legitimate website links backed by public GitHub code repositories, and closely audit the permissions tab for vague or sweeping system access. A clean name, polished presentation, and high user rating are simply no longer sufficient guarantees of safety.
This alarming episode raises much broader, more fundamental questions regarding the fundamental role of the modern web browser within the cryptocurrency landscape. Browser-based wallets originally gained widespread popularity due to their high accessibility and ease of use, allowing users to interact seamlessly with decentralized applications without needing to switch platforms or download standalone desktop software.
Yet, that very accessibility has come at a severe security cost. The web browser is inherently a high-risk operational environment subject to various attack vectors, including malicious extension manipulation, active session hijacking, clipboard scrapers, and now covert blockchain exfiltration.
As the industry grapples with these persistent vulnerabilities, wallet developers are increasingly likely to rethink their primary distribution models. Some proactive development teams already actively discourage Chrome Web Store installations, preferring to steer users toward standalone mobile applications or secure desktop binaries. Other projects may eventually build automated warning systems to caution users who attempt to install software from unverified or questionable sources.
Ultimately, the core problem persists: software distribution across the web remains highly fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a genuinely secure wallet from a brilliantly polished clone. The Safery extension demonstrated that attackers no longer need to impersonate established giants like MetaMask or Phantom to succeed; they can simply manufacture their own trusted brand, seed fake signals of legitimacy, and construct an invisible digital backdoor that uses a public blockchain as its courier. This reality demands a profound reassessment of how trust is established within cryptocurrency user experiences, and how vulnerable even casual browser-facing tools truly are.
