For a brief period in November, a malicious Chrome extension managed to climb the ranks of the Chrome Web Store, positioning itself as the fourth search result for the high-volume keyword "Ethereum wallet." Disguised under the name "Safery: Ethereum Wallet," the application possessed all the visual markers of a legitimate, professionally developed tool. It featured a clean icon, a generic yet professional title adjacent to security terminology, a sudden surge of five-star reviews, and boilerplate descriptions that are instantly familiar to anyone who has ever downloaded a decentralized cryptocurrency wallet to interact with Web3 applications.
Beneath this polished and deceptive frontend, however, lay a purpose-built cyberattack designed explicitly to harvest user seed phrases and systematically drain victim wallets. Rather than relying on traditional methods of exfiltration, the extension utilized a novel and clandestine technique: it encoded stolen recovery secrets directly into micro-transactions executed on the Sui blockchain.
The campaign came to light after security tooling company Socket, which focuses heavily on open-source software supply chains, installed and analyzed the extension following its discovery in the wild. The primary objective of Socket’s investigation was to understand how "Safery" managed to completely evade automated detection mechanisms, steadily climb the competitive Chrome Web Store rankings, and exfiltrate sensitive seed phrases without raising immediate security alarms. Furthermore, the analysis aimed to determine what users could do to identify and protect themselves against similar emerging threats. The resulting security report walks through the attacker’s sophisticated methodology, serving simultaneously as a postmortem of the incident and a stark warning that browser extensions remain a dangerous and frequently overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular case uniquely noteworthy is that the malicious actors behind the extension did not rely on traditional phishing tactics. In the cryptocurrency sector, spoofing an existing brand—such as creating a MetaMask lookalike or utilizing a recycled phishing domain—is an unfortunately common and well-trodden territory. "Safery," however, took an entirely different route. It invented a completely original identity, manufactured or purchased a flood of fake bot reviews to aggressively game the search algorithm, and launched openly as a novel, independent wallet option.
Because of this fabricated identity, the extension’s listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious or overreaching permissions requested, and no sudden redirections to shady, untrusted external domains. The official Chrome Web Store publisher page contained zero prior complaints or flags, and its designated support URL directed users to an off-platform website that had not yet been flagged by security tracking firms at the time of Socket’s detailed analysis.
Given the remarkably polished appearance of the listing, the vast majority of everyday users would likely not have hesitated before clicking the "Add to Chrome" button. Upon installation, the extension merely requested permission to run on "all websites," which is standard, expected behavior for cryptocurrency wallets that require continuous access to decentralized applications to function properly. Notably, the extension did not prompt users for extra, unusual permissions, nor did it attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the companion website perfectly matched the name of the extension, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—behavior that completely mirrors legitimate software.
The Seed Heist, Broadcast Over Sui
The real damage began the exact moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or securely encrypting it for authorized user access, the extension silently fractured the phrase into multiple small pieces. It then ingeniously encoded these fragments to look like completely random cryptocurrency wallet addresses.
According to Socket’s technical research, these extracted fragments were quietly embedded directly into regular Sui blockchain transactions. Specifically, the extension executed tiny, minuscule SUI token transfers—amounts so small that they would never draw the attention of the user or network monitors—to addresses directly controlled by the attacker. Hidden deep inside those blockchain transactions, either tucked away inside memo fields or subtly obfuscated within the transaction parameters, were the exact pieces of the user’s private seed phrase.
This tactical approach provided the attackers with significant operational advantages. Because the data was transmitted as part of a normal transaction, the extension did not need to send outbound network requests to malicious, external servers. There was no obvious command-and-control beacon communicating over HTTP or WebSockets that a traditional web browser or local antivirus software could easily flag and intercept.
Instead, the malicious payload left the victim’s device disguised as an ordinary, innocuous blockchain transaction, efficiently routed through a widely used, low-fee layer-one network. Once successfully recorded on-chain, the data was publicly accessible, permitting the attacker to quietly retrieve it at their convenience, reconstruct the complete seed phrase, and systematically sweep associated assets clean without ever needing to touch the user’s device a second time.
In effect, the scam creatively weaponized the Sui blockchain itself, turning it into a covert communications channel. Because the Sui network boasts extremely fast confirmation times and negligible transaction costs, it functioned seamlessly as a low-latency message bus for the thieves.
Socket successfully traced multiple instances of these unique seed-fragment transactions, definitively confirming the direct link between the initial entry of a seed phrase into the extension and the eventual loss of funds. While the actual thefts of cryptocurrency occurred off-chain—taking place on Ethereum or other layer-one networks where the victims’ wallets held substantial capital—the precise instructions required to carry out the thefts were hidden entirely in plain sight on an entirely separate blockchain.
Evidence uncovered by researchers indicates that before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher likely tested the methodology in private. Earlier, abandoned builds experimented with much simpler data-leaking techniques before the Sui encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to break into Chrome’s coveted "trending" tier, which further accelerated its visibility to unsuspecting users. Reports confirmed that the fake wallet sat comfortably among the top organic results for "Ethereum wallet" searches even as growing reports of suspicious behavior began circulating publicly across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged heavily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm evaluates multiple factors, including exact keyword matches, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden, manufactured burst of activity, particularly within niche categories, can climb search rankings rapidly if established, better-vetted competitors are not updated with equal frequency. In this instance, "Safery" benefited from a name that scored exceptionally well for common user queries, a rapid blitz of positive reviews that were largely templated or duplicated, and a very fresh upload date that signaled active maintenance.
Available evidence indicates that Google did not manually review the listing prior to its publication. The Chrome Web Store policy typically subjects new extensions to a brief automated scan alongside fundamental static analysis. Extensions generally only undergo deeper human scrutiny when they request highly elevated permissions, such as direct access to active tabs, system clipboards, local file systems, or browsing history. Wallet extensions routinely manage to avoid triggering these heightened security flags by operating safely within iframes or utilizing officially approved developer APIs. "Safery" deliberately stayed well within those established bounds.
Even when vigilant users began raising serious concerns and reporting the extension, the time gap between initial reporting and the eventual administrative takedown stretched out long enough for substantial financial damage to occur. Part of this lag is structural; the Chrome Web Store does not act on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or explicitly identified malware signatures. In this specific scenario, because the payload consisted of heavily obfuscated JavaScript that relied entirely on legitimate blockchain infrastructure rather than external malicious hosts, traditional automated malware detection methods failed to catch it.
This incident is far from the first time browser extensions have been exploited as vectors for cryptocurrency theft. Previous waves of scams have included fraudulent Ledger Live applications that prompted users to input their secret recovery phrases, or instances where legitimate, established extensions were hijacked after attackers managed to compromise the original developer’s publishing keys.
What truly set "Safery" apart, however, was the remarkable smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website that authorities could easily take down, and no rogue server IP address to block—just a single browser extension quietly moving confidential secrets onto a public blockchain and walking away.
Users who fell victim to the scheme still had limited options for recourse, provided they acted with extreme urgency. Swift action could theoretically limit exposure by allowing individuals to immediately rotate their seed phrases and revoke existing token smart contract approvals. Security firms like Socket quickly published triage checklists for anyone who had installed the extension: uninstall the application immediately, revoke all active token approvals, sweep remaining digital assets to a brand-new wallet created on a completely clean and uncompromised device, and continuously monitor associated public addresses for unauthorized activity. For those users who failed to notice the silent data exfiltration or who stored significant amounts of capital in vulnerable hot wallets, asset recovery remained highly improbable.
The unfolding situation has prompted security researchers and independent developers to call for much stronger heuristics directly from Google and the Chrome platform. One prominently proposed solution involves automatically flagging and blocking any browser extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another suggested defense mechanism is requiring strict publisher attestation for all wallet-related extensions, providing verifiable, cryptographic proof that a given publisher genuinely controls the underlying codebase behind a recognized wallet brand. Furthermore, industry experts have voiced the need for much tighter scrutiny surrounding wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday end users, security organizations continue to stress the importance of rigorous evaluation before downloading tools. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s history, independently verify official associations with known and trusted projects, carefully inspect review patterns for obvious anomalies like bursts of identical text, check for legitimate website links backed by public GitHub software repositories, and closely scan the permissions tab for vague or sweeping access requests. A clean name, professional branding, and a high star rating are simply no longer enough to guarantee safety.
This sophisticated attack raises much broader, more fundamental questions regarding the long-term role of the traditional web browser in cryptocurrency management. Browser-based wallets originally gained widespread popularity due to their exceptional accessibility and ease of use, enabling individuals to interact seamlessly with complex decentralized applications without requiring them to switch platforms or download separate, standalone desktop applications.
However, that unmatched accessibility has consistently come at the steep cost of heightened exposure. The modern web browser remains an inherently high-risk operating environment that is perpetually vulnerable to extension manipulation, session hijacking, clipboard scraping, and now, covert blockchain-based data exfiltration.
In response to these persistent vulnerabilities, cryptocurrency wallet developers are increasingly likely to rethink their primary distribution models. Some development teams already actively discourage users from utilizing the Chrome Web Store, preferring instead to direct them toward dedicated mobile applications or standalone desktop binaries. Others may soon introduce proactive in-app warnings designed to caution users attempting to install software from unverified or third-party sources.
Ultimately, the core problem persists: software distribution remains heavily fragmented, and the average user lacks the technical expertise required to reliably distinguish a legitimate, secure wallet from a polished, malicious clone. The "Safery" extension proved conclusively that attackers no longer need to impersonate established giants like MetaMask or Phantom to succeed; they can simply invent their own brand, seed artificial trust signals, and construct an invisible backdoor that utilizes an independent blockchain as a courier. This reality demands a comprehensive reassessment of how trust is established within cryptocurrency user experiences, and just how close to the metal everyday tools like browser extensions really operate. Crypto users frequently operate under the assumption that Web3 guarantees absolute digital sovereignty and self-custody, but in the wrong hands, a standard browser wallet functions less like a secure vault and more like an open port—and Chrome will not always warn you before something slips through.
