For a few critical days last November, a sophisticated and malicious browser extension managed to secure the fourth position for the search query "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively named "Safery: Ethereum Wallet," was designed with enough polish and professional presentation to easily pass as a legitimate tool for cryptocurrency users. Featuring a clean icon, a generic yet security-adjacent name, a massive influx of five-star reviews, and standard descriptive language familiar to anyone who has ever downloaded a digital asset manager, it presented virtually no immediate warning signs to prospective victims.
Beneath its pristine frontend interface, however, lay a purpose-built cyberattack mechanism. The extension was engineered to steal sensitive user seed phrases and systematically empty connected digital wallets by stealthily encoding the stolen secrets into micro-transactions executed on the Sui blockchain.
The security tooling company Socket, which specializes in open-source software supply chains, installed and conducted a thorough technical analysis of the extension shortly after its malicious nature was uncovered. The primary objective of the research was to understand how "Safery" managed to successfully evade automated detection, climb the competitive Chrome Store search rankings, and exfiltrate sensitive seed phrases without triggering platform alarms, while also providing valuable insight into how users might spot similar threats in the future. The resulting security report serves as both a detailed technical postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular case uniquely noteworthy is that the malicious actors behind the operation did not rely on the common tactic of spoofing an existing, trusted wallet brand. Unlike previous high-profile scams that utilized MetaMask lookalike interfaces or recycled phishing domains, Safery invented an entirely fresh identity from scratch. The perpetrators bought or artificially generated fake reviews to rapidly manipulate search rankings, launching the software effectively as a brand-new option in the marketplace.
Because of this original-identity approach, the store listing showed an absolute absence of traditional red flags. There was no broken grammar, no suspicious or overly broad permission requests, and no redirection to shady external domains. The Chrome Web Store publisher page carried zero prior complaints, and its designated support URL directed users to an off-platform website that security trackers had not yet flagged at the time of Socket’s investigation.
Given its polished appearance and professional presentation, the vast majority of web users would have felt comfortable clicking the "Add to Chrome" button without a second thought. The extension requested permission to run on "all websites," which is a routine and necessary request for crypto wallets that need seamless integration with various decentralized applications across the web.
Crucially, it did not prompt for extra, anomalous permissions or attempt to inject complex content scripts that would typically trigger Chrome’s more aggressive security warnings. The overall branding was minimalist, the supporting website mirrored the extension’s exact name, and the initial setup screen naturally prompted users to either create a new wallet or import an existing one—behavior that mimics standard, legitimate industry practices.
The Seed Heist, Broadcast Over Sui
The true damage of the exploit began the moment an unsuspecting user entered their seed phrase into the interface. Rather than storing the recovery phrase locally or securely encrypting it for user accessibility, the extension silently fractured the phrase into smaller pieces and encoded them to look like completely random cryptocurrency wallet addresses.
Socket’s comprehensive research demonstrated that these fragmented pieces of confidential data were directly inserted into active Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so small they would naturally draw zero attention—to various addresses directly controlled by the attackers.
Hidden discreetly inside those routine blockchain transactions, either tucked away within memo fields or embedded via obfuscated destination addresses, were the exact recovery components of the user’s seed phrase.
This tactical approach provided the attackers with significant operational advantages. Because the data was transmitted inside standard blockchain traffic, the extension had zero requirement to send outbound network requests to malicious command-and-control servers. There was no suspicious beaconing or data exfiltration routed over HTTP or WebSockets that a traditional web browser or local antivirus program might catch and flag.
Instead, the payload left the user’s local device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee blockchain network. Once successfully recorded on-chain, the sensitive data became publicly accessible, giving the attacker the luxury of retrieving it at their convenience, reconstructing the complete seed phrase, and systematically sweeping external wallets clean without ever needing to touch the victim’s device again.
In effect, the sophisticated scam utilized the Sui blockchain infrastructure itself as a covert communication channel. Because the Sui network boasts exceptionally fast transaction confirmation times and negligible fees, it functioned perfectly as a low-latency message bus for the hackers.
Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between seed entry and the subsequent loss of digital assets. While the actual thefts took place off-chain on Ethereum or other Layer-1 networks where the victims’ wallets held substantial funds, the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the polished version that eventually climbed to the top of Chrome’s wallet search results, the publisher likely tested the methodology in private experimental builds. Digital forensic evidence indicates that earlier iterations experimented with much simpler data leaks before the Sui encoding technique was successfully refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to comfortably reach Chrome’s "trending" tier, further amplifying its visibility to everyday users. Reports highlighted that the Safery wallet remained prominently positioned among the top search results for Ethereum wallet queries even as urgent warnings regarding its suspicious behavior began circulating across public platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying mechanics of Chrome’s search ranking logic. The Web Store search algorithm continuously weighs several distinct factors, including keyword matching, total install counts, review velocity, average user ratings, and update recency.
Extensions that experience a sudden, concentrated burst of activity, particularly within niche or specialized categories, can climb search rankings rapidly if more thoroughly vetted competitors are not updated with equal frequency. In this specific scenario, Safery combined a strategically optimized name that scored well for high-volume queries, a coordinated blitz of positive reviews—many of which were heavily templated or duplicated—and a fresh upload timestamp.
Available evidence indicates that Google did not subject this specific listing to a manual review prior to publication. Chrome Web Store policies typically subject newly submitted extensions to a brief automated scan and fundamental static code analysis.
Under the current system, extensions generally undergo deeper, more rigorous scrutiny only when they request elevated or sensitive permissions, such as direct access to open tabs, user clipboards, local file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating neatly within iframes or utilizing standard approved application programming interfaces. Safery remained strictly within those operational boundaries.
Even after concerned users began raising alarms and reporting the extension, the mandatory window of time between initial reporting and eventual platform takedown stretched out long enough for substantial financial damage to occur. Part of that lag is structural: the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of danger or the detection of known malware signatures.
In this scenario, however, the payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than traditional external hosts. As a result, conventional malware detection methodologies failed to catch it.
This security incident is far from the first time that browser extensions have been weaponized to target cryptocurrency holders. Previous historical scams have included fake Ledger Live applications that similarly prompted unsuspecting users to enter their recovery phrases, or compromised legitimate extensions where attackers managed to hijack the original developer’s publishing keys.
What distinctly sets the Safery incident apart is the remarkable smoothness of its digital facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website that authorities could easily take down, and no malicious server IP address to block—just a single extension silently moving secrets onto a public blockchain network and walking away.
Impactful recourse for affected users remained limited. Those who acted with extreme promptness could mitigate some exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized protocols.
Socket and other industry security researchers outlined critical triage steps for anyone who had mistakenly installed the extension: immediate uninstallation, the urgent revocation of all active token approvals, sweeping remaining assets to an entirely new wallet using a clean and uncompromised device, and careful monitoring of all associated addresses. For users who failed to notice the silent data exfiltration or who maintained large balances within vulnerable hot wallets, asset recovery remained highly unlikely.
Security researchers and software developers are now intensifying calls for stronger detection heuristics directly from Google Chrome. Among the proposed systemic solutions is the implementation of automated flagging for any browser extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another strongly advocated approach involves requiring mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase associated with a recognized wallet brand. Furthermore, industry experts are urging tighter scrutiny of wallet-related permissions, even when those permissions do not explicitly feature traditional dangerous access patterns.
For end users navigating the web, security firms continue to stress rigorous checklist practices before installing any cryptocurrency extension. Users are advised to thoroughly review the publisher’s history, verify authentic association with a known project, inspect review patterns for artificial bursts of identical feedback, check for real website links backed by public code repositories, and scrutinize the permissions tab for vague or sweeping access requests.
Ultimately, this alarming incident raises broader, fundamental questions about the role of the standard web browser within the cryptocurrency ecosystem. Browser-based wallets originally gained widespread popularity due to their high accessibility and ease of use, allowing everyday users to interact seamlessly with decentralized applications without needing to switch platforms or download standalone desktop applications.
However, that unmatched convenience has come at a severe cost to security and exposure. The modern web browser remains an inherently high-risk environment subject to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As a result, wallet developers are likely forced to rethink their distribution models entirely. Some development teams already actively discourage Chrome Web Store installations, preferring to direct users toward dedicated mobile applications or standalone desktop binaries. Others may soon implement native warnings for users attempting to install wallet software from unverified sources.
The core underlying problem persists: software distribution across the web remains heavily fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a legitimate, secure wallet from a polished clone.
The Safery extension proved conclusively that malicious actors no longer need to spoof prominent brands like MetaMask or Phantom to succeed. By creating an entirely fictional brand, seeding fabricated trust signals, and building an invisible backdoor that leveraged the Sui blockchain as an efficient courier, the attackers bypassed traditional defenses.
This development demands a fundamental reassessment of how trust is established within cryptocurrency user experiences, and how close to the core infrastructure even casual tools like browser extensions truly operate. Cryptocurrency users naturally assume that Web3 technology guarantees absolute sovereignty and self-custody, but in the wrong hands, an unvetted browser wallet functions less like a secure digital vault and more like an open port—and the browser will not always warn you before something slips through.
