By Asro 
For a few critical days last November, a sophisticated malicious Chrome extension managed to climb the ranks of the Chrome Web Store, positioning itself as the fourth organic search result for the high-value keyword query "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," achieved a level of polish that easily allowed it to pass as a legitimate, trustworthy tool to unsuspecting users. It featured a clean, professional-looking icon, a generic name cleverly positioned alongside security-adjacent language, a massive influx of five-star reviews, and boilerplate descriptions that instantly look familiar to anyone who has ever downloaded a decentralized cryptocurrency wallet.
However, hidden directly behind this polished frontend was a purpose-built, highly calculated cyberattack. The extension was engineered to steal user seed phrases and rapidly empty their digital asset wallets by covertly encoding stolen secrets into micro-transactions executed on the Sui blockchain.
The security tooling company Socket, which specializes in open-source software supply chains, installed and closely analyzed the extension immediately after security researchers flagged its suspicious behavior. Their primary objective was to understand how "Safery" managed to completely bypass automated detection mechanisms, steadily climb the competitive Chrome Store search rankings, and exfiltrate sensitive seed phrases without triggering platform alarms. Furthermore, the security team wanted to determine actionable steps users could take to spot and defend against similar threats in the future. The resulting technical report walks through the attacker’s innovative approach, serving as both a postmortem analysis and a stark warning that browser extensions continue to represent a dangerous, overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case deeply noteworthy to cybersecurity experts and digital asset holders alike is that the malicious actors did not simply rely on traditional tactics. Stealing seed phrases is, unfortunately, well-trodden territory in the crypto threat landscape.
What truly sets this incident apart is that Safery did not spoof an existing, established wallet brand. It was not a sloppy MetaMask lookalike, nor did it rely on a recycled phishing domain designed to catch typographical errors. Instead, the creators invented an entirely new identity, purchased or generated botted fake reviews to manipulate search rankings, and launched the application as a completely "new" independent wallet option.
Because of this novel approach, the store listing showed virtually no immediate red flags that users have been trained to look out for. There was no broken grammar in the descriptions, no bizarre or excessive permission requests, and no suspicious redirection to shady external domains. The Chrome Web Store publisher page associated with the extension had zero prior complaints logged against it, and its designated support URL led to an off-platform website that had not yet been flagged by security trackers at the time of Socket’s initial analysis.
Given its polished appearance and professional presentation, most everyday users would not have hesitated for even a second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for crypto wallets that must interact seamlessly with various decentralized applications across the web.
Notably, the extension did not prompt users for extra, unusual permissions, nor did it attempt to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding remained minimalist, the accompanying support website precisely matched the extension’s name, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—again, entirely standard behavior for any legitimate software in this category.
The Seed Heist, Broadcast Over Sui
The real, irreversible damage began the exact moment a user entered their private seed phrase into the interface. Instead of storing the sensitive phrase locally or securely encrypting it for user-controlled access, the extension silently fragmented the phrase into smaller pieces. It then encoded these fragments to look like random, ordinary blockchain wallet addresses.
Socket’s rigorous research demonstrates that these fragmented pieces were directly inserted into active Sui blockchain transactions. Specifically, the extension executed tiny SUI token transfers—minuscule amounts of cryptocurrency that would never draw the attention of the user or network monitors—and sent them to external addresses directly controlled by the attacker.
Hidden securely inside those seemingly innocuous transactions, either tucked away inside memo fields or cleverly obfuscated within the target addresses themselves, were the distinct pieces of the victim’s seed phrase.
This calculated approach provided massive tactical advantages to the attackers. Crucially, it meant the extension did not require any outbound network requests to malicious, external servers. There was no traditional command-and-control beacon operating in the background, and no data exfiltration occurring over standard HTTP or WebSockets protocols that a modern web browser or commercial antivirus software might instantly flag and block.
Instead, the malicious payload left the user’s device disguised as a completely normal-looking blockchain transaction, routed safely through a widely used, exceptionally low-fee layer-1 blockchain. Once the data successfully landed on-chain, it was publicly accessible, allowing the attacker to calmly retrieve the fragments at their leisure, reconstruct the complete seed phrase, and completely sweep the victim’s wallets clean without ever needing to touch the user’s device a second time.
In effect, the sophisticated scam utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network features remarkably fast transaction confirmation times and negligible gas fees, it functioned perfectly as a low-latency message bus for the thieves.
Socket successfully traced multiple historical examples of these seed-fragment transactions and definitively confirmed the direct link between seed entry and the subsequent loss of user assets. While the actual thefts occurred off-chain—primarily on Ethereum or other layer-1 networks where the victims’ compromised wallets actually held substantial funds—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before finally releasing the specific version that successfully landed in Chrome’s top wallet search results, the publisher almost certainly tested this clandestine method in private. Digital forensics and historical evidence indicate that earlier, unreleased builds experimented with much simpler data leaks before the Sui encoding technique was fully refined.
By the time the active, malicious extension was finally flagged and reported by vigilant community members, it had accumulated enough installations to comfortably reach Chrome’s "trending" tier, which further amplified its visibility to casual searchers. Reports indicated that the "Safery" wallet sat comfortably among the top organic results for "Ethereum wallet" searches even as mounting reports of suspicious account drains circulated widely on public forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged entirely on the internal ranking logic of the Chrome Web Store. The store’s search algorithm heavily weighs factors such as keyword matching, total install counts, review velocity, average star ratings, and how recently an extension was updated.
Extensions that experience a sudden, manufactured burst of activity—especially within niche categories where better-vetted competitors are not updated frequently—can climb search results with alarming speed. In this specific scenario, "Safery" benefited from a name that scored exceptionally well for common user queries, a rapid blitz of positive reviews that were largely templated or duplicated, and a fresh upload date that signaled active development.
There is currently no evidence to suggest that Google manually reviewed this particular listing prior to its publication. The standard Chrome Web Store policy subjects most new extensions to little more than a brief automated scan and fundamental static code analysis.
Extensions typically undergo much deeper manual scrutiny only when they explicitly request elevated, dangerous permissions, such as direct access to open tabs, the system clipboard, local file systems, or browsing history. Wallet extensions frequently manage to avoid triggering these heavy security flags by operating safely within iframes or utilizing officially approved application programming interfaces. "Safery" carefully stayed within those exact operational boundaries.
Even when concerned users raised red flags and attempted to report the listing, the frustrating time gap between the initial reporting and the eventual platform takedown stretched on long enough for devastating financial damage to occur. Part of this lag is structural: the Chrome Web Store does not automatically act on flagged extensions instantly unless there is an overwhelming consensus from security researchers or a matching signature for known malware.
In this case, however, the payload was heavily obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than traditional external web hosts. Traditional malware detection methods simply failed to catch it.
This security failure is unfortunately not the first time browser extensions have been weaponized to steal cryptocurrency. Previous high-profile scams have included fake Ledger Live companion applications that prompted unsuspecting users to enter their master recovery phrases, or hijacked legitimate, pre-existing extensions where attackers managed to compromise the original developer’s publishing keys.
What truly makes the "Safery" incident unique is the remarkable smoothness of the frontend facade combined with the complete absence of traditional backend cyber infrastructure. There was no malicious phishing website to take down, and no rogue server IP address to block—just a single browser extension quietly moving stolen secrets onto a public blockchain and walking away.
Users who fell victim to the scheme still had very narrow windows of recourse. If they acted with extreme urgency, they could limit their overall exposure by immediately rotating their seed phrases and revoking outstanding token spending approvals across their accounts.
Security firms like Socket quickly published comprehensive triage steps for anyone who realized they had installed the rogue extension: uninstall the software immediately, revoke all active token approvals, sweep any remaining digital assets to a completely new wallet generated on a clean and uncompromised device, and closely monitor all associated addresses for anomalous activity. For users who failed to notice the silent data exfiltration in time, or who stored large amounts of capital directly in vulnerable hot wallets, asset recovery remained virtually impossible.
The incident has prompted security researchers, developers, and everyday users to call for significantly stronger heuristics from Google regarding the Chrome Web Store. One prominent solution being discussed is the implementation of automated flags for any extension that includes user interface elements explicitly prompting for standard 12- or 24-word recovery phrases.
Another widely supported approach involves requiring strict publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher actually controls the official codebase behind a recognized wallet brand. There are also renewed demands for much tighter inspection of wallet-related permissions, even when those permissions do not explicitly include traditional dangerous access patterns.
For end users navigating the Web3 space, security analysts continue to emphasize that a clean name, a professional presentation, and a high star rating are simply not enough to guarantee safety. The broader situation raises fundamental questions about the inherent risks of relying on web browsers as the primary interface for decentralized finance. Browser-based wallets originally gained immense popularity due to their high accessibility and ease of use, allowing users to interact smoothly with decentralized applications without needing to switch platforms or install standalone native applications.
However, that vital accessibility has come at a severe cost to user security. The modern web browser remains an inherently high-risk computing environment that is constantly subject to malicious extension manipulation, session hijacking, automated clipboard scrapers, and now covert blockchain exfiltration techniques.
As developers and security professionals grapple with these evolving threats, the fundamental architecture of crypto user experience is facing intense scrutiny. Until distribution models are fundamentally reformed, users must remain acutely aware that browser wallets can easily transform from digital vaults into open ports, and major platform operators may not always issue warnings before malicious tools slip through the cracks.
Raul Delapena Setiawan 
Muslim 
Siti Muinah