By Raul Delapena Setiawan 
For a few critical days in November, a meticulously crafted malicious Chrome extension managed to secure the fourth position for the search query "Ethereum wallet" on the official Chrome Web Store.
The extension, deceptively named "Safery: Ethereum Wallet," was designed with enough polish to effortlessly pass as a legitimate tool to the average internet user. It featured a clean, professional icon, a generic name carefully adjacent to standard security language, a sudden flood of five-star reviews, and boilerplate descriptions that instantly feel familiar to anyone who has ever downloaded a cryptocurrency wallet.
Beneath that polished frontend, however, lay a purpose-built attack mechanism engineered to steal sensitive seed phrases and completely empty user wallets. It achieved this by stealthily encoding the stolen secrets into micro-transactions executed directly on the Sui blockchain.
Socket, a prominent security tooling company focused on open-source software supply chains, installed and closely analyzed the extension shortly after its suspicious nature was discovered by the broader cybersecurity community.
Their primary objective was to understand how "Safery" managed to completely evade automated detection systems, rapidly climb the competitive Chrome Store search rankings, and exfiltrate stolen seed phrases without raising any immediate alarms, as well as to determine what proactive steps users could take to spot similar threats in the future. The resulting technical report walks meticulously through the attacker’s approach, serving simultaneously as a forensic postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular security incident is particularly noteworthy because the malicious actors behind it did not resort to simply spoofing an existing, established wallet brand. That specific tactic is, unfortunately, well-trodden territory in the crypto threat landscape.
What makes the Safery case stand out is that the extension did not attempt to impersonate a MetaMask lookalike or recycle a known phishing domain. Instead, it invented an entirely fresh identity out of thin air, purchased or deployed bot-driven fake reviews to artificially inflate its search rankings, and launched itself cleanly as a "new" and independent wallet option.
This calculated approach meant the store listing displayed virtually no immediate red flags: there was no broken grammar in the descriptions, no obviously suspicious permission requests, and no redirection attempts to shady, untrusted external domains.
Furthermore, the Chrome Web Store publisher page carried no prior user complaints, and its designated support URL led to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket’s detailed analysis.
Given its remarkably polished and professional appearance, most everyday users would not have hesitated for even a moment before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for genuine crypto wallets that must interact seamlessly with various decentralized applications across the web.
Crucially, it did not prompt for extra, unusual permissions or attempt to inject complex content scripts that might have triggered Chrome’s more aggressive built-in security warnings. The branding was minimalist, the companion website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—again, entirely standard behavior for any legitimate software in this category.
The Seed Heist, Broadcast Over Sui
The real, irreparable damage began the moment an unsuspecting user entered their private seed phrase. Instead of storing the phrase locally on the device or encrypting it for user-exclusive access, the extension silently fractured the sensitive text into smaller pieces and cleverly encoded them to mimic random, unrelated wallet addresses.
Socket’s rigorous research demonstrates that these fragmented pieces were then systematically inserted into actual Sui blockchain transactions. Specifically, the extension issued tiny, nearly invisible SUI token transfers—minuscule amounts of currency designed to draw zero attention—to addresses directly controlled by the attacker.
Hidden discreetly inside those transactions, either tucked away safely in memo fields or disguised within obfuscated addresses, were the precise fragments of the user’s private seed phrase.
This sophisticated approach offered immense tactical advantages to the hackers. It completely eliminated the need for the extension to send traditional outbound requests to malicious external servers. There was no suspicious command-and-control beacon operating in the background, and there was no outward data exfiltration over HTTP or WebSockets that a modern browser or standard antivirus program might easily flag.
Instead, the payload safely left the user’s device disguised as a completely normal, legitimate-looking blockchain transaction, routed smoothly through a widely used, low-fee blockchain network. Once safely on-chain, the data was publicly accessible, allowing the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep connected wallets clean without ever needing to touch the user’s compromised device a second time.
In effect, the sophisticated scam utilized the Sui blockchain itself as an unconventional communications channel. And because the Sui network features remarkably fast confirmation times and virtually negligible transaction costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple distinct examples of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts occurred off-chain—predominantly on Ethereum or other Layer-1 networks where the victims’ wallets conveniently held valuable funds—the explicit instructions for carrying out the heists were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher almost certainly tested this unique methodology in private. Digital evidence indicates that earlier, unreleased builds experimented with much simpler data-leaking mechanisms before the Sui encoding technique was fully refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough fraudulent installs to comfortably reach Chrome’s coveted "trending" tier, which further amplified its visibility to innocent users. Reports indicated that the "Safery" wallet sat proudly among the top results for "Ethereum wallet" searches even as urgent reports of suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged heavily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm evaluates multiple factors simultaneously, including keyword matching, total install counts, review velocity, average user ratings, and update recency.
Extensions that experience a sudden, aggressive burst of activity, particularly within niche categories, can climb search rankings rapidly if better-vetted competitors are not updated with equal frequency. In this specific case, "Safery" benefited from a name that scored exceptionally well for common search queries, a coordinated blitz of positive reviews—many of which were clearly templated or duplicated—and a deceptively fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy subjects most new extension submissions to little more than a brief automated scan and fundamental static analysis.
Extensions typically undergo much deeper manual scrutiny only when they explicitly request highly elevated permissions, such as widespread access to user tabs, sensitive clipboards, local file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating carefully within isolated iframes or by utilizing officially approved application programming interfaces. The "Safery" extension stayed safely within those acceptable bounds.
Even when concerned users raised alarms and reported the extension, the operational lag between the initial reporting and the eventual store takedown stretched on long enough for substantial financial damage to occur. Part of that lag is structural: the Chrome Web Store does not act on flagged extensions instantaneously unless there is an overwhelming consensus of reports or officially recognized malware signatures.
In this scenario, the payload consisted of heavily obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than traditional, easily blockable external web hosts. Consequently, traditional malware detection methods failed to catch it in time.
This is far from the first instance in which browser extensions have been weaponized to steal cryptocurrency from unwary consumers. Previous high-profile scams have included fraudulent Ledger Live applications that improperly prompted users to enter their recovery phrases, or hijacked legitimate extensions where attackers managed to compromise the original developer’s publishing keys.
What fundamentally distinguished "Safery" from previous attacks was the sheer smoothness of its user-facing facade and the complete absence of traditional backend infrastructure. There was no external phishing website for authorities to take down, and no centralized server to block—just a single browser extension quietly moving secret data onto a public blockchain and walking away cleanly.
Victims still retained some limited avenues for recourse. If they acted with extreme swiftness, they could potentially limit their exposure by rotating their seed phrases, transferring remaining assets to a secure hardware wallet, and revoking outstanding transaction approvals across various decentralized protocols.
Security firms like Socket quickly published practical triage steps for anyone who realized they had installed the extension: uninstall the malicious software immediately, revoke all active token approvals, sweep remaining digital assets to a brand-new wallet using a completely clean and uncompromised device, and closely monitor any associated addresses. For users who failed to notice the silent exfiltration in time or who stored large amounts of capital in vulnerable hot wallets, meaningful recovery remained highly unlikely.
The Real Trouble Begins Before the Wallet Ever Loads
In the wake of this incident, cybersecurity researchers and independent developers are mounting pressure on tech giants to implement stronger security heuristics directly within the Chrome ecosystem. One prominently proposed solution involves automatically flagging and blocking any extension that includes user interface elements prompting for a standard 12-word or 24-word recovery phrase.
Another widely discussed approach requires mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase behind a recognized wallet brand. There are also persistent calls for significantly tighter inspection standards regarding wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday end users, security firms continue to stress the importance of rigorous personal diligence. Before installing any cryptocurrency-related browser extension, users are strongly advised to thoroughly review the publisher’s history, independently verify any claimed associations with known open-source projects, inspect review patterns for obvious anomalies like sudden bursts of identical text, check for real website links backed by public code repositories on platforms like GitHub, and carefully scan the permissions tab for vague or overly sweeping access requests.
As this incident painfully demonstrates, a clean interface, a professional name, and a high star rating are simply no longer enough to guarantee safety in the Web3 space.
The situation raises much broader, uncomfortable questions regarding the fundamental role of the traditional web browser in the modern cryptocurrency landscape. Browser-based wallets originally gained widespread popularity primarily due to their high accessibility and ease of use, allowing everyday users to interact smoothly with complex decentralized applications without needing to switch platforms or install standalone desktop software.
However, that unmatched convenience has come at a severe cost to security. The standard web browser is inherently a high-risk operational environment, constantly subjected to potential extension manipulation, session hijacking, silent clipboard scrapers, and now, covert blockchain-based exfiltration.
Moving forward, wallet developers are increasingly likely to rethink their primary distribution models entirely. Some cautious development teams already actively discourage Chrome Web Store installations, preferring to direct users toward dedicated mobile applications or standalone desktop binaries. Others may soon implement prominent native warnings for users attempting to install wallet software from unverified or third-party sources.
The core systemic problem, however, remains largely unresolved: software distribution is deeply fragmented, and the vast majority of everyday users simply do not possess the technical expertise required to distinguish a genuinely secure cryptocurrency wallet from a polished, malicious clone.
The "Safery" extension proved conclusively that attackers no longer need to successfully impersonate massive industry titans like MetaMask or Phantom. Instead, they can invent entirely new brands out of whole cloth, manufacture artificial trust signals, and construct invisible backdoors that quietly utilize public blockchains as secure couriers for stolen wealth.
Ultimately, this security breach serves as a vital reminder that forces a fundamental rethink of how trust is established in cryptocurrency user experiences, and how dangerously close to the underlying operating system even casual tools like browser extensions really operate. Crypto users frequently operate under the comforting assumption that Web3 technology inherently guarantees financial sovereignty and absolute self-custody. Yet, in the wrong hands, an unvetted browser wallet functions less like a secure digital vault and more like an open port—and the browser will not always warn you before something slips silently through.
Muslim 
Siti Muinah