By Nila Kartika Wati 
For a few critical days in November, a malicious browser extension disguised as a cryptocurrency management tool managed to rank as the fourth search result for the phrase “Ethereum wallet” on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was crafted with enough visual polish and professional presentation to easily pass as a legitimate piece of software in the eyes of unsuspecting digital asset holders. It featured a clean, modern icon, a generic name carefully positioned adjacent to security-related terminology, a sudden and heavy influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a decentralized finance application or crypto wallet.
However, behind that polished frontend interface lay a purpose-built, highly sophisticated cyberattack designed to systematically steal user seed phrases and completely empty digital wallets. Instead of relying on traditional external command-and-control servers that could be easily monitored, blocked, or flagged by antivirus software, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
Security tooling company Socket, which focuses heavily on open-source software supply chains, installed and closely analyzed the extension immediately after its malicious nature was uncovered. The primary objective of their investigation was to understand how “Safery” successfully evaded automated detection, climbed rapidly through the Chrome Store rankings, and exfiltrated sensitive seed phrases without raising immediate alarms, as well as to determine what proactive steps users could take to identify and protect themselves against similar threats. The resulting security report walks through the attacker’s innovative approach, serving simultaneously as a postmortem examination and a stark warning that browser extensions continue to represent a dangerous and frequently overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy to cybersecurity analysts is the fact that the hackers behind the scheme did not simply spoof an existing, well-known wallet brand. Unfortunately, the impersonation of established protocols like MetaMask or the use of recycled phishing domains has long been well-trodden territory in the crypto threat landscape. Instead, Safery invented an entirely new digital identity, acquired or generated a large volume of fake reviews to artificially inflate its search rankings, and launched itself cleanly as a completely "new" wallet option for everyday users.
This tactical choice meant that the extension’s store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious or overly broad permissions requested upfront, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page possessed no prior consumer complaints, and its designated support URL led directly to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s initial analysis.
Given its highly polished appearance and professional layout, the average user would likely have felt little to no hesitation before clicking the "Add to Chrome" button. Upon installation, the extension requested permission to run on all websites, which is an entirely standard and common operational requirement for crypto wallets that need seamless integration with various decentralized applications across the web. Notably, it refrained from prompting users for extra, unnecessary permissions or attempting to inject complex content scripts that would typically trigger more aggressive warnings from Google Chrome’s built-in security systems. The branding throughout the interface was minimalist, the associated website matched the exact name of the extension, and the initial setup screen naturally prompted users to create or import a wallet—once again mimicking completely standard behavior for legitimate software.
The Seed Heist, Broadcast Transparently Over Sui
The true damage of the operation began the moment a user entered their recovery seed phrase into the interface. Rather than storing the phrase locally on the machine or properly encrypting it for authorized user access, the malicious extension silently split the sensitive recovery text into multiple fragments. It then cunningly encoded these fragments so that they appeared to be nothing more than random, ordinary cryptocurrency wallet addresses.
Detailed research conducted by Socket revealed that these hidden fragments were deliberately inserted directly into live Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—amounts so vanishingly small that they would never draw the attention of casual observers or automated monitors—sending them directly to various addresses under the absolute control of the attacker. Hidden safely inside those transactions, either tucked away neatly within memo fields or obfuscated directly inside the transaction addresses themselves, were the precise pieces of the victim’s seed phrase.
This inventive approach offered substantial tactical advantages to the malicious actors. It entirely eliminated the need for the browser extension to send suspicious outbound network requests to unknown malicious servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration conducted over standard HTTP or WebSockets protocols that a modern browser or endpoint security solution might easily flag and intercept.
Instead, the malicious payload left the user’s local device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee layer-1 network. Once successfully logged on-chain, the sensitive data became publicly accessible, enabling the attacker to retrieve the transaction details at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the sophisticated scam utilized the Sui blockchain itself as an unconventional communications channel. Because the Sui network boasts extremely fast confirmation times and negligible transaction costs, it functioned flawlessly as a low-latency message bus for the perpetrators. Socket successfully traced multiple historical examples of these seed-fragment transactions and definitively confirmed the direct link between the initial entry of a seed phrase in the fake browser extension and the eventual loss of digital assets. While the actual thefts of funds occurred off-chain—predominantly on Ethereum or other layer-1 networks where the victims’ wallets maintained substantial balances—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before finally releasing the polished version that eventually landed prominently in Chrome’s top wallet search results, the publisher almost certainly tested the underlying methodology in private environments. Digital forensics and historical data show that earlier, rudimentary builds experimented with much simpler data leaks before the Sui encoding mechanism was thoroughly refined. By the time the active, dangerous extension was formally flagged by security researchers, it had already accumulated enough active installations to surge into Chrome’s “trending” tier, which further amplified its visibility to prospective victims. Reports confirmed that the Safery wallet managed to maintain its position among the top results for Ethereum wallet searches even as mounting reports of suspicious behavior and asset drain began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged directly on the specific mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm heavily weighs factors such as exact keyword matches, total install counts, review velocity, average user ratings, and the recency of software updates. Browser extensions that experience a sudden, sharp burst of activity and downloads, particularly within niche categories, can climb rapidly through the directory if better-vetted, established competitors are not updated with equal frequency. In this particular instance, Safery benefited from a title that scored exceptionally well for common user search queries, a coordinated blitz of positive reviews featuring templated or duplicated phrasing, and a very fresh upload date.
Available evidence does not indicate that Google manually reviewed this specific listing prior to its public publication. Chrome Web Store policies typically subject most new extension submissions to a brief automated scan alongside fundamental static analysis. Extensions generally only undergo much deeper manual scrutiny when they request highly elevated permissions, such as widespread access to user tabs, system clipboards, local file systems, or browsing history. Because crypto wallet extensions frequently manage to bypass these specific warning flags by operating securely within isolated iframes or utilizing officially approved developer APIs, Safery was able to stay safely within those structural bounds.
Even after concerned users began raising alarm bells, the critical window of time between initial reporting and the eventual takedown by store administrators stretched on long enough for significant financial damage to occur. Part of this persistent lag is structural: the Chrome platform typically does not act on flagged extensions instantaneously unless there is an overwhelming consensus of danger or the detection of explicitly known malware signatures. In this case, because the payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external malicious hosts, traditional automated malware detection methods completely failed to catch it.
This incident is far from the first time that browser extensions have been maliciously exploited to target cryptocurrency holders. Previous historical scams have included fraudulent Ledger Live companion applications that prompted unsuspecting users to enter their master recovery phrases, as well as compromised legitimate extensions where attackers managed to hijack the original developer’s publishing credentials. What fundamentally distinguished Safery from past efforts, however, was the remarkable smoothness of its digital facade and the total absence of traditional backend infrastructure. There was no centralized phishing website that authorities could easily take down, and no external command server to block; there was simply a single browser extension quietly moving sensitive secrets onto a public blockchain and walking away.
Impacted users still retained a narrow window of recourse. For those who acted swiftly upon discovering the compromise, mitigating steps included immediately uninstalling the extension, actively revoking all existing token and smart contract approvals, sweeping remaining digital assets to a brand-new wallet generated on a completely clean device, and closely monitoring associated public addresses for unauthorized activity. However, for users who failed to notice the silent exfiltration in time, or for individuals who stored substantial wealth in vulnerable hot wallets, asset recovery remained highly improbable.
The Real Trouble Begins Before the Wallet Ever Loads
In the wake of this security failure, independent researchers and blockchain developers are renewing fervent calls for stronger, more proactive heuristics from Google Chrome itself. Among the primary proposed solutions is the implementation of an automated flagging system that would instantly freeze any extension containing user interface elements designed to prompt for standard 12- or 24-word recovery phrases.
Another prominent recommendation involves requiring strict publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the underlying codebase behind a recognized wallet brand. Furthermore, security experts are advocating for much tighter, more rigorous inspections of wallet-related permissions, even in instances where those permissions do not explicitly incorporate traditionally dangerous access patterns.
For everyday end users, Socket published a comprehensive and practical checklist focused on safe browser extension management. Before installing any cryptocurrency-related extension, users are strongly advised to thoroughly review the publisher’s historical track record, verify official associations with known and trusted open-source projects, carefully inspect review patterns for artificial anomalies like sudden bursts of identical text, confirm the existence of legitimate, active websites linked to public GitHub repositories, and scrutinize the permissions tab for vague or overly sweeping system access. As the Safery incident clearly demonstrates, possessing a clean name and a superficially high rating is no longer enough to guarantee safety.
This alarming case raises much broader, more fundamental questions regarding the browser’s expanding role as a primary gateway for cryptocurrency management. Browser-based wallets originally gained widespread popularity due to their exceptional accessibility and ease of use, allowing everyday people to interact seamlessly with complex decentralized applications without needing to switch operating platforms or download standalone desktop applications.
However, that profound accessibility has come at a severe cost to user security and exposure. The modern web browser remains an inherently high-risk environment that is continually subjected to malicious extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
Consequently, many wallet developers are expected to fundamentally rethink their primary distribution models going forward. Some cautious development teams already actively discourage users from installing software via the Chrome Web Store, strongly preferring dedicated mobile applications or standalone desktop binaries instead. Other projects may soon introduce native warnings within their ecosystems whenever users attempt to install wallet software originating from unverified or unrecognized web sources.
Ultimately, the core underlying problem remains stubbornly persistent: software distribution across major web stores is highly fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a genuinely legitimate crypto wallet from a polished, malicious clone. The Safery extension proved conclusively that attackers no longer need to successfully masquerade as dominant market leaders like MetaMask or Phantom. By simply creating an entirely independent brand, seeding artificial trust signals, and constructing an invisible backdoor that utilized a public blockchain as an efficient courier, they managed to bypass traditional defenses entirely. This development demands a thorough reassessment of how trust is established within crypto user experiences, and just how close to the metal everyday tools like browser extensions truly operate.
Raul Delapena Setiawan 
Muslim 
Siti Muinah