By Sagoh 
For a brief period last November, a sophisticated and malicious software application disguised as a crypto asset manager managed to infiltrate the upper echelons of the official Chrome Web Store. The extension, deceptively titled “Safery: Ethereum Wallet,” climbed to the fourth position in search results for the high-volume query “Ethereum wallet,” presenting a polished and trustworthy appearance that successfully bypassed initial automated detection systems and fooled unsuspecting digital asset investors.
The application’s frontend was meticulously designed to mimic standard security-focused software. It featured a clean, professional icon, a generic name paired with security-adjacent terminology, an influx of five-star reviews, and boilerplate descriptions that closely mirror legitimate cryptocurrency tools. Behind this carefully constructed facade, however, lay a purpose-built cyberattack designed to harvest user seed phrases and systematically drain victim wallets by encoding sensitive data into micro-transactions executed on the Sui blockchain.
Following the discovery of the fraudulent listing, security tooling company Socket, which specializes in open-source software supply chains, installed and analyzed the extension. The objective of their investigation was to determine how Safery managed to evade detection, manipulate the Chrome Store ranking algorithm, and exfiltrate sensitive recovery phrases without raising automated alarms, while also providing actionable insights for users trying to identify similar threats. The resulting technical report acts as both a postmortem of the incident and a stark warning that browser extensions remain a dangerous and frequently overlooked blind spot within the broader cryptocurrency ecosystem.
What distinguishes this incident from standard phishing campaigns is that the threat actors did not attempt to spoof an existing, well-known wallet brand. The creators of Safery did not rely on a MetaMask lookalike interface or a recycled phishing domain designed to catch typographical errors. Instead, they invented an entirely new brand identity, cultivated artificial trust by purchasing or generating botted fake reviews to manipulate search visibility, and launched the application as a legitimate alternative option in the market.
This strategic approach ensured that the store listing displayed virtually no immediate red flags. There was no broken grammar, no request for bizarre or overly aggressive permissions, and no suspicious redirection to external, unverified websites. The publisher page on the Chrome Web Store had no prior complaints registered against it, and its designated support URL directed traffic to an off-platform site that security trackers had not flagged at the time of Socket’s analysis.
Given its polished interface and professional presentation, the average user had little reason to hesitate before clicking the prompt to add the software to their browser. The extension requested permission to run on all websites, a standard operational requirement for cryptocurrency wallets that need to interact dynamically with decentralized applications across the web. Crucially, the software did not prompt users for elevated system permissions or attempt to inject complex content scripts that might have triggered the more aggressive warnings built into Google Chrome. The branding remained minimalist, the accompanying website mirrored the name of the extension precisely, and the initial setup screen guided users through the standard process of creating a new wallet or importing an existing one.
The real damage commenced the moment a user entered their recovery seed phrase. Rather than storing the phrase locally or securely encrypting it for user accessibility, the extension silently fragmented the secret text and encoded the individual pieces into what appeared to be completely random wallet addresses. Socket’s research revealed that these fragments were embedded directly into transactions on the Sui blockchain. Specifically, the malicious software initiated minuscule SUI token transfers—amounts so small they were virtually guaranteed to draw zero attention—directed toward addresses completely controlled by the attacker.
Concealed within these micro-transactions, either hidden inside memo fields or cleverly obfuscated within the recipient addresses themselves, were the discrete components of the victim’s seed phrase. This tactical methodology offered significant advantages to the perpetrators. By routing the data through a blockchain network, the extension eliminated the need to send outbound network requests to malicious external servers. There was no command-and-control beacon communicating over HTTP or WebSockets that a traditional web browser or local antivirus scanner could easily flag or intercept.
Instead, the stolen data exited the user’s device disguised as a completely normal, legitimate blockchain transaction, routed seamlessly through a widely used, low-fee layer-one network. Once published on-chain, the data became publicly accessible, allowing the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to interact with the victim’s device again. In effect, the malicious actors repurposed the Sui blockchain itself as a covert communications channel. Because the Sui network offers rapid transaction confirmation times and negligible fees, it functioned essentially as a low-latency message bus for the operation.
Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct link between entering a seed phrase into the fake extension and the subsequent loss of funds. While the actual asset thefts occurred off-chain on Ethereum or various other layer-one networks where the victims maintained balances, the architectural instructions required to execute the thefts were hidden in plain sight on an entirely separate blockchain. Evidence uncovered by researchers suggests the publisher likely tested the methodology in private prior to releasing the version that achieved prominent search placement in the Chrome store, as earlier, simpler builds experimented with alternative data-leak techniques before the Sui encoding mechanism was perfected.
By the time the active extension was finally flagged and reported by vigilant community members, it had accumulated enough installations to secure a coveted spot on Chrome’s trending tier, which further amplified its visibility. Reports circulated across platforms like Reddit and Telegram as affected users noticed unauthorized outflows, even as the Safery wallet maintained its top position for searches related to Ethereum wallets.
The rapid rise and success of the Safery extension highlighted underlying vulnerabilities in the ranking logic of the Chrome Web Store. The store’s search algorithm heavily weighs keyword matching, total installation counts, review velocity, average user ratings, and the recency of software updates. Applications experiencing a sudden surge of activity, particularly within niche categories characterized by less frequent updates from established competitors, can ascend the rankings rapidly. Safery leveraged a high-scoring name for common search queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a recently published upload date to game the system successfully.
There is no evidence to suggest that Google manually reviewed the listing prior to publication. Policies governing the Chrome Web Store typically subject new extensions to a brief automated scan and basic static code analysis. Deeper scrutiny is generally reserved for extensions that request highly sensitive or elevated permissions, such as direct access to browser tabs, the system clipboard, local file systems, or browsing history. Wallet extensions frequently circumvent these trigger warnings by operating within isolated iframes or utilizing officially approved application programming interfaces, boundaries that Safery carefully respected.
Even after users began raising alarms in community forums, the time elapsed between the initial reports and the eventual takedown of the extension stretched long enough for substantial financial damage to occur. Part of this lag is structural, as the browser platform typically does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or a positive identification of known malware signatures. Because the payload consisted of obfuscated JavaScript relying entirely on existing blockchain infrastructure rather than external host servers, traditional malware detection routines failed to catch it in time.
Security experts and developers have since called for the implementation of stronger heuristics by Google to prevent similar incidents. Proposed defenses include automatically flagging any extension that features user interface elements prompting for a standard twelve or twenty-four-word recovery phrase. Additional recommendations involve requiring strict publisher attestation for wallet extensions, providing cryptographic proof that a given publisher genuinely controls the codebase behind an established wallet brand, and tightening the inspection of permissions requested by financial applications.
For end users, security organizations have emphasized the importance of rigorous vetting procedures. Before installing any cryptocurrency-related browser extension, individuals are advised to thoroughly review the publisher’s history, verify direct associations with recognized projects, inspect review patterns for artificial bursts of identical text, confirm the existence of legitimate official websites backed by public code repositories, and carefully evaluate requested permissions. The presence of a clean name and high user ratings can no longer be relied upon as definitive proof of safety.
The incident underscores the broader security trade-offs inherent in browser-based cryptocurrency management. While web-accessible wallets achieved widespread popularity due to their convenience and ease of use—allowing users to interact seamlessly with decentralized applications without switching platforms—that accessibility has come at the cost of exposure to sophisticated threats. As malicious actors continue to innovate, finding new ways to exploit traditional distribution channels and infrastructure, both developers and users are forced to reevaluate the assumptions of trust that underpin the modern digital asset experience.
Raul Delapena Setiawan 
Muslim 
Siti Muinah