By Ali Ikhwan 
For a few critical days in November, a sophisticated malicious Chrome extension managed to secure the fourth organic search result for the term “Ethereum wallet” on the official Chrome Web Store.
The deceptive extension, operating under the name “Safery: Ethereum Wallet,” presented a facade polished enough to easily fool unsuspecting users searching for a reliable way to manage their digital assets. It featured a clean, professional icon, a generic name carefully positioned adjacent to security-related language, a heavy influx of five-star reviews, and boilerplate descriptions that would look entirely familiar to anyone who has ever downloaded a legitimate cryptocurrency wallet.
However, behind this polished frontend lay a purpose-built cyberattack designed to systematically steal seed phrases and completely empty user wallets. The malicious software achieved this by ingeniously encoding stolen recovery secrets into micro-transactions executed directly on the Sui blockchain.
The threat was brought to light after Socket, a prominent security tooling company focused on open-source software supply chains, installed and analyzed the extension following its initial discovery. Their investigation aimed to uncover how "Safery" successfully evaded automated detection systems, climbed the competitive Chrome Store rankings, and exfiltrated sensitive seed phrases without raising immediate alarms, while also providing crucial insights into how users can spot similar threats in the future. The comprehensive report released by Socket walks through the attacker’s unique approach, serving simultaneously as a postmortem of the security failure and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the malicious actors did not rely on the well-trodden territory of spoofing an existing, trusted wallet brand. Unlike previous high-profile scams, Safery was not a MetaMask lookalike or a recycled phishing domain designed to trick users through typo-squatting. Instead, it invented an entirely new identity, utilized bought or botted fake reviews to artificially manipulate search rankings, and launched itself cleanly into the marketplace as a fresh, legitimate wallet option.
This calculated approach meant that the extension’s listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no bizarre or overly aggressive permissions requested, and no suspicious redirections to shady external domains. The official Chrome Web Store publisher page carried no prior user complaints, and the provided support URL directed visitors to an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s initial analysis.
Given its professional appearance, the average user would not have hesitated before clicking the "Add to Chrome" button. The extension requested permission to run on all websites—a completely standard and necessary request for crypto wallet extensions that must interact seamlessly with a wide variety of decentralized applications across the web.
Significantly, the extension did not prompt for extra, unusual permissions or attempt to inject complex content scripts that would typically trigger Chrome’s more aggressive security warnings. Its branding maintained a minimalist aesthetic, the accompanying support website matched the extension’s name precisely, and the initial setup screen simply prompted users to either create a new wallet or import an existing one, reinforcing the illusion of standard, trustworthy behavior.
The Seed Heist, Broadcast Over Sui
The true damage of the operation began the moment a user entered their seed phrase. Rather than storing the sensitive recovery phrase locally on the machine or attempting to encrypt it for user access, the extension silently fragmented the phrase into distinct pieces. It then cleverly encoded these fragments to look like completely random, innocuous wallet addresses.
Socket’s rigorous research demonstrates that these fragmented secrets were quietly inserted directly into Sui blockchain transactions. Specifically, the extension executed tiny SUI token transfers—minuscule monetary amounts designed to draw zero attention from users or automated monitors—directed toward blockchain addresses completely controlled by the attacker.
Hidden inside the metadata of those transactions, embedded securely within memo fields or obfuscated recipient addresses, were the critical pieces of the user’s master seed phrase.
This tactical approach provided the hackers with massive advantages. It completely eliminated the need for the extension to send outbound network requests to external malicious servers. There was no suspicious command-and-control beacon, nor any data exfiltration over standard HTTP or WebSockets that a traditional browser security tool or antivirus program might easily flag and block.
Instead, the payload departed the user’s device disguised as a completely normal, everyday blockchain transaction, routed safely through a widely used, low-fee blockchain network. Once successfully published on-chain, the data was publicly accessible, permitting the attacker to quietly retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep connected wallets clean without ever needing to touch the user’s device or interact with the browser again.
In practical terms, the scam repurposed the Sui blockchain itself to act as an invisible, decentralized communications channel. Because the Sui network boasts exceptionally fast confirmation times and virtually negligible transaction costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple historical examples of these seed-fragment transactions, definitively confirming the direct causal link between seed phrase entry and the subsequent loss of assets. While the actual thefts of cryptocurrency occurred off-chain—primarily on Ethereum or other Layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry them out were brazenly hidden in plain sight on an entirely separate blockchain.
Before releasing the final, highly optimized version that managed to capture top search results in the Chrome Web Store, the publisher almost certainly tested the methodology in private. Evidence uncovered during the investigation shows that earlier, preliminary builds of the software experimented with much simpler data leakage techniques before the Sui blockchain encoding method was fully refined and implemented.
By the time the active, dangerous extension was finally flagged and reported, it had accumulated a sufficient number of installations to break into Chrome’s coveted "trending" tier, which further amplified its visibility to unsuspecting users. Reports from industry observers confirmed that the Safery wallet persistently occupied top search positions for Ethereum-related queries even as growing warnings and complaints about suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying ranking logic of the Chrome Web Store search algorithm. The store’s algorithm typically weighs a combination of factors, including keyword matches, overall install counts, review velocity, average user ratings, and the recency of software updates.
Extensions that experience a sudden, sharp burst of activity and user acquisition—particularly within specialized or niche categories—can climb the rankings rapidly if their more established and better-vetted competitors are not updated with matching frequency. In this specific scenario, Safery combined a strategically chosen name that scored exceptionally well for common user search queries, a coordinated blitz of positive reviews (many of which were templated or duplicated), and a remarkably fresh upload date.
There is currently no evidence to suggest that Google performed a manual human review of the listing before it was published to the public store. Chrome Web Store policies generally subject newly submitted extensions to a brief automated scan alongside fundamental static analysis.
Deeper security scrutiny is typically reserved for extensions that request explicitly elevated permissions, such as widespread access to user tabs, system clipboards, local file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter automated flags by operating securely within isolated iframes or utilizing officially approved application programming interfaces. Safery strictly stayed within those permissible operational bounds.
Even when vigilant users raised initial concerns and attempted to report the suspicious listing, the critical time gap between the initial reports and the eventual takedown by platform administrators stretched on long enough for significant financial damage to occur. Part of this vulnerability is structural: the Chrome ecosystem does not automatically act on flagged extensions instantaneously unless there is an overwhelming consensus of reports or a match with known malware signatures.
In this case, the malicious payload consisted of heavily obfuscated JavaScript code that cleverly relied entirely on existing, legitimate blockchain infrastructure rather than communicating with external, blockable hosts. Traditional malware detection mechanisms simply failed to catch it.
This security incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency from retail users. Previous high-profile scams have included fraudulent Ledger Live applications that deceptively prompted users to input their sensitive recovery phrases, or instances where legitimate, established extensions were temporarily hijacked, allowing malicious actors to gain access to the original developer’s publishing keys.
What distinctly set the Safery incident apart was the sheer smoothness of the front-end facade combined with the total absence of traditional backend infrastructure. There was no external phishing website to take down, and no malicious command server to block; there was merely a single browser extension quietly moving user secrets onto a public blockchain and walking away.
Impacted users retained very limited recourse. For those who acted with extreme promptness, mitigating further exposure required immediately uninstalling the malicious software, revoking existing token approvals, sweeping any remaining assets to a brand-new wallet using a completely clean device, and carefully monitoring all associated blockchain addresses. For the many users who failed to notice the silent exfiltration in real time or who maintained large capital balances in vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers and independent software developers are now calling for much stronger heuristics and automated checks directly from Google. One frequently proposed solution involves automatically flagging and restricting any extension that includes user interface elements specifically designed to prompt individuals for 12- or 24-word recovery phrases.
Another recommended defensive approach is the mandatory implementation of publisher attestation for all wallet extensions. This mechanism would provide verifiable, cryptographic proof that a given publisher genuinely controls the underlying codebase associated with a recognized cryptocurrency wallet brand. Industry voices are also advocating for much tighter, more rigorous inspections of wallet-related permissions, even in cases where those extensions do not explicitly request traditionally dangerous access patterns.
For everyday cryptocurrency users, security analysts continue to publish practical checklists for better browser extension management. Before installing any crypto-related browser tool, users are strongly advised to thoroughly review the publisher’s history, verify explicit associations with known and trusted open-source projects, inspect review patterns for artificial bursts of identical text, check for legitimate website links backed by public GitHub code repositories, and scrutinize the permissions tab for vague or overly sweeping system access.
As this incident clearly demonstrates, possessing a clean name and a high star rating on an official software marketplace is simply no longer enough to guarantee safety. The event raises profound, broader questions regarding the fundamental safety of using web browsers as the primary interface for decentralized finance. Browser wallets achieved widespread popularity primarily due to their accessibility and user-friendly nature, enabling individuals to interact seamlessly with decentralized applications without the friction of switching platforms or downloading standalone desktop applications.
However, that accessibility has come at the severe cost of heightened exposure. The modern web browser remains a fundamentally high-risk environment subject to continuous threats, including extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based exfiltration.
Cryptocurrency wallet developers are now expected to seriously rethink their long-term distribution models. While some cautious development teams already discourage the use of Chrome Web Store installations entirely—preferring dedicated mobile applications or standalone desktop binaries—others may soon implement automated warnings for users attempting to install software from unverified sources.
Ultimately, the core problem persists: software distribution remains heavily fragmented, and the average user lacks the technical expertise required to distinguish a genuinely legitimate wallet from a brilliantly polished clone. The Safery extension proved that attackers no longer need to impersonate established giants like MetaMask or Phantom to succeed; they can simply manufacture their own trusted brand, seed artificial trust signals, and construct an invisible digital backdoor utilizing a public blockchain as a courier.
This reality demands a profound industry-wide reassessment of how trust is established in cryptocurrency user experiences, and serves as a sobering reminder of how close to the metal even casual tools like browser extensions truly operate.
Raul Delapena Setiawan 
Muslim 
Siti Muinah