By Jia Lissa 
For several days in November, a malicious browser extension masquerading as a crypto wallet climbed the rankings to secure the fourth position for the search query “Ethereum wallet” on the Chrome Web Store. The extension, titled “Safery: Ethereum Wallet,” was crafted with enough visual polish and professional design to easily deceive unsuspecting users looking for a secure tool to manage their digital assets. It featured a clean, professional icon, a generic name paired with security-oriented terminology, a massive influx of five-star reviews, and standard descriptions that closely mirror legitimate applications in the decentralized finance ecosystem.
Beneath this polished exterior, however, lay a purpose-built cyberattack mechanism. The extension was engineered to intercept seed phrases and systematically drain user wallets by secretly encoding stolen sensitive information into micro-transactions executed on the Sui blockchain. Security tooling company Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its public discovery.
The primary objective of Socket’s investigation was to understand how "Safery" managed to evade automated detection systems, successfully manipulate the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without triggering immediate security alerts. Furthermore, the analysis sought to provide actionable insights into what users could do to identify and protect themselves against similar emerging threats. The resulting report serves as both a detailed postmortem of the incident and a stark warning that browser extensions continue to represent a dangerous and frequently overlooked blind spot in cryptocurrency security.
This particular case stands out within the cybersecurity landscape because the threat actors did not rely on traditional spoofing techniques. While stealing seed phrases is an unfortunately common occurrence in the digital asset sector, Safery did not impersonate an existing, established wallet brand. It was neither a MetaMask lookalike nor a recycled phishing domain designed to catch typos. Instead, the attackers invented a completely novel identity, utilized purchased or automated bot reviews to artificially boost search rankings, and launched the software as a brand-new, independent wallet option.
This strategic approach ensured that the store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious permission requests, and no automatic redirection to shady or unverified external domains. The Chrome Web Store publisher page had no prior history of complaints, and the provided support URL directed users to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s analysis.
Given its professional appearance, the average user would likely experience very little hesitation before clicking the “Add to Chrome” button. Like many standard crypto tools, the extension requested permission to run across all websites, a standard functional requirement for wallets that need to interact seamlessly with various decentralized applications. Notably, the software did not prompt for excessive additional privileges or attempt to inject content scripts that would typically provoke more aggressive security warnings from the browser. The branding remained minimalist, the accompanying website mirrored the name of the extension, and the initial setup interface naturally prompted users to either create a new wallet or import an existing one, matching standard industry behavior entirely.
The Seed Heist, Broadcasted Over Sui
The true damage of the operation began the moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or encrypting it securely for user access, the extension silently fragmented the phrase into smaller pieces and encoded them to resemble random cryptocurrency wallet addresses.
Data recovered during Socket’s research demonstrated that these fragments were deliberately embedded directly into Sui blockchain transactions. Specifically, the extension initiated tiny, minuscule transfers of SUI tokens—amounts so negligible that they would never draw attention—directed toward addresses completely controlled by the attacker. Hidden meticulously inside these transactions, either within designated memo fields or through obfuscated address routing, were the exact segments of the victim’s seed phrase.
This tactical execution offered significant advantages for the threat actors. Crucially, it eliminated the need for the extension to send outbound network requests to malicious command-and-control servers. There was no external beaconing activity, and no data exfiltration occurred over standard HTTP protocols or WebSockets that a traditional browser security filter or antivirus program might flag as suspicious.
Instead, the payload left the user’s device disguised as a completely normal blockchain transaction, routed smoothly through a widely utilized, low-fee blockchain network. Once successfully recorded on-chain, the sensitive data became publicly accessible, enabling the attacker to retrieve it at their convenience, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to interact with the victim’s device a second time.
In effect, the scammers repurposed the Sui blockchain itself to function as a covert communications channel. Because the Sui network offers rapid transaction confirmation times and virtually negligible fees, it operated with the efficiency of a low-latency message bus. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct correlation between seed entry and subsequent asset loss. While the actual thefts took place off-chain—primarily targeting Ethereum and other Layer-1 networks where the victims maintained significant asset balances—the instructions necessary to execute the thefts were hidden entirely in plain sight.
Before releasing the final version that successfully captured top placement in Chrome’s wallet search results, the publisher likely tested the methodology in private development environments. Digital evidence indicates that earlier experimental builds experimented with simpler data leakage techniques before the Sui encoding process was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated a sufficient installation base to secure a spot in Chrome’s “trending” category, which further amplified its visibility to unsuspecting users. Reports from alternative crypto media outlets confirmed that the Safery wallet remained prominently featured among top results for Ethereum wallet searches even as growing warnings circulated across communities on Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension relied heavily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm evaluates multiple metrics, including keyword matches, total installation counts, review velocity, average star ratings, and the recency of the last software update.
Extensions that experience a sudden surge in user activity, particularly within specialized or niche categories, can climb rapidly through the search results if established competitors are not updated with equal frequency. In this scenario, Safery combined a highly optimized name for common search queries with a coordinated blitz of positive reviews—many of which were templated or duplicated—and a very recent upload date.
There is no evidence to suggest that Google manually reviewed this specific listing prior to its publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief automated scan and basic static analysis. Deeper scrutiny is typically reserved for extensions that request elevated or sensitive permissions, such as broad access to browser tabs, the system clipboard, the local file system, or user browsing history.
Wallet extensions frequently bypass these stringent automated flags by operating neatly within isolated iframes or utilizing officially approved application programming interfaces. Safery strictly maintained its operations within these permitted boundaries.
Even when vigilant users raised initial concerns about the extension’s behavior, the operational lag between initial reporting and eventual removal from the store stretched out long enough for substantial financial damage to occur. Part of this delay is structural, as the browser platform does not automatically deactivate flagged extensions instantly unless there is an overwhelming consensus of reports or a verified malware signature. Because the payload consisted of obfuscated JavaScript relying entirely on legitimate blockchain infrastructure rather than external malicious hosts, traditional automated malware detection mechanisms failed to catch it.
This incident is far from the first time browser extensions have been weaponized to target cryptocurrency assets. Previous security incidents have involved fraudulent Ledger Live desktop applications prompting users to enter recovery phrases, or compromised legitimate extensions where attackers managed to hijack the original developer’s publishing credentials.
What distinguishes the Safery incident is the exceptional smoothness of the facade and the near-total absence of traditional backend infrastructure. There was no external phishing website that authorities could easily take down, and no centralized command server to block; instead, there was simply a single browser extension quietly moving secrets onto a public distributed ledger and disappearing.
Impactful countermeasures remained available to users who acted with extreme speed. Those who recognized the threat early could limit their exposure by rapidly rotating their seed phrases and revoking outstanding transaction approvals across various decentralized finance protocols.
Socket and other security researchers published comprehensive triage steps for anyone who had installed the extension: immediately uninstall the software, revoke all associated token approvals, transfer remaining assets to a completely new wallet created on a secure, clean device, and closely monitor the compromised addresses. For users who failed to notice the silent data exfiltration or who maintained substantial capital in vulnerable hot wallets, financial recovery remained highly unlikely.
Security experts and independent developers are now increasing pressure on platform operators to implement stronger protective heuristics directly within the Chrome environment. One prominent proposal involves automatically flagging and restricting any extension that incorporates user interface elements explicitly designed to prompt users for a 12-word or 24-word recovery phrase.
Another suggested defense mechanism is the implementation of mandatory publisher attestation requirements for all wallet-related extensions, providing cryptographic proof that a listed publisher genuinely controls the underlying codebase of a recognized project. Furthermore, calls have grown louder for much tighter regulatory inspection of wallet permissions, even when those permissions do not explicitly involve conventionally dangerous access patterns.
For end users, security firms continue to advocate for rigorous evaluation practices before installing any browser-based extension. Before integrating a crypto tool, users are advised to thoroughly investigate the publisher’s background history, verify direct association with a publicly recognized project, scrutinize review patterns for unnatural bursts of identical feedback, cross-reference official websites with verified public repositories, and carefully inspect the permissions tab for sweeping or vaguely defined system access. A clean appearance and high initial ratings are no longer sufficient guarantees of safety.
This developing situation raises profound, broader questions regarding the fundamental role of the traditional web browser within the broader cryptocurrency ecosystem. Browser-based wallets originally gained widespread popularity due to their unmatched accessibility and ease of use, enabling individuals to interact effortlessly with decentralized applications without requiring platform switching or the installation of standalone desktop applications.
However, that high degree of accessibility has inevitably come at the expense of heightened exposure. The modern web browser remains an inherently high-risk computing environment susceptible to extension manipulation, session hijacking, clipboard scraping, and now covert blockchain-based data exfiltration.
As a result, wallet developers are increasingly expected to reconsider their primary distribution models. Several security-conscious development teams already actively discourage users from relying on Chrome Web Store installations, favoring dedicated mobile applications or standalone desktop binaries instead. Others may soon introduce automated warnings for users attempting to download and install software from unverified sources.
The underlying challenge persists: software distribution remains heavily fragmented, and the average user lacks the technical expertise necessary to easily distinguish a legitimate, secure wallet from a professionally executed clone. The Safery extension demonstrated that malicious actors no longer need to impersonate dominant brands like MetaMask or Phantom to succeed. By engineering an entirely independent brand, manufacturing artificial trust signals, and utilizing an alternative blockchain network as an invisible courier, the attackers bypassed traditional defenses entirely. This development underscores an urgent need to reevaluate how trust is established within cryptocurrency user experiences and highlights the vulnerability of relying solely on browser utilities for digital asset management.
Raul Delapena Setiawan 
Muslim 
Siti Muinah