By Neng Nana 
For a few critical days in November, a meticulously crafted malicious Chrome extension managed to rank as the fourth result for the high-value search query “Ethereum wallet” directly on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was designed with enough visual fidelity and operational polish to easily pass as a legitimate tool to even seasoned cryptocurrency users. It featured a clean, professional icon, a generic and reassuring name juxtaposed with common security terminology, a flood of manufactured five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a standard software-based cryptocurrency wallet.
However, hidden directly behind that polished frontend was a purpose-built cyberattack specifically designed to harvest seed phrases and systematically empty unsuspecting users’ digital assets. Rather than relying on traditional methods of data exfiltration, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain, bypassing standard security monitoring tools entirely.
The campaign came to light after security tooling company Socket, which focuses heavily on securing open-source software supply chains, installed and conducted a deep analysis of the extension following its discovery in the wild. The primary objective of Socket’s investigation was to understand how “Safery” managed to evade automated and manual detection mechanisms, successfully climb the competitive Chrome Store search rankings, and covertly exfiltrate sensitive seed phrases without ever raising alarms. Furthermore, the security team sought to determine what preventative measures users could take to spot similar sophisticated threats in the future. The resulting technical report walks through the attacker’s innovative approach, serving simultaneously as a postmortem of the incident and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case especially noteworthy within the cybersecurity and blockchain communities is that the hackers behind the operation did not simply spoof an existing, trusted wallet brand. Unfortunately, impersonating established entities like MetaMask or recycling known phishing domains has become a well-trodden and thoroughly documented territory in the history of crypto crime. Instead, Safery took a far more insidious path: it invented a completely novel identity from scratch, purchased or generated a flood of automated bot reviews to rapidly climb the store’s search algorithm rankings, and launched itself cleanly as a fresh, standalone wallet option.
This calculated approach meant that the official store listing displayed virtually no immediate red flags to prospective victims. There was no broken English or awkward grammar in the descriptions, no bizarre or overly broad permission requests outside the norm, and no sudden redirections to shady, unverified external domains. The official Chrome Web Store publisher page attached to the listing had zero prior history of complaints, and its designated support URL led directly to a professional off-platform website that had not yet been flagged by any external security trackers at the time Socket initiated its analysis.
Given its remarkably polished and professional appearance, the average internet user would likely not have hesitated for even a single second before clicking the prominent “Add to Chrome” button. Like many standard web3 tools, the extension requested permission to run on “all websites,” a universally accepted and necessary requirement for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, it did not prompt users for extra, suspicious permissions, nor did it attempt to inject aggressive content scripts that would typically trigger Chrome’s more sensitive and prominent security warnings. The overall branding remained strictly minimalist, the accompanying support website matched the exact name of the extension, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one—behavior that is entirely standard across the industry.
The real financial damage began almost immediately once an unsuspecting user entered their recovery seed phrase. Instead of storing the sensitive phrase locally on the machine or encrypting it for legitimate user access, the malicious extension silently split the text string into smaller fragments. It then cleverly encoded these fragments so that they appeared to be nothing more than random, ordinary cryptocurrency wallet addresses.
According to Socket’s in-depth research, these fragmented pieces were systematically inserted into actual Sui blockchain transactions. Specifically, the extension autonomously issued tiny, negligible SUI token transfers—amounts so infinitesimally small that they would never draw the attention of the user or network monitors—to specific addresses directly controlled by the attacker. Hidden safely inside those innocuous-looking transactions, either tucked away inside memo fields or embedded via obfuscated destination addresses, were the exact recovery components of the user’s seed phrase.
This tactical approach provided significant operational advantages to the threat actors. Crucially, it meant that the extension did not need to send any outbound network requests to malicious command-and-control servers. There was no suspicious beaconing, and no data exfiltration over standard HTTP protocols or WebSockets that a traditional web browser, firewall, or antivirus software package might intercept and flag as hostile.
Instead, the payload seamlessly left the user’s compromised device disguised as a completely normal, everyday blockchain transaction, expertly routed through a widely used, low-fee layer-1 network. Once safely recorded on-chain, the fragmented data became publicly accessible, allowing the malicious actors to quietly retrieve it at their convenience, reconstruct the complete seed phrase offline, and systematically sweep the victims’ multi-chain wallets clean without ever needing to touch the user’s device again.
In effect, the sophisticated scam utilized the Sui blockchain itself as a covert communications channel. Because the Sui network boasts extremely fast confirmation times and negligible transaction costs, it functioned perfectly as a low-latency, highly efficient message bus for the attackers.
Socket’s analysts successfully traced multiple examples of these unique seed-fragment transactions on-chain, definitively confirming the direct technical link between the initial entry of a seed phrase into the extension and the subsequent, unauthorized loss of assets. While the actual thefts ultimately occurred off-chain—predominantly on Ethereum and other major layer-1 networks where the victims’ wallets conveniently held substantial funds—the precise instructions required to carry out the heists were hidden entirely in plain sight.
Before releasing the polished version that eventually conquered Chrome’s top wallet search results, the publisher almost certainly tested and refined this methodology in private. Digital forensics and historical data show that earlier, less visible builds experimented with simpler data-leaking mechanisms before the Sui encoding technique was finally perfected. By the time the active, malicious extension was finally identified and flagged by security researchers, it had accumulated enough total installs to comfortably reach Chrome’s coveted “trending” tier, which served to further boost its organic visibility and attract even more victims. Industry tracking reports highlighted the alarming reality that the Safery wallet continued to sit comfortably among the top recommended results for Ethereum wallet searches even as mounting reports of suspicious account drainings began circulating actively across public forums like Reddit and Telegram.
The ultimate success of the Safery extension hinged almost entirely on the specific mechanics of Chrome’s internal ranking logic. The Chrome Web Store search algorithm heavily weighs factors such as precise keyword matching, total install counts, review velocity, average user ratings, and the recency of software updates. Browser extensions that experience a sudden, manufactured burst of activity, particularly within niche categories where established competitors are not updated frequently, can climb the rankings at an alarming rate. In this specific scenario, Safery possessed a strategically chosen name that scored exceptionally well for common user queries, a blitz of positive reviews—many of which were clearly templated or duplicated—and a very fresh upload date that signaled active maintenance to the automated system.
There is currently no evidence to suggest that Google manually reviewed the listing prior to publication. The standard Chrome Web Store policy subjects most newly submitted extensions to a relatively brief automated security scan accompanied by fundamental static analysis. Extensions typically only undergo much deeper manual and automated scrutiny when they request highly elevated permissions, such as continuous access to browser tabs, the system clipboard, local file systems, or complete browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating safely within iframes or by utilizing officially approved browser APIs, and Safery expertly stayed well within those established regulatory bounds.
Even after concerned users began raising alarms and reporting suspicious behavior, the critical time gap between the initial reports and the eventual takedown by store administrators stretched on long enough for substantial financial damage to occur. Part of this persistent lag is structural: the Chrome ecosystem does not automatically disable or remove flagged extensions instantaneously unless there is an overwhelming consensus of abuse or a recognized, hardcoded malware signature matching existing databases. In this specific instance, the malicious payload consisted entirely of heavily obfuscated JavaScript that cleverly relied on public blockchain infrastructure rather than external, malicious hosts, meaning traditional signature-based malware detection methods simply failed to catch it.
This security failure is part of a broader, ongoing trend regarding the exploitation of browser extensions to steal cryptocurrency assets. Previous high-profile scams have involved fake Ledger Live desktop and browser applications prompting unsuspecting users to type their private recovery phrases directly into web interfaces, or compromised legitimate extensions where attackers managed to hijack the original developer’s publishing keys. What truly distinguished Safery from previous attacks was the exceptional smoothness of its user-facing facade and the complete absence of traditional backend hosting infrastructure. There was no malicious phishing website to take down, and no external command server to block—just a single, standalone extension quietly translating sensitive user secrets into public blockchain transactions and walking away without a trace.
For affected users who realized they had fallen victim to the trap, recourse was severely limited, though immediate action could sometimes mitigate further losses. Security firms like Socket promptly published urgent triage steps for anyone who had installed the extension: uninstall the software immediately, revoke all outstanding smart contract token approvals, securely transfer any remaining assets to a fresh, uncompromised wallet using an entirely clean device, and continuously monitor the associated addresses for anomalous activity. For users who failed to notice the covert exfiltration in time, or for those who stored large amounts of capital directly in vulnerable hot wallets, asset recovery remained virtually impossible.
In the wake of the incident, security researchers, developers, and industry experts are calling for significantly stronger heuristics directly from Google and other browser manufacturers. One widely discussed proposal involves automatically flagging and quarantining any extension that includes user interface elements prompting for a standard 12-word or 24-word recovery phrase. Another suggested defense mechanism is the mandatory implementation of publisher attestation protocols for all wallet-related extensions, which would provide cryptographically verifiable proof that a given software publisher genuinely controls the underlying codebase associated with a recognized wallet brand. Furthermore, there are growing industry demands for much tighter inspection of wallet-related permissions, ensuring that even extensions lacking overtly dangerous access patterns are subjected to rigorous scrutiny.
For everyday cryptocurrency users, security firms continue to emphasize practical checklists for safe digital asset management. Before installing any crypto-related browser extension, users are strongly advised to thoroughly investigate the publisher’s historical track record, verify official associations with recognized open-source projects, carefully inspect review patterns for obvious bursts of identical or templated text, cross-reference official website links with public code repositories like GitHub, and meticulously scan the permissions tab for vague or sweeping access requests. Ultimately, industry experts warn that a clean aesthetic, a professional name, and a high star rating are simply no longer enough to guarantee safety.
This troubling incident raises broader, fundamental questions regarding the prominent role that web browsers play in the modern cryptocurrency landscape. Browser-based wallets gained widespread popularity primarily due to their accessibility and ease of use, enabling individuals to interact smoothly with complex decentralized applications without needing to switch platforms or download standalone desktop applications. However, that vital accessibility has come at a severe cost to overall security exposure. The standard web browser remains a notoriously high-risk environment that is continually subject to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As a result, major wallet developers are widely expected to re-evaluate their primary distribution models moving forward. Some development teams already actively discourage users from relying on Chrome Web Store installations, preferring instead to direct communities toward dedicated mobile applications or standalone desktop binaries. Others may soon implement prominent, native warning systems for users attempting to install software from unverified or newly minted sources.
Nevertheless, the core systemic problem persists: software distribution across the web remains heavily fragmented, and the vast majority of everyday users simply lack the technical expertise required to distinguish a genuinely legitimate web3 wallet from a polished, malicious clone. The Safery extension proved conclusively that attackers no longer need to successfully impersonate industry giants like MetaMask or Phantom; they can simply invent an entirely new brand, seed artificial trust signals into public marketplaces, and construct an invisible backdoor that utilizes an independent blockchain as a silent courier. This reality demands a comprehensive rethinking of how trust is established in cryptocurrency user experiences, and just how close to the metal even casual tools like browser extensions really operate. Crypto users frequently operate under the assumption that the ethos of web3 guarantees absolute digital sovereignty and self-custody. Yet, in the wrong hands, an unvetted browser wallet functions less like a secure financial vault and more like an open port—and the browser will not always warn you before something slips through.
Raul Delapena Setiawan 
Muslim 
Siti Muinah