By Azzam Bilal Chamdy 
For a few critical days in November, a deceptively polished malicious Chrome extension managed to climb the ranks of the Chrome Web Store, securing the fourth position for the heavily searched query “Ethereum wallet.” Named “Safery: Ethereum Wallet,” the application successfully masqueraded as a legitimate and secure tool for cryptocurrency users by leveraging a clean icon, generic security-adjacent terminology, a flood of five-star reviews, and boilerplate descriptions that are instantly familiar to anyone who has ever downloaded a digital asset manager. Beneath this convincing frontend, however, lay a purpose-built attack mechanism designed to harvest user seed phrases and systematically empty wallets by encoding the stolen credentials into micro-transactions on the Sui blockchain.
The sophisticated threat was brought to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its discovery. The cybersecurity company’s primary objective was to investigate how Safery managed to evade initial detection, manipulate the Chrome Store search algorithms, and exfiltrate sensitive seed phrases without triggering automated security alarms. Furthermore, the team sought to identify actionable steps users could take to spot and defend against similar browser-based threats. The resulting analytical report serves as both a detailed postmortem of the security failure and a stark warning that browser extensions remain a dangerous and frequently overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the malicious actors behind Safery did not rely on traditional spoofing techniques. Unlike previous exploits that imitated established wallet brands, created MetaMask lookalikes, or utilized recycled phishing domains, Safery forged an entirely new identity. The attackers manufactured a novel brand, purchased or deployed bot networks to flood the listing with fake positive reviews to artificially boost its search rankings, and launched the software as a completely new cryptocurrency wallet option. This strategic approach ensured that the store listing displayed virtually no immediate red flags, such as broken grammar, suspicious permission requests, or hidden redirections to malicious external domains.
Furthermore, the Chrome Web Store publisher page associated with the extension had no prior consumer complaints or historical flags. Its designated support URL directed users to an off-platform website that security trackers had not flagged at the time of Socket’s analysis. Given the remarkably polished presentation, the average internet user would have experienced little hesitation before clicking the “Add to Chrome” button. The extension requested permission to run on “all websites,” which is standard operational behavior for cryptocurrency wallets that require persistent integration with various decentralized applications across the web.
Notably, Safery refrained from prompting users for extra, intrusive permissions or attempting to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding remained minimalist, the accompanying website mirrored the extension’s name precisely, and the initial setup screen guided users through the standard process of either creating a new wallet or importing an existing one, reinforcing the illusion of authenticity.
The Seed Heist, Broadcast Over Sui
The malicious functionality activated the moment a user entered their seed phrase. Rather than storing the sensitive recovery phrase locally or securely encrypting it for authorized user access, the extension silently fragmented the phrase into smaller pieces. It then encoded these fragments to resemble random, innocuous wallet addresses. According to Socket’s technical research, these extracted fragments were quietly embedded directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so small they would naturally draw zero attention—directed toward blockchain addresses controlled entirely by the attackers.
Concealed within these low-value transactions, either hidden inside memo fields or cleverly obfuscated within the transaction addresses themselves, were the fractured components of the victim’s seed phrase. This tactical methodology provided distinct operational advantages for the hackers. Because the process relied on legitimate blockchain interactions, the extension had no need to send outbound network requests to malicious command-and-control servers. There was no suspicious HTTP or WebSocket exfiltration beacon that modern web browsers or antivirus programs are typically programmed to detect and block.
Instead, the payload departed the user’s compromised device disguised as a completely normal blockchain transaction, routed smoothly through a widely utilized, low-fee decentralized network. Once stored permanently on-chain, the fragmented data became publicly accessible. This allowed the attackers to retrieve the pieces at their leisure, reconstruct the complete seed phrase offline, and systematically sweep the victims’ associated wallets clean across various blockchain networks without ever needing to interact with the user’s device a second time.
In effect, the perpetrators utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network boasts exceptionally fast confirmation times and negligible transaction fees, it functioned flawlessly as a low-latency message bus for the stolen data. Socket successfully traced multiple instances of these suspicious seed-fragment transactions, definitively confirming the direct causal link between the entry of a seed phrase into the extension and the eventual loss of digital assets. While the actual financial thefts occurred off-chain—predominantly on Ethereum and other Layer 1 networks where the victims held substantial balances—the operational instructions required to execute the thefts were hidden in plain sight.
Evidence gathered by security researchers indicates that the publisher likely tested this novel exfiltration method in private environments before releasing the final version that successfully infiltrated Chrome’s top wallet search results. Earlier, preliminary builds experimented with simpler data leakage techniques before the Sui encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported by vigilant community members, it had already accumulated enough installations to reach the Chrome Web Store’s “trending” tier, which further amplified its visibility to unsuspecting users. Reports from industry outlets confirmed that the Safery wallet maintained its prominent placement among top results for Ethereum wallet searches even as initial warnings and alerts began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged primarily on the underlying mechanics of Chrome’s search ranking logic. The Web Store search algorithm evaluates a complex matrix of factors, including exact keyword matches, total install counts, review velocity, average user ratings, and update recency. Extensions that experience a sudden, sharp burst of user activity, particularly within specialized or niche categories, can ascend rapidly through the rankings, especially if more established and thoroughly vetted competitors are not updated frequently. In this instance, Safery capitalized on a strategic name that scored exceptionally well for high-volume search queries, backed by a coordinated blitz of positive reviews and a remarkably fresh upload date.
Crucially, available evidence indicates that Google did not subject this specific listing to a manual human review prior to publication. The standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan and fundamental static analysis. Deeper scrutiny and manual reviews are typically reserved for extensions that request elevated or inherently dangerous permissions, such as broad access to user tabs, system clipboards, local file systems, or browsing history. Because crypto wallet extensions frequently bypass these specific warning triggers by operating carefully within isolated iframes or utilizing standard, approved application programming interfaces, Safery managed to stay comfortably within permitted bounds.
Even after concerned users began noticing anomalous behavior and raising alarms, the operational lag between the initial reports and the eventual takedown by store administrators stretched on long enough for substantial financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not automatically disable or remove flagged extensions instantaneously unless there is an overwhelming consensus of abuse or clear, recognized malware signatures. Because Safery’s payload consisted of heavily obfuscated JavaScript that interacted exclusively with public blockchain infrastructure rather than external, malicious web hosts, traditional automated malware detection mechanisms failed to catch it in time.
This incident is far from the first time that browser extensions have been weaponized to target cryptocurrency holders. Historical precedents include fraudulent Ledger Live applications designed to trick users into divulging their recovery phrases, as well as compromised legitimate extensions where malicious actors successfully hijacked developer publishing keys. However, what sets the Safery incident apart is the absolute smoothness of its superficial facade and the complete absence of traditional backend infrastructure. There was no classical phishing website to shut down and no centralized command-and-control server to block—just a single browser extension quietly translating sensitive user secrets into public blockchain data and walking away undetected.
For victims who acted with extreme urgency, some limited avenues for damage mitigation existed. Quick-action responses included immediately uninstalling the malicious software, actively revoking outstanding token approvals, sweeping remaining digital assets to a freshly generated wallet utilizing an entirely clean and uncompromised device, and continuously monitoring associated blockchain addresses for further unauthorized activity. Conversely, for users who failed to notice the silent exfiltration or who maintained significant capital within vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers and blockchain developers are now intensifying calls for more sophisticated heuristic analysis from web browser operators. Among the prominent solutions proposed is the implementation of automated flags for any extension that incorporates user interface elements explicitly prompting for standard twelve- or twenty-four-word recovery phrases. Additional recommendations include enforcing mandatory publisher identity verification for all wallet extensions, which would provide cryptographically verifiable proof that a specific publisher genuinely controls the underlying codebase of a recognized project. Industry experts are also advocating for stricter inspection protocols regarding wallet-related permissions, regardless of whether those extensions request overtly dangerous system access patterns.
For end users navigating the increasingly complex Web3 landscape, security firms like Socket continue to emphasize rigorous pre-installation checklists. Experts advise individuals to thoroughly research a publisher’s historical background, independently verify official associations with recognized blockchain projects, carefully inspect review patterns for anomalous bursts of identical or templated feedback, cross-reference stated websites with public source code repositories, and scrutinize permission tabs for overly broad access requests. Ultimately, the incident underscores a sobering reality for the digital asset community: a clean name, minimalist branding, and a high user rating are no longer sufficient guarantees of safety in an environment where browser extensions operate as high-risk gateways to decentralized finance.
Raul Delapena Setiawan 
Muslim 
Siti Muinah