By Muslim 
For several days last November, a malicious browser extension masquerading as a crypto utility managed to secure the fourth spot in search results for the term "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively titled "Safery: Ethereum Wallet," was designed with enough professional polish to easily pass as a legitimate piece of software in the eyes of unsuspecting users. It featured a clean, modern icon, a generic name strategically paired with security-oriented terminology, a sudden and overwhelming influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a digital asset manager.
Beneath this polished frontend, however, lay a purpose-built attack mechanism engineered to steal sensitive user data. The extension was designed to capture seed phrases and empty user wallets by quietly encoding the stolen secrets into micro-transactions executed on the Sui blockchain. The threat was uncovered and brought to light by Socket, a security tooling company specializing in the safety of open-source software supply chains. Researchers at the firm installed and thoroughly analyzed the extension shortly after its discovery to understand how "Safery" managed to evade automated detection systems, climb the Chrome Store rankings, and exfiltrate sensitive data without raising immediate alarms. Their subsequent report offers a detailed postmortem of the incident while serving as a stark warning that browser extensions continue to represent a dangerous and frequently overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case noteworthy within the cybersecurity and crypto communities is that the malicious actors did not rely on the well-trodden territory of simply spoofing an existing, trusted wallet brand. Unlike previous campaigns that frequently deployed MetaMask lookalikes or recycled phishing domains, Safery invented an entirely new identity. The developers purchased or generated botted fake reviews to manipulate search rankings and launched the application as a brand-new, independent wallet option. This sophisticated approach ensured that the listing showed virtually no immediate red flags, such as broken grammar, suspicious permission requests, or sudden redirections to shady external domains. Furthermore, the Chrome Web Store publisher page displayed zero prior consumer complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by security trackers at the time of Socket’s initial analysis.
Given its highly polished appearance, the average user would have had little reason to hesitate before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a standard and necessary requirement for crypto wallets that need to interact seamlessly with various decentralized applications. Notably, it refrained from prompting for extra, highly invasive permissions or attempting to inject complex content scripts that typically trigger Chrome’s more aggressive security warnings. The overall branding was minimalist and clean, the accompanying website closely matched the extension’s name, and the initial setup screen naturally prompted users to create or import a wallet—behavior that is entirely standard for legitimate software in this category.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment a user entered their recovery seed phrase into the interface. Instead of securely storing the phrase locally or properly encrypting it for user accessibility, the extension silently fragmented the phrase and cleverly encoded the pieces into what appeared to be completely random, innocuous wallet addresses. Socket’s extensive research demonstrated that these fragments were systematically inserted into actual Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—amounts so small they would never draw attention—to addresses directly controlled by the attackers.
Hidden discreetly inside those transactions, either embedded within memo fields or obfuscated through targeted addresses, were the critical components of the victim’s seed phrase. This tactical approach offered significant advantages for the perpetrators. It entirely eliminated the need for the extension to send outbound network requests to malicious command-and-control servers. There was no suspicious beaconing or data exfiltration routed over standard HTTP or WebSockets channels that a modern browser or traditional antivirus software might flag. Instead, the stolen payload left the user’s device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee blockchain network. Once recorded on-chain, the data remained publicly accessible, granting the attacker the ability to retrieve the fragments at their leisure, reconstruct the seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, this novel scam utilized the Sui blockchain itself as an unconventional communications channel. Because the Sui network boasts fast transaction confirmation times and virtually negligible fees, it functioned remarkably well as a low-latency message bus for the attackers. Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts occurred off-chain—targeting funds held by victims on Ethereum or other Layer 1 networks where their genuine wallets held capital—the operational instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher likely tested the methodology extensively in private environments. Digital evidence indicates that earlier, preliminary builds experimented with much simpler data leaks before the Sui encoding technique was ultimately refined. By the time the active, malicious extension was finally flagged and scrutinized, it had accumulated enough installs to comfortably reach Chrome’s coveted "trending" tier, which further amplified its visibility. Reports from industry outlets confirmed that the Safery wallet continued to sit comfortably among the top results for Ethereum wallet searches even as growing reports of suspicious behavior began circulating within communities on Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying mechanics of Chrome’s search ranking logic. The Web Store search algorithm primarily weighs factors such as keyword matching, total install counts, review velocity, average ratings, and the recency of updates. Extensions that experience a sudden, sharp burst of user activity, particularly within niche categories, can climb search rankings rapidly if their more thoroughly vetted competitors are not updated with equal frequency. In this specific case, Safery benefited from a name optimized for common user queries, a blitz of positive reviews that were largely templated or duplicated, and a very fresh upload date.
There is no evidence to suggest that Google manually reviewed this particular listing prior to publication. Current Chrome Web Store policies typically subject most new extensions to little more than a brief automated scan and fundamental static analysis. Extensions generally only undergo deeper human or algorithmic scrutiny when they explicitly request elevated permissions, such as direct access to browser tabs, the user’s clipboard, local file systems, or browsing history. Wallet extensions routinely manage to bypass these stricter flags by operating safely within isolated iframes or utilizing standard, approved application programming interfaces, and Safery carefully stayed well within those operational bounds.
Even when vigilant users began raising concerns and reporting the extension, the time lag between the initial reports and the eventual takedown stretched on long enough for substantial financial damage to occur. Part of this lag is structural; the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or known malware signatures already documented in threat databases. In this scenario, the payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external hosting providers, meaning traditional malware detection methodologies failed to catch it in time.
This incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency assets from unsuspecting users. Previous high-profile scams have included fraudulent Ledger Live applications that improperly prompted users to enter their recovery phrases, as well as instances where legitimate, established extensions were hijacked to allow threat actors access to the original developer’s publishing keys. What distinguished Safery from previous attacks, however, was the remarkable smoothness of its digital facade and the total absence of traditional backend infrastructure. There was no external phishing site to take down, and no rogue server to block—just a single browser extension quietly depositing stolen secrets onto a public blockchain and walking away cleanly.
Affected users still had limited recourse if they acted with extreme swiftness, such as limiting their overall exposure by immediately rotating seed phrases and revoking outstanding transaction approvals across their accounts. Socket and other collaborating security firms issued urgent triage steps for anyone unfortunate enough to have installed the extension: uninstall the application immediately, revoke any active token approvals, sweep remaining digital assets to an entirely new wallet using a completely clean device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who stored large amounts of capital directly in vulnerable hot wallets, asset recovery remained an unlikely outcome.
Security researchers and developers are now calling for significantly stronger heuristics from browser operators like Google. One prominently proposed solution involves automatically flagging and blocking any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase. Another suggested approach is the mandatory implementation of publisher attestation for all wallet extensions, providing cryptographic, verifiable proof that a specific publisher genuinely controls the underlying codebase associated with a known wallet brand. Furthermore, there are growing demands for much tighter inspection of wallet-related permissions, even when those permissions do not explicitly include overtly dangerous access patterns.
For end users navigating the web, security experts continue to emphasize the importance of thorough due diligence before installing any software that handles sensitive financial data. Reviewing the publisher’s history, verifying direct associations with recognized projects, inspecting review patterns for suspicious bursts of identical text, checking for genuine website links backed by public code repositories, and scrutinizing permission tabs for vague or sweeping access requests remain vital precautions. Ultimately, this significant security incident forces a broader conversation regarding the inherent risks of relying on traditional browser environments for asset management, as the boundary between convenient accessibility and severe financial exposure continues to blur.
Raul Delapena Setiawan 
Siti Muinah