By Nana Wu 
For several days last November, a cleverly disguised and malicious browser extension managed to climb the rankings on the official Chrome Web Store, securing the fourth position for the highly competitive search query "Ethereum wallet."
The application, misleadingly named "Safery: Ethereum Wallet," presented a polished facade capable of deceiving even experienced digital asset users. It featured a clean, professional icon, a generic name paired with security-sounding terminology, a massive influx of five-star reviews, and boilerplate descriptive text that closely mirrors legitimate cryptocurrency applications available on the market. Beneath this deceptive frontend, however, lay a purpose-built cyberattack designed to harvest sensitive recovery phrases and systematically empty user wallets by encoding stolen secrets directly into micro-transactions on the Sui blockchain.
The threat was uncovered and subsequently analyzed by Socket, a prominent security tooling company that specializes in monitoring and protecting open-source software supply chains. Following the initial discovery, researchers installed the extension in a controlled environment to dissect its inner workings. Their primary objective was to understand how "Safery" successfully bypassed automated security detections, manipulated the Chrome Web Store search and ranking algorithms, and exfiltrated sensitive seed phrases without triggering browser or antivirus alarms. The resulting security report serves both as an urgent postmortem of the incident and as a sobering warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular incident stands out among historical crypto exploits because the threat actors did not rely on traditional spoofing techniques. While impersonating established wallet brands like MetaMask or recycling defunct phishing domains is unfortunately common practice in the crypto threat landscape, Safery carved out an entirely new identity. It invented a fictional brand from scratch, purchased or generated a network of bot-driven fake reviews to artificially inflate its search rankings, and launched itself as a seemingly novel wallet option within the store.
This calculated strategy meant that the listing displayed virtually no immediate red flags to prospective victims. There was no broken English in the description, no demand for suspicious or unauthorized permissions, and no redirection to questionable external domains. Furthermore, the Chrome Web Store publisher page had accumulated zero prior complaints from users, and its listed support URL directed traffic to an off-platform website that had not yet been flagged by threat intelligence and security trackers at the time of Socket’s analysis.
Given the remarkably polished appearance of the listing, the average user would likely experience very little hesitation before clicking the "Add to Chrome" button. Upon installation, the extension requested permission to run on all websites—a standard operational requirement for legitimate crypto wallets that must interact seamlessly with various decentralized applications across the web. Crucially, the software did not prompt for elevated or unusual permissions, nor did it attempt to inject complex content scripts that would typically provoke more aggressive security warnings from the Chrome browser. The branding remained minimalist, the developer’s website matched the extension’s title precisely, and the initial setup screen encouraged users to either create a brand-new wallet or import an existing one, reinforcing the illusion of normal functionality.
The Seed Heist, Broadcast Over Sui
The true malicious mechanics of the application initiated the moment a user inputted their recovery seed phrase. Instead of securely storing the phrase locally on the device or encrypting it for legitimate user access, the extension silently fragmented the phrase into smaller pieces. It then encoded these fragments to masquerade as seemingly random, innocuous wallet addresses.
Detailed findings from Socket’s research indicate that these fragmented data pieces were embedded directly into public transactions on the Sui blockchain. Specifically, the extension executed minuscule SUI token transfers—amounts so negligible that they would never draw the attention of automated monitoring tools—directed toward addresses completely controlled by the attacker. Hidden meticulously inside those seemingly routine transactions, either within designated memo fields or through obfuscated destination addresses, were the individual components of the victim’s sensitive seed phrase.
This exfiltration method provided distinct tactical advantages for the perpetrators. Most notably, it completely eliminated the need for the extension to transmit outbound network requests to external malicious servers. There was no identifiable command-and-control beacon, nor was there any suspicious data exfiltration routed over traditional HTTP or WebSocket protocols that a modern browser or antivirus software might flag. Instead, the malicious payload departed the user’s local device disguised as a completely normal blockchain transaction, intelligently routed through a widely utilized, low-fee decentralized network. Once successfully recorded on-chain, the data remained publicly accessible, permitting the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to interact with the victim’s device a second time.
In essence, the scam repurposed the Sui blockchain infrastructure itself to function as a clandestine communications channel. Because the Sui network boasts exceptionally fast transaction confirmation times and negligible gas fees, it operated with the efficiency of a low-latency message bus. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct causal link between the entry of a recovery phrase into the extension and the subsequent loss of digital assets. While the actual thefts occurred off-chain—primarily on Ethereum or alternative layer-one networks where the victims’ wallets maintained substantial balances—the operational instructions required to execute the thefts were hidden entirely in plain sight.
Before deploying the final version that successfully infiltrated Chrome’s top wallet search results, the publisher likely tested the methodology within private development environments. Digital forensics and version histories reveal that earlier, rudimentary builds experimented with simpler data leakage techniques before the Sui encoding scheme was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated a sufficient volume of installations to secure a coveted spot in Chrome’s trending tier, which further amplified its visibility to unsuspecting users. Reports from specialized crypto news outlets confirmed that the Safery wallet maintained its prominent ranking among search results for Ethereum wallet queries even as initial warnings and complaints regarding suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension depended heavily on the underlying mechanics of the Chrome Web Store search and ranking algorithm. The platform’s algorithm systematically weighs factors such as precise keyword matches, total install counts, review velocity, average user ratings, and the recency of the last software update.
Software extensions that experience a sudden, concentrated burst of user activity—particularly within specialized or niche categories—can climb the visibility ladder with surprising speed if established, well-vetted competitors fail to update their applications frequently. In this instance, Safery combined a strategically optimized title that scored exceptionally well for common user queries with a coordinated blitz of positive reviews, many of which were clearly templated or duplicated, alongside a completely fresh upload date to manipulate the system.
There is currently no evidence indicating that Google performed a manual security review of the listing prior to its publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan and fundamental static analysis. Extensions typically undergo deeper, more rigorous scrutiny only when they explicitly request highly elevated permissions, such as continuous access to user tabs, sensitive clipboard data, local file systems, or browsing history. Wallet extensions routinely manage to bypass these restrictive flags by operating safely within isolated iframes or by utilizing officially approved browser APIs, boundaries that Safery carefully respected throughout its operation.
Even after concerned users began raising alarms about the application’s behavior, the operational lag between initial reporting and the eventual takedown of the extension stretched on long enough for significant financial damage to occur. Part of this vulnerability is structural: the Chrome ecosystem rarely acts on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or the detection of established malware signatures. Because the payload in this case relied on obfuscated JavaScript interacting directly with legitimate blockchain infrastructure rather than communicating with external, known-malicious hosts, traditional automated malware detection methods failed to catch it in time.
This incident is far from an isolated occurrence within the broader history of browser extensions being weaponized to target digital asset holders. Previous security breaches have included fraudulent Ledger Live applications prompting users to input recovery phrases directly into web interfaces, as well as instances where legitimate extensions were hijacked after attackers compromised the original developer’s publishing credentials.
What distinguished Safery from past campaigns, however, was the seamless nature of its user interface facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website that authorities could swiftly dismantle, and no rogue command-and-control server to block; there was merely a single browser extension quietly translating sensitive secrets into public blockchain transactions and slipping away unnoticed.
For affected users, remediation options were extremely narrow and time-sensitive. Individuals who recognized the threat quickly enough could limit their ongoing exposure by immediately rotating their recovery seeds and systematically revoking outstanding transaction approvals across various decentralized finance protocols. Security firms including Socket published urgent triage guidelines for anyone who had installed the extension, recommending immediate uninstallation, the revocation of all active token approvals, the transfer of remaining assets to a fresh wallet generated on a completely clean device, and the continuous monitoring of associated addresses. For those users who failed to notice the silent exfiltration or who maintained substantial capital in vulnerable hot wallets, asset recovery remained virtually impossible.
As the fallout from the incident continues to reverberate across the industry, security researchers, developers, and industry stakeholders are intensifying calls for stronger heuristic safeguards directly from browser operators like Google. Proposed technical solutions include implementing automated security flags for any extension that incorporates user interface elements prompting for a standard 12- or 24-word recovery phrase.
Additional recommendations involve establishing mandatory publisher attestation requirements for wallet extensions, providing verifiable cryptographic proof that a specific publisher genuinely controls the codebase behind an established wallet brand. Furthermore, experts are advocating for much tighter scrutiny surrounding wallet-related permissions, even in instances where those permissions do not explicitly trigger traditional dangerous access patterns.
For end users navigating the Web3 space, security analysts continue to emphasize the importance of rigorous evaluation habits. Before installing any cryptocurrency-related browser extension, users are advised to thoroughly review the publisher’s history, verify authentic associations with recognized projects, inspect review patterns for artificial bursts of identical or templated feedback, cross-reference official website links with public code repositories, and scrutinize the permissions tab for overly sweeping access requests. A clean name, professional branding, and a high aggregate rating are no longer sufficient guarantees of safety.
The incident ultimately forces a broader philosophical examination of the browser’s expanding role within the cryptocurrency landscape. Browser-based wallets achieved widespread popularity primarily due to their accessibility and user-friendly design, enabling everyday users to interact smoothly with complex decentralized applications without requiring separate desktop installations or platform switches.
That vital accessibility, however, has consistently come at the expense of heightened exposure. The modern web browser remains a high-risk operating environment susceptible to extension manipulation, malicious session hijacking, aggressive clipboard scrapers, and now, covert blockchain-based exfiltration. As long as these vulnerabilities persist, the underlying distribution models for digital asset tools will remain fundamentally challenged, leaving everyday participants vulnerable to polished clones operating in plain sight.
Raul Delapena Setiawan 
Muslim 
Siti Muinah