By Sagoh 
For a brief yet damaging period last November, a sophisticated and malicious browser extension managed to climb its way to the fourth position in the Chrome Web Store search results for the high-value keyword "Ethereum wallet." Disguised under the innocuous and polished name "Safery: Ethereum Wallet," the application easily fooled casual observers and vigilant crypto users alike. Featuring a clean, professional icon, a generic name cleverly positioned alongside security-adjacent language, an overwhelming influx of five-star reviews, and standard descriptions familiar to anyone navigating the decentralized finance space, the extension presented a veneer of absolute legitimacy.
Beneath this deceptively polished frontend, however, lay a purpose-built attack mechanism engineered to silently harvest seed phrases and systematically empty user wallets. Rather than relying on traditional methods that could easily be flagged by antivirus software or browser monitoring tools, the malicious software encoded stolen secrets into micro-transactions on the Sui blockchain. The incident has since become a major talking point among cybersecurity professionals, shedding light on the dangerous blind spots that continue to plague browser extensions within the broader cryptocurrency ecosystem.
The operation came to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and conducted a thorough analysis of the extension following its initial discovery in the wild. The researchers set out to understand how "Safery" managed to successfully evade automated detection mechanisms, rapidly climb the Chrome Store rankings, and exfiltrate sensitive seed phrases without raising immediate alarms. Furthermore, the firm aimed to provide valuable insights into what everyday users could do to spot similar emerging threats. The resulting technical report walks through the attacker’s unconventional methodology, serving simultaneously as a postmortem analysis and a stark warning about the vulnerabilities inherent in browser-based cryptocurrency management.
What makes this specific incident particularly noteworthy within the cybersecurity and blockchain communities is that the hackers bypassed the conventional playbook of spoofing an existing, trusted wallet brand. It was neither a crude MetaMask lookalike nor a recycled phishing domain designed to catch careless visitors. Instead, the creators of Safery invented an entirely new digital identity, invested in purchasing or generating botted fake reviews to artificially boost their search engine rankings within the Web Store, and launched as a completely fresh wallet option on the market.
This calculated approach meant that the extension’s store listing was remarkably devoid of immediate red flags. There was no broken English or awkward grammar, no bizarre permission requests that would trigger cautious hesitation, and no suspicious redirection links leading to sketchy external domains. The publisher page associated with the Chrome Web Store showed a pristine history completely free of prior complaints. Meanwhile, its listed support URL directed traffic to an off-platform website that had not yet been flagged by automated security trackers at the time Socket initiated its investigation.
Given the high degree of professional polish, the vast majority of web users would have experienced little to no hesitation before clicking the "Add to Chrome" button. The extension did request permission to run on "all websites," but this is a standard, ubiquitous requirement for legitimate crypto wallets that must interact seamlessly with a wide variety of decentralized applications across the web. Notably, the software did not prompt for extra, unauthorized permissions or attempt to inject malicious content scripts that would typically provoke Chrome’s more aggressive warning banners. The overall branding remained minimalist and cohesive, the official website accurately mirrored the extension’s stated name, and the initial setup screen simply prompted users to create a brand new wallet or import an existing one—behavior indistinguishable from standard, trusted software.
The Seed Heist, Broadcast Over Sui
The real, irreversible damage began the moment an unsuspecting user entered their recovery seed phrase into the interface. Instead of securely storing the phrase locally or properly encrypting it for authorized user access, the extension executed a silent, malicious routine. It fragmented the seed phrase into smaller pieces and cleverly encoded those fragments to mimic random, innocuous wallet addresses.
Socket’s rigorous research demonstrates that these fragmented pieces were secretly inserted directly into active Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—such vanishingly small financial amounts that they would never draw the attention of a human observer or automated balance tracker—directed toward specific addresses under the direct control of the attacker. Hidden cleverly inside those transactions, either tucked away safely within memo fields or obfuscated directly inside the transaction addresses themselves, were the vital components of the user’s private seed phrase.
This tactical design choice offered profound advantages to the perpetrators. By routing the data through the blockchain, the extension completely avoided making outbound network requests to overtly malicious command-and-control servers. There was no suspicious HTTP or WebSocket exfiltration beacon that a modern browser or standard antivirus program might readily flag and block.
Instead, the payload seamlessly departed the user’s local device disguised as a completely normal, everyday blockchain transaction, expertly routed through a widely used, highly efficient layer-1 chain. Once successfully recorded on-chain, the data became entirely public and accessible, permitting the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep connected wallets clean without ever needing to touch the victim’s device a second time.
In effect, the operation weaponized the Sui blockchain itself, turning it into an encrypted communications channel. Because the Sui network boasts remarkably fast confirmation times alongside negligible transaction costs, it functioned with the efficiency of a low-latency message bus. Socket successfully traced multiple instances of these unique seed-fragment transactions, definitively confirming the direct causal link between the initial entry of a seed phrase within the fake extension and the eventual loss of digital assets. While the actual thefts of funds occurred off-chain—predominantly on Ethereum or other major layer-1 networks where the victims’ compromised wallets held substantial balances—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before deploying the final version that successfully captured prominent placement in Chrome’s top wallet search results, the publisher likely tested the underlying methodology in private environments. Evidence uncovered by researchers indicates that earlier, preliminary builds experimented with much simpler data leakage techniques before the Sui blockchain encoding method was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated a sufficient volume of installations to secure a coveted spot in Chrome’s "trending" tier, which further amplified its visibility to unsuspecting users. Reports from industry outlets confirmed that the Safery wallet comfortably maintained its position among the top search results for Ethereum wallet queries even as initial warnings and suspicious behavior reports began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged entirely on the underlying mechanics of Chrome’s search and ranking logic. The Web Store search algorithm continuously evaluates a complex matrix of factors, including keyword matching, total installation counts, review velocity, average user ratings, and update recency. Extensions that experience a sudden, sharp burst of user activity—particularly within specialized or niche categories—can climb the rankings rapidly, especially if their better-vetted, legitimate competitors are not updated with equal frequency. In this particular instance, Safery benefited heavily from a keyword-optimized name, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, recent upload date.
Available evidence does not indicate that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policies dictate that most newly submitted extensions undergo only a brief automated scan alongside fundamental static code analysis. Deeper, more manual scrutiny is typically reserved for extensions that request explicitly elevated or dangerous permissions, such as broad access to browser tabs, local clipboards, the file system, or user browsing history.
Because many genuine crypto wallet extensions successfully avoid these specific permission flags by operating securely within iframes or utilizing approved APIs, Safery was able to comfortably stay within those established boundaries. Even when vigilant users raised early concerns and submitted reports, the time lag between initial reporting and the eventual takedown of the extension stretched on long enough for significant financial damage to occur.
Part of this persistent lag is structural: the Chrome ecosystem generally does not act instantaneously on flagged extensions unless there is an overwhelming consensus of reports or a match against known malware signatures. In this specific case, the payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external, centralized hosts, rendering traditional malware detection methods effectively blind.
This security incident is far from an isolated event, as browser extensions have repeatedly been targeted or utilized as vectors for cryptocurrency theft. Previous high-profile scams have involved fraudulent Ledger Live desktop apps and browser variants prompting users to input recovery phrases, as well as instances where legitimate extensions were hijacked when attackers compromised a developer’s publishing keys. What fundamentally set Safery apart, however, was the remarkable smoothness of its digital facade combined with the complete absence of traditional backend infrastructure. There was no external phishing website that authorities could easily take down, and no centralized server IP address to block—just a single browser extension quietly depositing secrets onto a public blockchain and walking away.
For users who fell victim to the scheme, recourse remained severely limited. Those who acted with extreme swiftness could occasionally limit their ongoing exposure by rapidly rotating their seed phrases and actively revoking existing token approvals across various decentralized applications. Security firms including Socket quickly published detailed triage steps for anyone who had installed the software: uninstall the malicious extension immediately, revoke all active token approvals, sweep remaining digital assets to a completely new wallet utilizing a thoroughly clean device, and continuously monitor associated addresses for unauthorized activity. For users who failed to notice the silent exfiltration in time, or for those who maintained substantial balances in vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers and independent software developers are now intensifying calls for the implementation of stronger heuristics directly within the architecture of the Chrome Web Store. One widely discussed proposal involves the automatic flagging and blocking of any extension that incorporates user interface elements explicitly prompting for a standard 12-word or 24-word recovery phrase. Another suggested approach includes requiring mandatory publisher attestation for all wallet extensions, which would provide cryptographically verifiable proof that a designated publisher officially controls the underlying codebase associated with a recognized wallet brand. Additionally, industry experts are advocating for much tighter, more rigorous inspections of wallet-related permissions, even in instances where those permissions do not explicitly incorporate traditional dangerous access patterns.
For everyday end users, security advocates continue to stress the importance of adopting a rigorous checklist for extension management. Before installing any cryptocurrency-related browser extension, users are urged to carefully review the publisher’s historical track record, independently verify official associations with known and trusted projects, and scrutinize review patterns for suspicious anomalies such as sudden bursts of identical or templated text. Furthermore, users should always cross-reference official website links with verified public repositories and closely inspect the permissions tab for vague or overly sweeping access requests. A clean name and a high star rating, as the Safery incident starkly demonstrated, are no longer sufficient guarantees of safety.
The episode raises broader, more philosophical questions regarding the fundamental role that modern web browsers play within the cryptocurrency ecosystem. Browser-based wallets originally gained widespread popularity primarily due to their accessibility and user-friendly design, enabling everyday users to interact smoothly with complex decentralized applications without the friction of switching platforms or downloading standalone desktop applications. However, that vital accessibility has come at a severe cost to overall security exposure. The modern web browser remains a notoriously high-risk environment subject to constant threats, including extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As a result of these persistent vulnerabilities, wallet developers are increasingly likely to rethink their primary distribution models. Some development teams already actively discourage users from installing software via the Chrome Web Store, preferring instead to direct them toward dedicated mobile applications or standalone desktop binaries. Others may soon implement prominent in-app warnings for users attempting to install extensions from unverified or lesser-known sources.
The core challenge remains stubbornly fragmented: software distribution lacks a unified standard of trust, and the vast majority of everyday users simply do not possess the technical expertise required to distinguish a genuinely secure wallet from a polished, malicious clone. The Safery extension proved conclusively that attackers no longer need to successfully mimic established market leaders like MetaMask or Phantom to achieve their goals. By engineering an entirely independent brand, seeding artificial trust signals, and constructing an invisible backdoor that leveraged a public blockchain as a covert courier, the operation bypassed conventional defenses.
This reality demands a profound rethinking of how trust is established and verified within cryptocurrency user experiences, and how intimately connected even casual, everyday tools like browser extensions really are to the underlying assets they protect. While cryptocurrency culture heavily emphasizes user sovereignty and absolute self-custody, incidents like this serve as a sobering reminder that in the wrong hands, a standard browser wallet functions less like a secure digital vault and more like an open port—and the browser will not always issue a warning before something slips through.
Raul Delapena Setiawan 
Muslim 
Siti Muinah