By Asro 
For a few critical days last November, a sophisticated and malicious browser extension managed to capture the fourth-place ranking for the search query “Ethereum wallet” on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was crafted with enough polish and professional design to easily fool unsuspecting users looking for a secure way to manage their digital assets. It featured a clean, professional icon, a generic and reassuring name adjacent to security-oriented language, a rapid influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a legitimate cryptocurrency wallet.
Beneath that polished frontend, however, lay a purpose-built attack mechanism designed specifically to harvest user seed phrases and systematically empty their wallets. Instead of relying on traditional, easily trackable methods of data exfiltration, the malware ingeniously encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light after security tooling company Socket, which focuses heavily on open-source software supply chains, installed and closely analyzed the extension following its initial discovery. Their primary objective was to understand how “Safery” managed to evade automated detection systems, successfully climb the competitive Chrome Store rankings, and exfiltrate sensitive seed phrases without triggering immediate security alarms. Furthermore, the security team wanted to determine what everyday users could do to spot similar threats in the wild. The resulting technical report walks through the attacker’s innovative approach, serving simultaneously as a postmortem of the security failure and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular case is especially noteworthy because the threat actors behind the scheme did not simply spoof an existing, well-known wallet brand. Security analysts frequently encounter recycled phishing domains or malicious lookalikes attempting to mimic industry giants like MetaMask, but Safery chose a different path. It entirely invented a fresh identity, utilized purchased or automated bot reviews to artificially inflate its search rankings, and launched itself as a seemingly brand-new, independent wallet option.
This calculated approach meant that the listing displayed virtually no immediate red flags to casual observers. There was no broken grammar in the descriptions, no obviously suspicious or excessive permissions requested, and no immediate redirection to shady, unverified external domains. Additionally, the Chrome Web Store publisher page bore no prior complaints, and the provided support URL directed users to an off-platform website that had not yet been flagged by security trackers at the time of Socket’s in-depth analysis.
Given its highly polished appearance, the average user would likely not have hesitated before clicking the “Add to Chrome” button. Like many legitimate tools, the extension requested permission to run on “all websites,” which is a standard and necessary requirement for crypto wallets that must interact seamlessly with various decentralized applications across the web. Notably, it refrained from prompting for extra permissions or attempting to inject complex content scripts that might have triggered Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the companion website matched the extension’s name precisely, and the initial setup screen naturally prompted users to create or import a wallet—behavior that completely mirrored standard industry practices.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment an unsuspecting user entered their seed phrase into the interface. Instead of securely storing the phrase locally or properly encrypting it for user-controlled access, the extension silently fragmented the sensitive recovery phrase and cunningly encoded the pieces into what appeared to be entirely random wallet addresses.
Socket’s comprehensive research revealed that these stolen seed fragments were actively inserted into actual Sui blockchain transactions. Specifically, the extension issued tiny, nearly invisible SUI token transfers—minuscule monetary amounts designed to draw zero attention—to addresses directly controlled by the attacker. Hidden safely inside those transactions, either tucked away within memo fields or obfuscated directly within the structure of the recipient addresses, were the critical pieces of the victim’s seed phrase.
This tactical approach provided significant advantages to the hackers. Because the data was smuggled out via legitimate blockchain interactions, the extension had no need to send outbound network requests to malicious, external servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration occurring over HTTP or WebSockets that a modern browser extension scanner or local antivirus software might flag.
Instead, the payload left the user’s device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee layer-1 chain. Once successfully recorded on-chain, the data became publicly accessible, allowing the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep connected wallets clean without ever needing to touch the user’s device or network again.
In effect, the sophisticated scam utilized the Sui blockchain itself as an unconventional, highly effective communications channel. Because the Sui network boasts exceptionally fast confirmation times and negligible transaction costs, it functioned seamlessly like a low-latency message bus for the thieves.
Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between seed entry and the subsequent loss of assets. While the actual thefts of cryptocurrency occurred off-chain—primarily on Ethereum or other layer-1 networks where the victims’ wallets conveniently held valuable funds—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before finally releasing the version that ultimately landed in Chrome’s top wallet search results, the publisher likely tested this novel method in private development environments. Digital evidence indicates that earlier, preliminary builds experimented with much simpler data leaks before the Sui encoding technique was fully refined and optimized.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to break into Chrome’s coveted “trending” tier, which further amplified its visibility to potential victims. Industry reports confirmed that the “Safery” wallet sat comfortably among the top search results for “Ethereum wallet” even as distressed reports of suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the “Safery” extension hinged heavily on the underlying ranking logic of the Chrome Web Store search algorithm. The store’s algorithm typically weighs factors such as keyword matching, total installation counts, review velocity, average user ratings, and the recency of the last update.
Extensions that experience a sudden, artificial burst of activity—especially within niche or high-demand categories—can climb search rankings rapidly if more established, well-vetted competitors are not updated frequently. In this particular instance, “Safery” capitalized on a name that scored exceptionally well for common user search queries, backed by a blitz of positive reviews that were largely templated or duplicated, alongside a very fresh upload date.
There is currently no public evidence indicating that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy subjects most newly submitted extensions to little more than a brief automated scan and fundamental static code analysis.
Extensions typically undergo much deeper security scrutiny only when they explicitly request elevated, highly sensitive permissions, such as extensive access to browser tabs, the user’s clipboard, local file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter flags by operating safely within isolated iframes or by utilizing standard, approved application programming interfaces. “Safery” carefully adhered to these operational boundaries to avoid detection.
Even when vigilant users eventually raised concerns and reported the extension, the time gap between initial reporting and final takedown stretched out long enough for substantial financial damage to occur. Part of this delay is structural: the Chrome Web Store does not automatically act on flagged extensions instantly unless there is an overwhelming consensus of reports or definitive known malware signatures matched in the code.
In this case, the malicious payload consisted of heavily obfuscated JavaScript that cleverly relied on public blockchain infrastructure rather than external hosting providers, meaning traditional antivirus and malware detection methods failed to catch it.
This incident is far from the first time browser extensions have been weaponized to steal cryptocurrency from retail users. Previous high-profile scams have included fake Ledger Live companion apps that prompted unsuspecting users to enter their master recovery phrases, or instances where legitimate, established extensions were hijacked after attackers compromised the original developer’s publishing credentials.
What made the “Safery” incident distinctly dangerous was the remarkable smoothness of its user interface facade and the complete absence of traditional backend infrastructure. There was no external phishing website to take down, and no malicious server IP address to block—just a single browser extension quietly moving classified secrets onto a public blockchain network and walking away cleanly.
Affected users still retained a narrow window of recourse. For those who acted with extreme promptness, exposure could be limited by immediately rotating their seed phrases and revoking any outstanding token spending approvals associated with their accounts.
Security researchers at Socket and other firms quickly published essential triage steps for anyone who had mistakenly installed the extension: uninstall the application immediately, revoke all token approvals across decentralized platforms, sweep remaining assets to a fresh wallet using an entirely clean device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who unfortunately stored large amounts of capital in vulnerable hot wallets, asset recovery remained highly unlikely.
The broader security incident has prompted renewed calls from developers and researchers for stronger, smarter heuristics from Google and the Chrome engineering team. Among the proposed technical solutions is the implementation of an automated flag system that would immediately halt any extension featuring user interface elements that prompt for standard 12- or 24-word recovery phrases.
Another frequently discussed approach involves requiring mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the codebase behind a recognized wallet brand. Industry advocates are also pushing for much tighter regulatory inspection of wallet-related permissions, even when those permissions do not explicitly trigger dangerous access patterns under current guidelines.
For everyday crypto users, Socket published a practical checklist for safer extension management moving forward. Before installing any new cryptocurrency extension, users are strongly advised to thoroughly review the publisher’s history, verify explicit associations with known, reputable software projects, closely inspect review patterns for unnatural bursts of identical feedback, check for real website links backed by public code repositories on platforms like GitHub, and carefully scan the permissions tab for vague or overly sweeping access requests.
As this incident demonstrates, a clean, professional name and a high star rating are simply no longer enough to guarantee safety in the digital asset space. The event raises deeper, systemic questions regarding the browser’s expanding role in cryptocurrency management. Browser wallets originally gained widespread popularity due to their high accessibility and ease of use, allowing users to interact effortlessly with complex decentralized applications without needing to switch platforms or download separate, standalone desktop applications.
However, that vital accessibility has come at the direct cost of increased exposure to risk. The modern web browser remains an inherently high-risk environment subject to continuous threats such as extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
In response, cryptocurrency wallet developers are expected to seriously rethink their long-term distribution models. Some development teams already actively discourage Chrome Web Store installations, preferring to guide users exclusively toward dedicated mobile applications or signed desktop binaries. Others may soon implement built-in software warnings for users attempting to install extensions from unverified or newly minted sources.
The core underlying problem remains stubbornly persistent: software distribution across the web is deeply fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a genuinely legitimate wallet from a polished, malicious clone.
The “Safery” extension did not need to successfully mimic MetaMask or masquerade as Phantom to achieve its goals. It simply invented its own trustworthy-looking brand, seeded fake trust signals into the marketplace, and constructed an invisible digital backdoor that leveraged the Sui blockchain itself as an untraceable courier.
Ultimately, this security breach forces a fundamental rethink of how trust is established within cryptocurrency user experiences, and highlights just how close to the metal even casual, everyday tools like browser extensions truly operate. While average crypto users often assume that the ethos of Web3 guarantees absolute sovereignty and self-custody, incidents like this prove that in the wrong hands, a browser wallet is not a secure digital vault—it is an open port. And the browser will not always warn you before something slips right through.
Raul Delapena Setiawan 
Muslim 
Siti Muinah