By Layla Zulfa 
For a few critical days last November, a malicious browser extension managed to climb through the ranks of the Chrome Web Store, positioning itself as the fourth organic search result for the high-intent query "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," was engineered to look entirely legitimate to the casual user. It featured a polished and clean icon, a generic title that closely mirrored standard security-focused cryptocurrency vocabulary, a rapid influx of five-star reviews, and boilerplate application descriptions that would immediately feel familiar to anyone who has ever navigated the Web3 ecosystem to download a self-custody crypto wallet.
However, behind that polished frontend sat a sophisticated, purpose-built attack mechanism designed explicitly to siphon seed phrases from unsuspecting victims and empty their multi-chain digital asset wallets. Rather than relying on traditional methods of data exfiltration, the extension covertly encoded stolen recovery phrases into micro-transactions routed directly through the Sui blockchain, hiding its illicit activities in plain sight.
The threat was brought to light and thoroughly dissected by Socket, a prominent security tooling company that specializes in monitoring open-source software supply chains. Security researchers at the firm installed and analyzed the extension shortly after its discovery in the wild, seeking to understand how "Safery" successfully bypassed automated detection protocols, manipulated Chrome Web Store search rankings, and spirited away sensitive seed phrases without triggering immediate security alarms. The resulting technical postmortem has served as both an urgent warning and a stark reminder that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency security landscape.
What makes this particular incident stand out among the crowded field of crypto-related cybercrime is the tactical pivot executed by the threat actors. In many historical cases, hackers rely on brand spoofing, creating clumsy MetaMask lookalikes or purchasing recycled phishing domains designed to catch users making careless navigation errors. "Safery" took a radically different path by inventing an entirely novel identity. It did not imitate an existing, trusted wallet brand; instead, it used automated bot networks or purchased fake reviews to organically climb the search rankings, launching itself under the guise of an entirely new, independent wallet option.
Because the attackers created a brand-new entity rather than copying a known target, the extension’s store listing was remarkably devoid of immediate red flags. There was no broken English in the descriptions, no erratic or unusual permission requests, and no suspicious redirects leading users to shady, unverified external domains. Furthermore, the Chrome Web Store publisher page possessed zero prior complaints or history of infractions, while its designated support URL directed users to an off-platform website that had not yet been flagged by any major security trackers at the time of Socket’s initial analysis.
Given the professional and clean appearance of the store listing, the vast majority of everyday users would likely have clicked "Add to Chrome" without a second thought. Like many legitimate Web3 tools, the extension requested permission to run on "all websites," a necessary technical requirement for wallets that need to interact seamlessly with decentralized applications across various domains.
Crucially, the extension avoided asking for extra, high-privilege permissions or attempting to inject complex content scripts that would normally provoke Chrome’s more aggressive automated warnings. Its branding adhered to a clean, minimalist aesthetic, its companion website matched the exact name of the extension, and its initial setup screen walked users through the standard, expected behavior of creating a brand-new wallet or importing an existing recovery phrase.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their sensitive seed phrase into the interface. Instead of safely storing the phrase locally or encrypting it for legitimate user access, the extension silently fragmented the recovery words into smaller pieces. It then encoded these fragments to masquerade as seemingly random, innocuous blockchain wallet addresses.
Socket’s deep-dive research revealed that these hidden fragments were deliberately injected directly into live Sui blockchain transactions. Specifically, the extension issued minuscule SUI token transfers—amounts so vanishingly small that they would never draw the attention of the user or automated monitoring systems—to wallet addresses entirely controlled by the attacker.
Concealed deep inside those routine transactions, either tucked away inside memo fields or embedded within obfuscated addresses, were the broken-down pieces of the victim’s secret seed phrase.
This tactical approach provided significant advantages to the malicious actors. Most notably, it completely eliminated the need for the extension to send outbound network requests to external, malicious command-and-control servers. There was no suspicious beaconing activity, and no data exfiltration occurring over traditional HTTP or WebSockets protocols that might have been easily flagged by modern browser heuristics or local antivirus software.
Instead, the stolen payload left the user’s device disguised as a completely normal-looking blockchain transaction, safely routed through a widely utilized, low-fee layer-1 chain. Once successfully posted on-chain, the sensitive data became publicly accessible on a distributed ledger, allowing the attacker to calmly retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to interact with the victim’s device a second time.
In practice, the scammers ingeniously transformed the Sui blockchain itself into an encrypted communications channel. Because the Sui network boasts exceptionally fast transaction confirmation times and negligible gas fees, it functioned flawlessly as a low-latency message bus for the thieves.
Socket successfully traced multiple instances of these distinct seed-fragment transactions, definitively confirming the direct link between entering a phrase into the fake extension and the subsequent, catastrophic loss of assets. While the actual thefts of funds predominantly occurred off-chain—either on Ethereum or other major layer-1 networks where the victims’ wallets held substantial capital—the precise instructions required to carry out the robberies were hidden in plain sight across an entirely separate blockchain ecosystem.
Before deploying the final version that successfully captured top search results in the Chrome Web Store, the publisher likely experimented with and tested the methodology in private environments. Evidence uncovered by researchers indicates that earlier, developmental builds experimented with simpler, less sophisticated data leaks before the Sui-based encoding technique was fully refined.
By the time the active, malicious extension was finally flagged and reported by vigilant community members, it had accumulated enough automated installations to comfortably secure a spot in Chrome’s coveted "trending" tier, which further amplified its visibility to unsuspecting searchers. Reports circulated across social media platforms like Reddit and Telegram, yet the "Safery" wallet stubbornly remained perched near the top of the search results for Ethereum wallets even as community warnings began to mount.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension relied heavily on the inherent mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm primarily evaluates a combination of keyword matching, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden, sharp burst of user activity—particularly within specialized or niche categories like cryptocurrency—can climb rapidly through the directory rankings if better-established, thoroughly vetted competitors fail to update their listings frequently. In this particular instance, "Safery" benefited from a title that scored exceptionally well for common user search queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a remarkably fresh upload date that signaled high activity to the search algorithm.
There is no evidence indicating that Google’s trust and safety teams manually reviewed the listing prior to its automated publication. Standard Chrome Web Store policy subjects most newly submitted extensions to little more than a brief automated scan and fundamental static analysis.
Extensions typically undergo much deeper scrutiny only when they explicitly request elevated, high-risk permissions, such as continuous access to browser tabs, the system clipboard, local file systems, or browsing history. Legitimate crypto wallets frequently manage to bypass these stricter flags by operating safely within iframes or utilizing standard, pre-approved browser APIs. "Safery" expertly toed the line, remaining strictly within those permitted operational bounds.
Even when everyday users began to raise vocal concerns and submit reports regarding suspicious app behavior, the critical time window stretching between initial reporting and eventual store takedown proved wide enough for significant financial damage to occur. Part of this operational lag is structural: the Chrome Web Store does not act on flagged extensions instantly unless there is an overwhelming consensus of abuse or the detection of explicitly known malware signatures.
In this scenario, the payload relied entirely on obfuscated JavaScript interacting directly with public blockchain infrastructure rather than communicating with external, flagged web hosts. Consequently, traditional, signature-based malware detection methods completely failed to catch the threat in motion.
This incident is far from an isolated event within the browser extension ecosystem. Previous waves of crypto-related scams have frequently utilized similar vectors, ranging from fake Ledger Live desktop and browser applications that prompted unsuspecting users to type out their secret recovery phrases, to hijacked legitimate extensions where attackers managed to compromise the original developer’s publishing keys.
What truly set "Safery" apart, however, was the immaculate smoothness of its operational facade and the total absence of traditional backend infrastructure. There was no classic phishing website to take down, and no rogue command server to block; there was merely a single, functional extension quietly transmuting secret keys into public blockchain transactions and slipping away unnoticed.
For victims who fell prey to the scheme, recourse was narrow and heavily dependent on rapid action. Security researchers at Socket and other firms quickly published emergency triage steps for anyone who had installed the extension: uninstall the application immediately, systematically revoke all outstanding token approvals, sweep remaining digital assets to an entirely fresh, uncompromised wallet using a completely clean device, and closely monitor associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who stored large amounts of capital directly in vulnerable hot wallets, financial recovery remained virtually impossible.
The incident has intensified calls across the cybersecurity and Web3 communities for much stronger heuristics and preventative measures from Google itself. Among the various solutions currently proposed by developers is the implementation of automated flags for any browser extension that includes user interface elements prompting for standard 12- or 24-word recovery phrases.
Additional proposals include mandatory publisher attestation requirements for all wallet-related extensions, which would provide cryptographic, verifiable proof that a declared publisher actually controls the underlying codebase associated with a known, trusted wallet brand. Industry experts are also advocating for much tighter, more rigorous inspections of wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For the end user, security firms continue to stress the importance of rigorous due diligence. Before installing any browser extension linked to cryptocurrency management, users are advised to thoroughly review the publisher’s history, independently verify official associations with recognized development teams, inspect review patterns for telltale bursts of identical or templated feedback, cross-reference official website links with public code repositories on platforms like GitHub, and carefully scrutinize the permissions tab for vague or overly broad access requests.
Ultimately, the "Safery" incident highlights the complex, high-risk nature of relying on standard web browsers as the primary interface for decentralized finance. While browser extensions gained widespread popularity due to their unmatched accessibility and ease of use—allowing people to interact effortlessly with decentralized applications without installing standalone desktop software—that convenience has come at the severe expense of increased surface exposure. The modern web browser remains a high-risk operational environment vulnerable to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As threat actors continue to innovate and find novel ways to exploit the trust architecture of centralized app stores, both users and developers are forced to re-evaluate the fundamental safety of browser-based crypto management. Until more robust safeguards are implemented at the platform level, the burden of security will continue to rest heavily on the shoulders of individuals navigating an increasingly hostile digital landscape.
Raul Delapena Setiawan 
Muslim 
Siti Muinah