By Lina Irawan 
For a few critical days last November, a sophisticated and malicious browser extension managed to secure the fourth position for the search query "Ethereum wallet" on the official Chrome Web Store. The extension, deceptively named "Safery: Ethereum Wallet," was designed with enough polish and professional branding to easily pass as a legitimate tool to even seasoned cryptocurrency users. It featured a clean, professional icon, a generic name cleverly positioned alongside security-related terminology, a sudden and heavy flood of five-star reviews, and boilerplate descriptions that are universally familiar to anyone who has ever downloaded a digital asset manager.
However, hidden directly behind this convincing frontend was a purpose-built cyberattack designed to systematically steal sensitive seed phrases and instantly empty user wallets. The malicious code achieved this by ingeniously encoding the stolen user secrets into micro-transactions executed on the Sui blockchain. The threat was ultimately uncovered and thoroughly investigated by Socket, a prominent security tooling company focused on monitoring open-source software supply chains. Security researchers at Socket installed and analyzed the extension immediately after its detection to understand how "Safery" managed to completely evade automated detection mechanisms, rapidly climb the Chrome Store search rankings, and quietly exfiltrate private recovery phrases without raising immediate alarms. The resulting report serves as both a detailed postmortem of the security failure and a sobering warning that browser extensions continue to represent a dangerous and vulnerable blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy in the history of crypto exploits is that the malicious actors behind it did not bother to spoof an existing, high-profile wallet brand. It was not a poorly disguised MetaMask lookalike or a recycled phishing domain designed to catch careless typos. Instead, the attackers chose to invent an entirely new identity from scratch, purchasing or generating bots to flood the store with fake positive reviews to artificially inflate its search rankings, and successfully launching as a brand-new, independent wallet option. Because of this strategic approach, the extension’s listing displayed virtually no immediate red flags that users are typically trained to spot: there was no broken grammar in the descriptions, no obviously suspicious permissions requested, and no sudden redirections to shady, untrusted external domains.
Furthermore, the Chrome Web Store publisher page associated with the extension had no prior consumer complaints or historical flags, and its designated support URL directed visitors to an off-platform website that had not yet been flagged by major security trackers at the time of Socket’s analysis. Given its highly polished appearance and professional presentation, the vast majority of everyday users would not have hesitated for a single moment before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is an exceptionally common and necessary request for legitimate crypto wallets that must interact seamlessly with a wide variety of decentralized applications across the web.
Crucially, the malicious software did not prompt users for extra, suspicious permissions, nor did it attempt to inject aggressive content scripts that would typically trigger Chrome’s more intrusive security warnings. The overall branding remained minimalist, the accompanying website perfectly matched the extension’s name, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—behavior that is entirely standard across the industry.
The Seed Heist, Broadcast Over Sui
The real, irreversible damage began the exact moment a user entered their recovery seed phrase into the application. Instead of storing the sensitive phrase locally or securely encrypting it for user-controlled access, the extension silently fragmented the phrase into smaller pieces and encoded those fragments to look precisely like random, ordinary wallet addresses. According to Socket’s detailed technical research, these fragmented pieces of data were directly inserted into active Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—amounts so infinitesimal that they would never draw the attention of the account holder—and sent them directly to addresses controlled entirely by the malicious actors.
Hidden safely inside the metadata of those micro-transactions, either tucked neatly into memo fields or embedded within obfuscated addresses, were the broken-down components of the user’s private seed phrase. This novel approach provided the attackers with significant tactical advantages. The extension did not require any outbound network requests to malicious, external command-and-control servers. There was no suspicious beaconing or data exfiltration over HTTP or WebSockets that a traditional web browser or local antivirus software might instantly flag and block.
Instead, the stolen payload left the user’s device disguised as a completely normal, legitimate blockchain transaction, routed smoothly through a widely utilized and low-fee blockchain network. Once safely inscribed on-chain, the data was publicly accessible, allowing the attackers to retrieve it at their leisure, reconstruct the complete seed phrase, and completely sweep the victims’ assets without ever needing to touch the user’s device a second time. In effect, the scammers repurposed the Sui blockchain itself to act as an anonymous communications channel. Because the Sui network features remarkably fast transaction confirmation times and negligible gas costs, it functioned flawlessly as a low-latency message bus for the thieves.
Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of funds. While the actual thefts of cryptocurrency occurred off-chain—predominantly on Ethereum or other Layer 1 blockchain networks where the victims’ wallets held substantial capital—the precise instructions required to carry out the thefts were hidden entirely in plain sight on an entirely different ledger. Evidence indicates that the publisher likely tested this data-exfiltration methodology in private environments before releasing the final version that managed to capture top placement in Chrome’s wallet search results, having experimented with simpler data leaks in earlier, unreleased builds. By the time the active extension was finally flagged and removed, it had accumulated enough installations to comfortably reach Chrome’s "trending" tier, which further amplified its visibility and user acquisition. Reports from industry outlets confirmed that the fraudulent wallet remained prominently displayed near the top of search results even as early warnings and complaints began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged almost entirely on the specific ranking logic employed by the Chrome Web Store search algorithm. The store’s backend heavily weighs factors such as exact keyword matches, total install counts, review velocity, average user ratings, and the recency of the last software update. Consequently, malicious extensions that experience a sudden, manufactured burst of activity—especially within niche or highly sought-after categories like cryptocurrency wallets—can climb the charts rapidly if established, better-vetted competitors are not updated with equal frequency. In this specific scenario, "Safery" combined a high-value search term in its title, a blitz of positive ratings featuring duplicated or templated text, and a pristine, fresh upload date to game the system effectively.
There is no evidence to suggest that Google manually reviewed the listing prior to its publication. The standard operating procedure for the Chrome Web Store subjects most new extension submissions to a brief automated scan combined with fundamental static analysis. Deeper scrutiny is typically reserved only for extensions that request explicitly elevated or dangerous permissions, such as direct access to browser tabs, the user clipboard, local file systems, or browsing history. Because legitimate wallet extensions frequently manage to bypass these restrictive flags by operating safely within isolated iframes or leveraging approved browser APIs, "Safery" was able to remain strictly within those acceptable technical bounds.
Even when vigilant users began raising concerns and reporting the extension, the structural lag between initial reporting and official takedown stretched out long enough for substantial financial damage to occur. Chrome’s administrative framework does not act on flagged extensions instantaneously unless there is an overwhelming community consensus or the presence of a known, pre-compiled malware signature. In this case, because the malicious payload consisted of obfuscated JavaScript relying entirely on legitimate blockchain infrastructure rather than external malicious hosts, traditional automated malware detection methods failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to steal digital assets from unsuspecting crypto users. Previous high-profile scams have included fake Ledger Live companion apps prompting users to input their physical recovery phrases, or compromised legitimate extensions where attackers managed to hijack the original developer’s publishing keys. However, what fundamentally differentiated the "Safery" scam was the absolute smoothness of its frontend facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website that law enforcement or hosting providers could easily take down, and no command server to block; there was simply a single browser extension quietly translating private secrets onto a public blockchain network and walking away.
For impacted individuals, immediate recourse was extremely limited, though swift action could occasionally limit total exposure by rotating compromised seeds and revoking active smart contract token approvals. Security firms like Socket quickly published emergency triage steps for anyone who had mistakenly installed the extension: uninstalling the software immediately, revoking all existing token allowances, sweeping remaining digital assets to a brand-new wallet generated on a completely clean device, and closely monitoring all associated blockchain addresses. For users who failed to notice the silent exfiltration in time, or for those who maintained substantial balances in vulnerable hot wallets, financial recovery remained virtually impossible.
Security researchers and independent developers are now increasing pressure on Google to implement stronger heuristic defenses directly within the Chrome browser architecture. One widely discussed proposal involves automatically flagging and quarantining any browser extension that includes user interface elements specifically designed to prompt users for a standard 12- or 24-word recovery phrase. Another suggested countermeasure is the implementation of mandatory publisher attestation for all wallet-related extensions, providing cryptographic proof that a given publisher genuinely controls the underlying codebase of a recognized crypto brand. Furthermore, industry experts are calling for significantly tighter inspection protocols regarding wallet-related permissions, even when those permissions do not explicitly involve traditionally dangerous access patterns.
For end users navigating the web, security organizations continue to stress the importance of rigorous due diligence before installing any browser-based utility. Security checklists advise checking the historical background of the publisher, verifying direct associations with known and trusted software projects, inspecting review patterns for unnatural bursts of identical language, confirming the existence of a real corporate website with a public GitHub repository, and carefully scrutinizing the permissions tab for sweeping system access. Ultimately, this sophisticated exploit underscores the inherent vulnerabilities of relying on web browsers as the primary interface for decentralized finance, forcing both developers and users to reevaluate how trust is established and maintained in the modern crypto landscape.
Raul Delapena Setiawan 
Muslim 
Siti Muinah