By Ali Ikhwan 
For a few critical days in November, a malicious browser extension masquerading as a crypto tool climbed the rankings to become the fourth overall search result for the term “Ethereum wallet” on the official Chrome Web Store.
The extension, bearing the deceptive title “Safery: Ethereum Wallet,” was meticulously designed to project an aura of absolute legitimacy. It featured a clean, professional icon, a generic name carefully chosen to sit adjacent to trusted security language, a rapid influx of five-star reviews, and boilerplate descriptions that immediately look familiar to anyone who has ever downloaded a cryptocurrency management tool. Behind this polished frontend, however, lay a sophisticated, purpose-built attack mechanism engineered to harvest seed phrases and systematically drain user wallets by encoding stolen sensitive data into micro-transactions executed on the Sui blockchain.
The operation came to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its sudden discovery. The primary objective of the security researchers was to understand how “Safery” managed to successfully bypass Google’s automated detection systems, rapidly climb the competitive Chrome Store search rankings, and exfiltrate stolen seed phrases without triggering internal alarms or alerting security software. Their subsequent postmortem report serves as both a detailed technical breakdown of the attacker’s methodology and a sobering warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy for cybersecurity professionals is that the hackers behind the scheme did not rely on traditional spoofing tactics. In the past, malicious actors frequently attempted to mimic existing, established wallet brands by creating MetaMask lookalikes or deploying recycled phishing domains. Safery, by contrast, forged an entirely new identity. It invented a brand from scratch, utilized purchased or automated bot-generated fake reviews to manipulate search engine optimization within the store, and launched quietly as a completely novel wallet option.
This calculated approach meant the store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious or overly broad permissions requested upfront, and no redirection to sketchy, untrusted external domains. Furthermore, the Chrome Web Store publisher page maintained a spotless record with zero prior complaints, and its designated support URL directed users to an off-platform website that had not yet been flagged by any security tracking services at the time of Socket’s analysis.
Given its pristine appearance and high apparent ranking, the average web user would likely have felt little hesitation before clicking the “Add to Chrome” button. Like many legitimate utilities, the extension requested permission to run across “all websites,” which is a standard operational requirement for crypto wallets that must interact seamlessly with decentralized applications. Crucially, it refrained from prompting for extra permissions or attempting to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding remained minimalist, the accompanying website matched the extension’s name precisely, and the initial setup screen guided users through standard procedures to either create a brand-new wallet or import an existing one.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment an unsuspecting user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or encrypting it securely for user access, the extension silently fractured the phrase into discrete pieces. It then encoded these fragments to resemble random, innocuous wallet addresses.
Socket’s comprehensive research revealed that these fragments were subsequently embedded directly into Sui blockchain transactions. Specifically, the extension initiated tiny, minuscule SUI token transfers—amounts so negligible that they would never draw the attention of the user or network monitors—to specific blockchain addresses controlled directly by the attackers. Embedded within those micro-transactions, either hidden cleverly inside memo fields or obfuscated within the transaction addresses themselves, were the vital components of the victim’s seed phrase.
This tactical strategy provided significant advantages to the malicious actors. Most importantly, it completely eliminated the need for the extension to send outbound network requests to external, malicious command-and-control servers. There were no outgoing HTTP beacons or persistent WebSocket connections that a browser monitor, firewall, or antivirus program might easily flag as suspicious activity.
Instead, the stolen payload departed the victim’s device disguised as a completely normal, everyday blockchain transaction, neatly routed through a widely utilized, low-fee blockchain network. Once successfully recorded on-chain, the sensitive data remained publicly accessible, allowing the attackers to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep the victims’ funds across various layer-one networks without ever needing to touch the user’s device a second time.
In effect, the scam repurposed the Sui blockchain infrastructure to function as an alternative communications channel. Because the Sui network offers exceptionally fast transaction confirmation times and negligible fees, it operated with the efficiency of a low-latency message bus. Socket successfully traced multiple instances of these unique seed-fragment transactions, definitively confirming the direct causal link between the entry of a seed phrase into the extension and the subsequent loss of digital assets. While the actual thefts occurred off-chain on networks like Ethereum or other layer-one blockchains where the victims happened to hold funds, the operational instructions required to execute the thefts were hidden entirely in plain sight.
Before releasing the final iteration that successfully captured top placement in Chrome’s wallet search results, the publisher likely tested the methodology extensively in a private environment. Evidence uncovered during the analysis indicates that earlier, experimental builds tested simpler data leaks before the Sui encoding technique was fully refined. By the time the active, dangerous extension was formally flagged, it had accumulated enough installations to secure a coveted spot in Chrome’s “trending” tier, which further amplified its visibility to prospective victims. Reports confirmed that the fake wallet remained prominently displayed among the top results for Ethereum wallet searches even as early warnings regarding its suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged primarily on the underlying mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm continuously weighs multiple factors, including keyword matches, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden surge in activity, particularly within specialized or niche categories, can climb search results rapidly if better-vetted, legitimate competitors are not updated frequently. In this case, Safery benefited from an optimized title that scored exceptionally well for common user queries, a coordinated blitz of positive reviews that often featured duplicated or templated text, and a fresh upload timestamp.
Available evidence does not indicate that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief automated scan and fundamental static analysis. Deeper scrutiny is typically reserved for extensions that request explicitly elevated permissions, such as direct access to browser tabs, local clipboards, file systems, or browsing history. Because crypto wallets frequently bypass these specific flags by operating within isolated iframes or utilizing standard, approved developer APIs, Safery easily stayed within acceptable administrative bounds.
Even after users noticed anomalous behavior and raised concerns, the lag time between initial public reporting and the eventual administrative takedown stretched on long enough for substantial financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not automatically remove flagged extensions instantly unless there is an overwhelming consensus of reports or a recognized, signature-based malware match. Because the payload consisted of obfuscated JavaScript that relied exclusively on legitimate blockchain infrastructure rather than traditional external servers, conventional malware detection heuristics failed to catch it in time.
This incident is far from the first instance of browser extensions being weaponized to steal digital assets from unsuspecting users. Previous notable scams have included fraudulent Ledger Live applications that prompted users to input their secret recovery phrases, or compromised legitimate extensions where attackers managed to hijack the original developer’s publishing cryptographic keys.
What truly distinguished Safery from previous attacks, however, was the remarkable polish of its facade paired with the complete absence of traditional backend infrastructure. There was no centralized phishing website to shut down and no rogue server IP address to block—just a single browser extension quietly depositing confidential secrets onto a public blockchain and walking away cleanly.
Impacted users retained limited options for recourse. Those who acted with extreme speed could minimize their overall exposure by immediately rotating their seed phrases and revoking any active transaction approvals linked to their accounts. Security analysts, including the team at Socket, quickly published triage recommendations for anyone who had installed the extension: uninstall the software immediately, revoke all token spending approvals, transfer remaining digital assets to an entirely new wallet using a clean, uncompromised device, and closely monitor all associated addresses for unauthorized activity. For everyday users who failed to notice the silent exfiltration or who kept substantial balances stored permanently in hot wallets, the prospects of recovering lost funds remained exceedingly slim.
Security researchers and independent software developers are now intensifying calls for stronger detection heuristics directly from Google and other browser vendors. One prominent proposal involves automatically flagging and quarantining any browser extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another suggested defense mechanism is to mandate publisher attestation for all wallet-related extensions, providing verifiable, cryptographic proof that a given publisher officially controls the codebase behind a recognized wallet brand. Industry voices are also advocating for much tighter scrutiny surrounding wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For the average end user, security experts emphasize that a clean product name and a high star rating are simply no longer sufficient guarantees of safety. The incident highlights the inherent vulnerabilities of relying heavily on browser environments for decentralized finance applications. While browser wallets surged in popularity due to their accessibility and ease of use—allowing individuals to interact seamlessly with decentralized applications without switching platforms or downloading standalone desktop software—that convenience has come at a significant security cost.
The modern browser remains a high-risk operational environment susceptible to extension manipulation, session hijacking, clipboard scrapers, and covert blockchain exfiltration vectors. As the threat landscape continues to evolve, developers and users alike are forced to re-evaluate the fundamental models of digital asset distribution, moving toward more secure, verified channels as the crypto community confronts the sobering reality of invisible backdoors hidden within everyday software.
Raul Delapena Setiawan 
Muslim 
Siti Muinah