By Neng Nana 
For a few critical days last November, a sophisticated malicious Chrome extension managed to climb the ranks of the Chrome Web Store, positioning itself as the fourth organic search result for the high-intent query “Ethereum wallet.”
Disguised under the name “Safery: Ethereum Wallet,” the application possessed all the visual hallmarks of legitimate software. It featured a crisp, professional icon, a generic yet reassuring name adjacent to standard security terminology, a sudden and overwhelming influx of five-star reviews, and boilerplate descriptions that instantly look familiar to anyone who has ever ventured into the world of decentralized finance and downloaded a crypto wallet.
Beneath that polished frontend, however, lay a purpose-built attack mechanism engineered to quietly harvest user seed phrases and systematically drain victim wallets. Rather than relying on traditional, easily flagged exfiltration methods, the extension encoded stolen secrets directly into micro-transactions executed on the high-speed Sui blockchain.
The threat was brought to light and thoroughly dissected by Socket, a prominent security tooling company that specializes in monitoring and analyzing open-source software supply chains. Following the discovery, Socket’s security researchers installed and analyzed the extension to understand how “Safery” successfully bypassed automated detection systems, manipulated Chrome Store search rankings, and exfiltrated sensitive seed phrases without triggering alarms. Their subsequent technical report serves as both a detailed postmortem of the incident and a stark reminder that browser extensions remain a persistent, high-risk blind spot in the broader cryptocurrency ecosystem.
What makes this particular campaign especially noteworthy to cybersecurity experts and digital asset holders is that the threat actors did not rely on traditional phishing tactics. They did not attempt to spoof an existing, trusted wallet brand, nor did they deploy a MetaMask lookalike or recycle a shady phishing domain. Instead, the malicious actors manufactured an entirely new identity from scratch. They purchased or generated bot-driven fake reviews to artificially inflate their search engine optimization and platform rankings, launching their creation cleanly as a completely "new" wallet option on the market.
This calculated approach ensured that the listing displayed virtually none of the classic red flags that savvy internet users have learned to spot. There was no broken English or awkward grammar in the descriptions, no bizarre or overreaching permission requests, and no suspicious redirections to sketchy third-party domains. Furthermore, the Chrome Web Store publisher page carried no prior user complaints or black marks, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by any security tracking services at the time of Socket’s analysis.
Given its professional appearance and seamless presentation, the average user would have encountered very little friction or hesitation before clicking the “Add to Chrome” button. Like many legitimate Web3 tools, the extension requested permission to run on “all websites”—a standard necessity for crypto wallets that need to interact fluidly with decentralized applications across the web. Notably, it refrained from prompting for extra permissions or attempting to inject complex content scripts that might have tripped Chrome’s more aggressive automated security warnings. Its branding remained minimalist, its companion website cleanly matched the extension’s name, and its initial setup screen simply prompted users to either create a brand-new wallet or import an existing one, mimicking entirely standard industry behavior.
The Seed Heist, Broadcast Over Sui
The real, unmitigated damage began the moment an unsuspecting user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or encrypting it securely for user access, the extension silently dissected the phrase into fragments. It then cunningly encoded those fragments to make them resemble random, innocuous wallet addresses.
Socket’s comprehensive research revealed that these broken-down fragments were systematically inserted directly into Sui blockchain transactions. Specifically, the malicious extension executed tiny, minuscule SUI token transfers—amounts so negligible that they would never draw the attention of automated monitoring or cautious users—sending them directly to addresses controlled and maintained by the attackers.
Hidden discreetly inside those routine-looking blockchain transactions, either buried within memo fields or cleverly obfuscated as recipient addresses, were the exact pieces of the victim’s seed phrase.
This tactical execution offered profound advantages for the hackers. It completely eliminated the need for the extension to send outbound network requests to malicious command-and-control servers. There were no outgoing HTTP beacons, WebSockets, or suspicious data leaks that a standard browser security layer, firewall, or antivirus program might intercept and flag.
Instead, the payload left the user’s device disguised as an entirely normal-looking blockchain transaction, routed seamlessly through a widely used, exceptionally low-fee layer-1 network. Once successfully posted on-chain, the data became publicly accessible yet entirely obscure to the casual observer, enabling the attacker to retrieve the pieces at their leisure, reconstruct the complete seed phrase, and systematically sweep connected assets clean without ever needing to touch the user’s compromised device a second time.
In effect, the operation weaponized the Sui blockchain itself, turning it into a covert communications channel. Because the Sui network boasts remarkably fast transaction confirmation times and virtually negligible transaction costs, it functioned identically to a low-latency message bus for the cybercriminals.
Socket successfully traced multiple distinct examples of these seed-fragment transactions on-chain, confirming the direct correlation between entering a seed phrase into the extension and the subsequent, rapid loss of assets. While the actual thefts of funds occurred off-chain—predominantly on Ethereum and other major layer-1 networks where the victims’ wallets held substantial capital—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the polished version that ultimately captured a top slot in Chrome’s wallet search results, the publisher likely tested the methodology in private experimental builds. Evidence uncovered during the investigation suggests that earlier iterations experimented with simpler, noisier data leaks before the Sui encoding technique was fully refined and optimized for stealth.
By the time the active extension was finally flagged and reported, it had accumulated enough automated and organic installations to breach Chrome’s “trending” tier, which further amplified its visibility to trusting users. Reports indicated that the “Safery” wallet stubbornly maintained its prominent position among the top search results for “Ethereum wallet” even as urgent warnings and discussions regarding its suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the “Safery” operation hinged heavily on the underlying mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm evaluates a complex matrix of factors, including keyword matching, total install counts, review velocity, average user ratings, and the recency of the last update.
Extensions that experience a sudden, concentrated burst of user activity—particularly within specialized or niche categories—can climb search rankings rapidly, especially if established, better-vetted competitor applications are not updated with matching frequency. In this scenario, “Safery” leveraged a keyword-optimized title that scored exceptionally well for common user queries, a rapid blitz of positive reviews that were largely templated or duplicated, and a fresh upload date that signaled active maintenance.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief, automated scanning process alongside fundamental static analysis.
Deeper scrutiny is typically reserved for extensions that request heavily elevated permissions, such as direct access to browser tabs, system clipboards, local file systems, or browsing history. Crypto wallet extensions frequently manage to bypass these stricter flags by operating carefully within isolated iframes or utilizing standard, approved developer application programming interfaces. “Safery” stayed strictly within those permitted operational bounds.
Even when vigilant users raised early concerns and submitted reports, the mandatory lag time between reporting and eventual takedown stretched on long enough for extensive damage to occur. Part of this delay is structural; the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of abuse or a match against known malware signatures.
In this specific case, the payload consisted entirely of heavily obfuscated JavaScript code that relied exclusively on legitimate blockchain infrastructure rather than external, malicious host servers. Traditional, legacy malware detection methods were entirely unequipped to catch it.
This incident is far from an isolated event in the ongoing security challenges facing browser environments. Previous crypto scams have ranged from fake Ledger Live desktop applications prompting users for recovery phrases to compromised legitimate extensions where attackers managed to hijack the original developer’s publishing keys.
What made “Safery” distinctly dangerous, however, was the immaculate smoothness of its public facade combined with the complete absence of traditional backend infrastructure. There was no centralized phishing website to shut down, no malicious server IP address to block, and no command center to dismantle—just a single extension quietly transcribing secrets onto a public ledger and walking away.
Impacted users were left with very narrow windows of recourse. For those who acted with extreme swiftness, limiting exposure required immediately rotating seed phrases, revoking all active token spending approvals, sweeping remaining assets to a fresh wallet generated on a completely clean device, and monitoring associated addresses for unauthorized activity. For everyday users who failed to notice the silent exfiltration or who maintained substantial capital balances in vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers and independent developers are now aggressively pushing for more sophisticated heuristics directly from Google and the Chrome team. Among the primary proposals is a system that would automatically flag and hold any extension whose user interface elements attempt to prompt individuals for a standard 12- or 24-word recovery phrase.
Additional recommendations include mandating strict publisher attestation frameworks for crypto-related browser extensions, providing verifiable cryptographic proof that a listed publisher genuinely controls the underlying codebase of a recognized wallet brand. Experts have also called for much tighter, more rigorous inspections of wallet-related permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For everyday users navigating the web, security analysts have published practical checklists for safer extension management. Before installing any decentralized finance or crypto-related browser tool, individuals are advised to thoroughly review the publisher’s historical track record, independently verify official associations with known and trusted projects, carefully inspect review patterns for unnatural bursts of identical or templated feedback, cross-reference official website links with verified public repositories, and scrutinize permission tabs for overly broad access requests.
As this incident demonstrates, a clean interface name and a five-star rating are no longer sufficient guarantees of safety. The situation raises fundamental, lingering questions regarding the browser’s expanding role as a primary gateway for cryptocurrency management. Browser-based wallets exploded in popularity largely due to their high accessibility and user-friendly design, enabling individuals to interact seamlessly with decentralized applications without installing heavy standalone software.
That accessibility, however, has come at a severe security cost. The modern web browser remains a high-risk operational environment acutely vulnerable to extension manipulation, session hijacking, clipboard scrapers, and, as demonstrated by this campaign, covert blockchain-based data exfiltration.
Industry analysts expect that wallet developers will increasingly rethink their long-term distribution models. While some development teams already actively discourage Chrome Web Store installations in favor of standalone mobile applications or verified desktop binaries, others may soon implement proactive in-app warnings designed to deter users from acquiring tools through unverified third-party channels.
The core systemic issue remains unresolved: software distribution is heavily fragmented, and the vast majority of casual users lack the technical expertise required to distinguish a legitimate financial vault from a polished, malicious clone.
The “Safery” extension did not need to impersonate MetaMask or masquerade as Phantom to achieve its goals. It simply fabricated its own trustworthy brand, engineered artificial social proof, and constructed an invisible digital backdoor that utilized an unrelated public blockchain as its private courier.
This sophisticated campaign serves as an urgent catalyst for a broader industry-wide reevaluation of how trust is established within cryptocurrency user experiences, and how dangerously close to the metal even casual tools like browser extensions truly operate. Users frequently enter the Web3 space operating under the comforting assumption that decentralization guarantees absolute financial sovereignty and self-custody. But in the hands of malicious actors, an unvetted browser wallet ceases to function as a digital vault—transforming instead into an open port. And the browser will not always warn you before something slips through.
Raul Delapena Setiawan 
Muslim 
Siti Muinah