By Nana Muazin 
For a brief period last November, a sophisticated malicious Chrome extension managed to climb the ranks on the official Chrome Web Store, securing the fourth position for the heavily trafficked search term "Ethereum wallet." The software, deceptively named "Safery: Ethereum Wallet," was engineered to look remarkably polished and professional, easily passing as a legitimate product to unsuspecting everyday cryptocurrency users.
The extension featured a clean, professional icon, a generic yet reassuring name adjacent to security-focused language, a massive influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a standard crypto wallet. However, lurking behind this convincing frontend was a purpose-built attack mechanism specifically designed to harvest seed phrases and systematically drain user wallets by encoding the stolen secrets into micro-transactions executed on the Sui blockchain.
Following its discovery, Socket, a prominent security tooling company specializing in open-source software supply chains, installed and thoroughly analyzed the extension. Their primary objective was to dissect how "Safery" managed to evade automated detection systems, successfully manipulate the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without triggering immediate security alarms. Furthermore, the analysis sought to determine what preventative steps users could take to spot similar novel threats in the wild. The resulting security report serves as a detailed postmortem and an alarming reminder that browser extensions remain a dangerous and frequently overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy within the threat intelligence community is that the malicious actors behind Safery did not rely on traditional spoofing tactics. Unlike many historical scams that attempt to clone an existing wallet brand by masquerading as a MetaMask lookalike or utilizing a recycled phishing domain, Safery invented an entirely original identity. The creators purchased or deployed networks of bot-generated fake reviews to artificially boost search rankings and launched the software as a brand-new, independent wallet option.
This calculated approach meant that the store listing displayed virtually no immediate red flags. There was no broken grammar, no suspicious permission requests, and no automatic redirection to shady external domains. The Chrome Web Store publisher page carried no prior user complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by any security tracking services at the time of Socket’s analysis.
Given its remarkably polished and professional appearance, the vast majority of everyday users would not have hesitated before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites"—a standard and necessary request for genuine crypto wallets that must interact seamlessly with a wide variety of decentralized applications. Notably, it did not prompt for extra, anomalous permissions or attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive automated warnings. The branding was minimalist, the accompanying website mirrored the extension’s exact name, and the initial setup screen naturally prompted users to either create a new wallet or import an existing one, mimicking standard industry behavior.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment a user entered their recovery seed phrase. Instead of storing the phrase locally on the device or properly encrypting it for legitimate user access, the extension silently split the recovery words into smaller fragments. It then encoded these fragments into what outwardly appeared to be completely random, innocuous wallet addresses.
Detailed research conducted by Socket demonstrated that these critical fragments were surreptitiously inserted directly into Sui blockchain transactions. Specifically, the extension initiated tiny SUI token transfers—minuscule monetary amounts intentionally chosen to draw zero attention—and sent them directly to addresses controlled directly by the threat actors. Hidden inside those blockchain transactions, either embedded within memo fields or cleverly obfuscated inside the transaction addresses themselves, were the discrete pieces of the victim’s seed phrase.
This inventive approach provided the attackers with significant tactical advantages. Crucially, it did not require the extension to send outbound network requests to malicious command-and-control servers. There was no suspicious beaconing activity or data exfiltration over standard HTTP protocols or WebSockets that a modern browser or traditional antivirus software might flag and block.
Instead, the payload left the user’s device disguised as a perfectly normal-looking blockchain transaction, efficiently routed through a widely used, low-fee layer-1 network. Once successfully recorded on-chain, the fragmented data was publicly accessible, permitting the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and subsequently sweep the victim’s funds without ever needing to touch the user’s device a second time.
In effect, the cybercriminals utilized the Sui blockchain itself as a covert communications channel. Because the Sui network boasts exceptionally fast confirmation times and negligible transaction costs, it functioned flawlessly as a low-latency message bus for the stolen data. Socket successfully traced multiple instances of these anomalous seed-fragment transactions, definitively confirming the direct causal link between the initial seed entry within the fake extension and the eventual loss of digital assets. While the actual thefts of funds occurred off-chain—primarily on Ethereum or other layer-1 networks where the victims’ wallets held significant balances—the operational instructions required to carry them out were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s prominent wallet search results, the publisher almost certainly tested the underlying methodology in private. Forensic evidence suggests that earlier, abandoned builds experimented with simpler data leakage techniques before the Sui blockchain encoding method was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installs to comfortably reach Chrome’s "trending" tier, which further amplified its visibility. Reports from industry outlets confirmed that the Safery wallet remained perched among the top results for Ethereum wallet searches even as anxious users began circulating warnings of suspicious behavior across platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged directly on the underlying mechanics of Chrome’s search and discovery ranking logic. The Web Store search algorithm evaluates a complex combination of factors, including keyword matching, total install counts, review velocity, average star ratings, and the recency of updates.
Extensions that experience a sudden, sharp burst of activity, particularly within specialized niche categories, can climb search rankings rapidly if better-vetted competitors are not updated frequently. In this case, Safery benefited from a strategically chosen name that scored exceptionally well for common user queries, a rapid blitz of positive reviews that often featured templated or duplicated text, and a fresh upload timestamp.
There is currently no evidence to suggest that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy treats most new extension submissions with a brief automated scan and fundamental static analysis. Extensions typically undergo deeper scrutiny only when they request elevated and dangerous permissions, such as direct access to browser tabs, the clipboard, local file systems, or browsing history. Genuine wallet extensions often manage to avoid triggering these strict flags by operating carefully within isolated iframes or by utilizing officially approved browser APIs, and Safery successfully stayed within those permitted operational bounds.
Even when vigilant users raised concerns and submitted reports, the lag time between the initial reporting and the eventual takedown by store administrators stretched on long enough for substantial financial damage to occur. Part of this delay is structural: the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or known malware signatures detected. Because the payload consisted of obfuscated JavaScript relying entirely on legitimate blockchain infrastructure rather than external malicious hosts, traditional automated malware detection methods failed to catch it.
This incident is part of a broader, ongoing trend of browser extensions being weaponized to target cryptocurrency users. Previous high-profile scams have included fake Ledger Live applications that deceptively prompted users to enter recovery phrases, as well as instances where legitimate, established extensions were hijacked to allow threat actors access to the original developer’s publishing keys. However, what distinguished Safery from many of its predecessors was the remarkable smoothness of its frontend facade and the total absence of traditional backend infrastructure. There was no phishing website to take down and no command server to block, just a single browser extension quietly moving secrets onto a public blockchain and walking away.
For impacted users, recourse was severely limited. Those who acted with extreme swiftness could occasionally mitigate their exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized finance protocols. Security firms published urgent triage steps for anyone who had installed the extension: uninstall the software immediately, revoke all active token approvals, securely transfer remaining digital assets to a brand-new wallet generated on a completely clean device, and continuously monitor associated addresses for unauthorized activity. For users who failed to notice the silent exfiltration in time, or those who stored large asset balances in vulnerable hot wallets, asset recovery remained virtually impossible.
Security researchers, developers, and industry analysts are now calling for significantly stronger heuristics from Google and browser extension marketplaces. One leading proposal is to implement automated rules that immediately flag and quarantine any extension that incorporates user interface elements prompting for a standard 12-word or 24-word recovery phrase. Another suggested defense is to mandate publisher attestation for all wallet-related extensions, providing cryptographic, verifiable proof that a given publisher officially controls the recognized codebase behind a known wallet brand. Furthermore, there are widespread calls for tighter, more rigorous inspections of wallet-related permissions, even when those permissions do not explicitly involve dangerous access patterns.
For end users navigating the web, security experts emphasize that a clean visual presentation, a professional name, and a high star rating are simply no longer sufficient guarantees of safety. The case of the Safery wallet has forced a broader, uncomfortable industry conversation regarding the inherent risks of relying on web browsers as the primary interface for decentralized finance. While browser-based wallets gained widespread popularity due to their accessibility and ease of use, allowing users to interact smoothly with decentralized applications without installing standalone desktop software, that convenience has come at a severe security cost. The modern web browser remains a high-risk environment uniquely vulnerable to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain exfiltration.
As the ecosystem grapples with these vulnerabilities, wallet developers are likely to rethink their distribution models entirely. Some development teams already actively discourage users from installing software through the Chrome Web Store, favoring dedicated standalone mobile applications or verified desktop binaries instead. Others may soon implement built-in warnings whenever users attempt to install wallet software from unverified or newly registered publisher accounts. Ultimately, the core structural problem persists: software distribution remains fragmented, and the average user is ill-equipped to distinguish a polished, professional clone from a legitimate financial tool. The Safery extension proved that threat actors no longer need to impersonate established household names to steal funds; they can construct their own synthetic trust, deploy an invisible backdoor, and use the blockchain itself as a courier, exposing the reality that in the wrong hands, a browser wallet functions less like a secure digital vault and more like an open port.
Raul Delapena Setiawan 
Muslim 
Siti Muinah