By Dwi Wanna 
For a few days in November, a malicious Chrome extension quietly captured the fourth spot for the search query “Ethereum wallet” on the official Chrome Web Store. The extension, titled “Safery: Ethereum Wallet,” was meticulously engineered to pass as a completely legitimate piece of software, boasting a clean, professional icon, a generic name paired with security-adjacent terminology, a rapid influx of five-star reviews, and boilerplate descriptions that are instantly familiar to anyone who has ever downloaded a cryptocurrency wallet.
Beneath its polished, unassuming frontend, however, lay a purpose-built cyberattack designed explicitly to harvest user seed phrases and systematically drain victim wallets. Rather than relying on traditional, easily trackable methods of data exfiltration, the extension encoded stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light after security tooling company Socket, which focuses heavily on open-source software supply chains, installed and analyzed the extension following its discovery. The research team set out to understand how an application dubbed “Safery” managed to evade automated detection systems, rapidly climb the Chrome Store rankings, and exfiltrate sensitive seed phrases without raising immediate alarms, as well as what everyday users could do to spot similar emerging threats. Their resulting technical report serves as both a detailed postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular incident stands out because the malicious actors behind it did not resort to spoofing an existing, well-known wallet brand. It was neither a crude MetaMask lookalike nor a recycled phishing domain designed to catch careless typists. Instead, the creators invented a completely new identity from scratch, purchased or botted fake reviews to manipulate search rankings, and launched the software as a fresh, alternative wallet option.
Because of this unique approach, the store listing displayed virtually no immediate red flags. There was no broken grammar, no suspicious permissions requests, and no sudden redirection to shady third-party domains. The Chrome Web Store publisher page carried no prior complaints from users, and its provided support URL led to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s analysis.
Given its remarkably polished and professional appearance, the average user would likely have felt no hesitation before clicking the “Add to Chrome” button. The extension requested permission to run on “all websites,” which is a standard, highly common requirement for crypto wallets that need seamless integration with various decentralized applications across the web. Notably, it did not prompt for extra permissions or attempt to inject content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the accompanying website closely matched the name of the extension, and the initial setup screen naturally prompted users to create a brand-new wallet or import an existing one—behavior that is entirely standard across the industry.
The Seed Heist, Broadcast Over Sui
The true damage began the moment a user entered their recovery seed phrase. Instead of storing the phrase locally on the device or properly encrypting it for authorized user access, the extension silently fragmented the phrase into pieces and encoded them to resemble random, ordinary wallet addresses.
Socket’s research revealed that these fragments were carefully inserted into Sui blockchain transactions. Specifically, the extension executed tiny SUI token transfers—minuscule monetary amounts that would never draw the attention of a casual observer—directed toward addresses completely controlled by the attacker. Hidden deep inside those transactions, either tucked away in memo fields or disguised within obfuscated addresses, were the broken-down components of the victim’s seed phrase.
This tactical approach offered significant advantages to the attackers. It completely eliminated the need for the extension to send outbound network requests to malicious, external servers. There was no command-and-control beacon operating in the background, and there was no data exfiltration occurring over standard HTTP or WebSockets protocols that an ordinary browser extension monitor or desktop antivirus software might flag.
Instead, the payload left the user’s local device disguised as a completely normal-looking blockchain transaction, smoothly routed through a widely used, exceptionally low-fee layer-1 network. Once the data successfully landed on-chain, it was publicly accessible, allowing the operator to retrieve it at their leisure, reconstruct the original seed phrase, and completely sweep the victim’s funds without ever needing to touch the user’s device again.
In effect, the scam utilized the Sui blockchain itself as a covert communications channel. Because the Sui network features remarkably fast transaction confirmation times and negligible fees, it functioned essentially as a low-latency message bus for the thieves. Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the subsequent loss of assets. While the actual thefts occurred off-chain—predominantly on Ethereum or other layer-1 networks where the victims’ wallets held substantial capital—the precise instructions required to carry them out were hidden entirely in plain sight.
Before releasing the final version that managed to secure a spot in Chrome’s top wallet search results, the publisher almost certainly tested the underlying method in private environments. Digital evidence indicates that earlier, unreleased builds experimented with simpler, more rudimentary data leaks before the Sui encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to reach Chrome’s coveted “trending” tier, which further amplified its visibility to unsuspecting users. Reports highlighted that the Safery wallet managed to sit comfortably among the top results for Ethereum wallet searches even as initial warnings and reports of suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged primarily on the underlying mechanics of Chrome’s search and discovery ranking logic. The Web Store search algorithm continuously weighs factors such as keyword matching, total install counts, review velocity, average user ratings, and the recency of software updates.
Extensions that experience a sudden, unnatural burst of activity—particularly within niche or high-demand categories—can climb the rankings rapidly if better-vetted competitors are not updated with equal frequency. In this specific scenario, Safery combined a high-scoring name for common search queries with a blitz of positive reviews, many of which were clearly templated or duplicated, alongside a very fresh upload date that signaled active maintenance.
There is no evidence to suggest that Google performed a manual human review of this listing prior to its publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan and fundamental static code analysis. Extensions generally only undergo deeper, more rigorous scrutiny when they request explicitly elevated permissions, such as broad access to tabs, user clipboards, local file systems, or browsing history.
Wallet extensions frequently manage to bypass these elevated risk flags by operating securely within iframes or by leveraging standard, pre-approved APIs. Safery carefully stayed well within those acceptable operational bounds. Even when vigilant users began raising urgent concerns, the inevitable lag time between initial reporting and official takedown stretched out long enough for extensive damage to occur.
Part of that delay is structural: the Chrome ecosystem does not automatically disable or remove flagged extensions instantly unless there is an overwhelming consensus of reports or known, matching malware signatures. In this case, the payload consisted entirely of heavily obfuscated JavaScript that relied strictly on existing blockchain infrastructure rather than external hosting servers, meaning traditional automated malware detection mechanisms failed to catch it in time.
This incident is far from the first time browser extensions have been weaponized to target cryptocurrency users. Previous notable scams have included fake Ledger Live companion applications prompting users to enter their confidential recovery phrases, as well as compromised legitimate extensions that allowed unauthorized attackers to gain access to a developer’s official publishing keys.
What truly sets the Safery incident apart, however, is the remarkable smoothness of its digital facade and the complete absence of traditional backend infrastructure. There was no vulnerable phishing website that law enforcement or hosting providers could easily take down, and there was no central command server to block—just a single browser extension quietly depositing hidden secrets onto a public blockchain network and walking away without a trace.
Users who fell victim still had limited options for recourse if they acted with extreme speed. By moving quickly, they could minimize their exposure by rotating their seed phrases and immediately revoking any outstanding token approvals. Security analysts from Socket and other firms rushed to provide triage steps for anyone who had installed the application: uninstall the extension immediately, revoke all active token approvals, sweep remaining assets to a fresh wallet generated on an entirely clean device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who maintained substantial capital holdings in vulnerable hot wallets, asset recovery remained virtually impossible.
The situation has prompted security researchers, developers, and industry observers to call for significantly stronger heuristics from Google’s review teams. One prominent proposal involves automatically flagging and holding any extension that includes user interface elements specifically designed to prompt users for a standard 12- or 24-word recovery phrase.
Another suggested defense mechanism is requiring mandatory publisher attestation for all wallet-related extensions, providing verifiable, cryptographic proof that a given publisher officially controls the underlying codebase of a recognized wallet brand. Furthermore, experts have urged tighter scrutiny regarding permissions requested by financial extensions, even when those requests do not feature traditionally dangerous access patterns.
For everyday cryptocurrency users, security firms continue to stress the importance of rigorous personal verification habits. Before installing any crypto-related browser extension, users are strongly advised to thoroughly review the publisher’s historical track record, verify direct associations with known and trusted projects, carefully inspect review patterns for obvious bursts of identical or botted text, confirm the existence of real organizational websites with active public code repositories, and scrutinize permission tabs for overly broad access. A clean name and a high star rating are simply no longer enough to guarantee safety in the modern Web3 landscape.
This troubling case raises much broader questions about the inherent role of standard web browsers in the decentralized finance era. Browser-based wallets originally gained widespread popularity due to their exceptional accessibility and ease of use, allowing everyday participants to interact seamlessly with complex decentralized applications without needing to switch platforms or install standalone native applications.
That convenience, however, has come at a severe security cost. The modern web browser remains an inherently high-risk operating environment subject to persistent threats like extension manipulation, session hijacking, clipboard scrapers, and now covert blockchain-based data exfiltration. As threats continue to evolve, wallet developers will likely be forced to rethink their overall distribution models. Some development teams already actively discourage Chrome Web Store installations altogether, preferring to direct users toward dedicated mobile applications or verified desktop binaries, while others may implement native warnings for users attempting to install unverified software.
The core underlying problem persists: software distribution remains heavily fragmented, and the vast majority of users lack the technical expertise required to reliably distinguish a legitimate, secure wallet from a polished, malicious clone. The Safery extension demonstrated that attackers no longer need to impersonate established giants like MetaMask or Phantom to succeed; they can effortlessly invent their own synthetic brands, manufacture artificial trust signals, and construct invisible backdoors utilizing public blockchains as independent couriers.
This reality demands a fundamental reassessment of how trust is established and verified in crypto user experiences, and just how close to the digital metal even casual tools like browser extensions really operate. Crypto users frequently operate under the comforting assumption that Web3 technology guarantees absolute sovereignty and self-custody. Yet in the wrong hands, a standard browser wallet functions less like a secure digital vault and more like an open port—and the browser will not always warn you before something slips through the cracks.
Raul Delapena Setiawan 
Muslim 
Siti Muinah