By Asro 
For a few critical days in November, a meticulously crafted malicious Chrome extension managed to climb the ranks of the Chrome Web Store, securing the fourth position for the heavily trafficked search term "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," was engineered to look professional enough to pass completely undetected by the average user. It featured a clean, modern icon, a generic yet comforting name adjacent to essential cybersecurity terminology, a flood of glowing five-star reviews, and boilerplate descriptions that instantly feel familiar to anyone who has ever navigated the world of decentralized finance and downloaded a cryptocurrency wallet.
Beneath that polished frontend, however, lay a sophisticated, purpose-built attack mechanism. The extension was designed explicitly to steal user seed phrases and completely empty user wallets by cleverly encoding stolen secrets into micro-transactions executed directly on the Sui blockchain.
The campaign came to light after security tooling company Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its discovery in the wild. Their primary objective was to understand how "Safery" successfully evaded automated detection systems, rapidly climbed the Chrome Store search rankings, and exfiltrated sensitive seed phrases without ever raising alarms. Furthermore, the security team sought to determine what users could do to spot similar emerging threats in the future. Their resulting technical report walks through the attacker’s innovative approach, serving simultaneously as a forensic postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case deeply noteworthy to cybersecurity experts is that the malicious actors behind it did not simply rely on traditional tactics. Stealing seed phrases is, unfortunately, well-trodden and familiar territory in the crypto sector. However, Safery did not spoof an existing, trusted wallet brand. It was not a clumsy MetaMask lookalike or a recycled phishing domain designed to catch careless typos. Instead, it invented an entirely new identity, utilized purchased or botted fake reviews to manipulate search rankings, and launched itself cleanly as a legitimate, brand-new wallet option.
This calculated approach meant that the extension’s listing page showed virtually no immediate red flags. There was no broken grammar, no suspicious or overly aggressive permission requests, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page carried no prior complaints, and its designated support URL directed users to an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s initial analysis.
Given its polished appearance and professional presentation, most everyday users would not have hesitated for even a second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites"—a standard and entirely common request for crypto wallet extensions that fundamentally require the ability to interact with various decentralized applications across the web. Notably, it did not prompt for extra, unusual permissions or attempt to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding was minimalist, the accompanying website matched the exact name of the extension, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one, mirroring completely standard industry behavior.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment a user entered their seed phrase. Instead of storing the sensitive phrase locally or encrypting it securely for authorized user access, the extension silently split the recovery phrase into fragments and encoded them to resemble random, ordinary wallet addresses.
Socket’s rigorous research demonstrates that these fragments were carefully inserted into Sui blockchain transactions. Specifically, the extension issued tiny SUI token transfers—minuscule amounts of cryptocurrency specifically chosen because they would draw absolutely zero attention—to various addresses directly controlled by the attacker. Hidden safely inside those transactions, either tucked away in memo fields or subtly obfuscated within the destination addresses themselves, were the fractured pieces of the victim’s seed phrase.
This clever approach provided tactical advantages to the hackers. It completely eliminated the need for the extension to send outbound network requests to malicious external servers. There was no command-and-control beacon operating in the background, and there was no data exfiltration over standard HTTP or WebSockets channels that a modern browser or antivirus program might flag.
Instead, the payload left the user’s infected device disguised as a completely normal-looking blockchain transaction, efficiently routed through a widely used, low-fee blockchain network. Once safely on-chain, the data was publicly accessible, allowing the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep wallets clean without ever needing to touch the user’s device again.
In effect, the scam utilized the Sui blockchain itself as an unconventional communications channel. Because the Sui network boasts fast transaction confirmation times and negligible fees, it functioned remarkably well as a low-latency message bus.
Socket successfully traced multiple examples of these seed-fragment transactions and definitively confirmed the direct link between seed entry and eventual asset loss. While the actual thefts occurred off-chain—primarily on Ethereum or other Layer-1 networks where the victims’ wallets held their valuable funds—the precise instructions for carrying them out were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher likely tested this novel method in private environments. Digital evidence indicates that earlier builds experimented with simpler data leaks before the Sui encoding technique was fully refined. By the time the active extension was finally flagged, it had accumulated enough installations to reach Chrome’s coveted "trending" tier, which further amplified its visibility. Reports highlighted that the "Safery" wallet sat comfortably among the top results for "Ethereum wallet" searches even as mounting reports of suspicious behavior began circulating within communities on Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged directly on the specific mechanics of Chrome’s search ranking logic. The Web Store search algorithm meticulously weighs keyword matching, total installation counts, review velocity, average star ratings, and update recency.
Extensions that experience a sudden, sharp burst of activity, particularly within specialized or niche categories, can climb search rankings rapidly if better-vetted, established competitors are not updated frequently. In this instance, "Safery" benefited from a name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews—many of which were clearly templated or duplicated—and a fresh upload date.
There is no evidence to suggest that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy subjects most new extensions to only a brief automated scan and fundamental static analysis. Extensions typically undergo deeper, more rigorous scrutiny only when they request elevated permissions, such as broad access to tabs, the user’s clipboard, local file systems, or browsing history. Wallet extensions frequently manage to avoid these triggers by operating safely within iframes or utilizing officially approved application programming interfaces. "Safery" operated strictly within those established bounds.
Even when vigilant users raised concerns and reported the extension, the time lag between the initial reports and the eventual takedown stretched on long enough for significant financial damage to occur. Part of that lag is structural: the Chrome Web Store does not act on flagged extensions instantaneously unless there is an overwhelming consensus of reports or recognized malware signatures.
In this case, the payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external hosting servers. Traditional malware detection methods simply failed to catch it.
This is far from the first time that browser extensions have been weaponized to steal cryptocurrency. Previous high-profile scams have included fake Ledger Live applications that prompted unsuspecting users to enter their recovery phrases, or hijacked legitimate extensions that granted attackers access to a developer’s official publishing key.
What made "Safery" distinctly different was the remarkable smoothness of its facade and the complete absence of traditional backend infrastructure. There was no classic phishing website to take down, and no malicious server to block—just a single browser extension quietly moving secrets onto a public blockchain and walking away.
Impacted users still had limited recourse if they acted with extreme swiftness. By moving quickly, they could minimize their exposure by rotating their seed phrases and immediately revoking outstanding transaction approvals. Socket and other security researchers provided clear triage steps for anyone who had mistakenly installed the extension: uninstall the software immediately, revoke all token approvals, sweep remaining digital assets to a brand-new wallet using a completely clean device, and closely monitor all associated addresses. For those users who failed to notice the silent exfiltration or who stored substantial amounts of capital in vulnerable hot wallets, asset recovery remained highly unlikely.
Security researchers and developers are now calling for significantly stronger heuristics from Google and the Chrome Web Store team. One prominent proposal is to automatically flag and review any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase. Another suggested approach is to mandate publisher attestation for all wallet extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the codebase behind a recognized wallet brand. There are also growing demands for much tighter inspection of wallet-related permissions, even when those permissions do not explicitly include overtly dangerous access patterns.
For everyday cryptocurrency users, security analysts continue to emphasize the importance of rigorous due diligence. Before installing any crypto-related browser extension, users are advised to thoroughly review the publisher’s history, verify authentic associations with known and trusted projects, inspect review patterns for anomalies like bursts of identical text, check for legitimate website links backed by public code repositories, and scrutinize the permissions tab for vague or sweeping access requests.
As this incident vividly demonstrates, a clean name and a high star rating are simply no longer enough to guarantee safety in the digital asset space.
Raul Delapena Setiawan 
Muslim 
Siti Muinah