By Lina Irawan 
For a critical few days last November, a malicious Chrome extension managed to climb to the fourth overall search result for the term “Ethereum wallet” on the official Chrome Web Store. Disguised under the name “Safery: Ethereum Wallet,” the application possessed all the visual indicators of a professional, legitimate product. It featured a clean, modern icon, a generic yet trustworthy-sounding name coupled with security-oriented language, a rapid influx of five-star reviews, and standard boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a cryptocurrency management tool.
Beneath this polished frontend, however, lay a purpose-built attack mechanism engineered specifically to steal sensitive seed phrases and completely empty user wallets. Instead of relying on traditional web servers or conventional command-and-control infrastructure, the extension leveraged the Sui blockchain, encoding stolen secrets directly into micro-transactions to exfiltrate user data completely undetected by standard security tools.
The threat was brought to light when Socket, a prominent security tooling company specializing in open-source software supply chains, installed and analyzed the extension shortly after its discovery. The cybersecurity firm’s primary objective was to understand how "Safery" managed to slip past automated filters, climb the competitive Chrome Store rankings, and exfiltrate sensitive recovery phrases without raising immediate alarms, while also outlining what everyday users could do to spot similar emerging threats. The resulting technical report functions as both a detailed postmortem of the security failure and a stark warning that browser extensions continue to represent a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy to security analysts is that the malicious actors did not simply spoof an existing, well-known wallet brand. Security experts note that impersonating established players like MetaMask or setting up recycled phishing domains is, unfortunately, well-trodden territory in the crypto threat landscape. By contrast, Safery invented an entirely distinct identity from scratch. The perpetrators purchased or utilized bot networks to generate fake reviews, systematically driving up search rankings and launching the software as a brand-new, independent wallet option.
This calculated approach meant the store listing presented virtually no immediate red flags to prospective victims. There was no broken grammar, no suspicious permissions requests, and no automatic redirection to shady third-party domains. Furthermore, the Chrome Web Store publisher page carried no prior user complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s comprehensive analysis.
Given its polished, professional appearance, the average user would likely experience no hesitation before clicking the "Add to Chrome" button. Following standard practices for legitimate software, the extension requested permission to run on "all websites"—a necessary technical requirement for crypto wallets that need to interact seamlessly with various decentralized applications. Notably, the extension did not prompt users for extra, suspicious permissions or attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding remained minimalist, the accompanying website mirrored the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one, mimicking completely standard onboarding behavior.
The Seed Heist, Broadcast Over Sui
The true damage began the moment a user entered their recovery seed phrase. Rather than storing the phrase locally or securely encrypting it for user-exclusive access, the extension silently fractured the phrase into distinct pieces. It then encoded these fragments to masquerade as random, innocuous wallet addresses.
According to Socket’s detailed research, these fragmented pieces were embedded directly into Sui blockchain transactions. Specifically, the extension initiated tiny SUI token transfers—minuscule monetary amounts designed to draw zero attention—routing them to addresses entirely under the attacker’s control. Hidden deep inside those blockchain transactions, either tucked away within memo fields or cleverly obfuscated within the transaction addresses themselves, were the vital components of the victim’s seed phrase.
This tactical execution provided significant advantages for the hackers. By utilizing this method, the extension completely avoided sending outbound HTTP or WebSocket requests to malicious external servers. There was no obvious command-and-control beacon or data exfiltration pattern that a modern web browser, firewall, or traditional antivirus program could easily intercept or flag.
Instead, the payload left the user’s device disguised as a completely normal-looking blockchain transaction, routed securely through a widely utilized, low-fee layer-1 chain. Once permanently recorded on-chain, the sensitive data became publicly accessible, allowing the malicious actors to retrieve it at their leisure, reconstruct the original seed phrase, and systematically sweep connected wallets clean without ever needing to touch the user’s local device a second time.
In effect, the sophisticated scam utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network boasts fast transaction confirmation times and virtually negligible gas costs, it functioned efficiently like a low-latency message bus for the attackers. Socket successfully traced multiple instances of these unique seed-fragment transactions, definitively confirming the direct link between entering a seed phrase into the fake extension and the eventual loss of digital assets. While the actual thefts occurred off-chain—predominantly on Ethereum or other layer-1 networks where the victims’ wallets held substantial funds—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the final version that eventually soared into Chrome’s top wallet search results, the publisher almost certainly tested the underlying methodology in private. Digital forensics indicate that earlier, unlisted builds experimented with simpler data leakage techniques before the Sui blockchain encoding method was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installation volume to secure a spot in Chrome’s coveted "trending" tier, which further amplified its visibility to unsuspecting users searching for storage solutions. Industry tracking reports confirmed that the Safery wallet maintained a prominent position among the top results for Ethereum wallet queries, even as mounting reports of suspicious behavior began circulating within communities on Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying ranking logic of the Chrome Web Store. The platform’s search algorithm evaluates multiple factors, including keyword matches, total install counts, review velocity, average star ratings, and update recency.
Extensions that experience a sudden burst of user activity, particularly within niche categories, can climb search rankings rapidly if more established, well-vetted competitors are not updated frequently. In this instance, Safery benefited from a name optimized for common user queries, a rapid influx of positive reviews that were largely templated or duplicated, and a fresh upload timestamp.
Available evidence indicates that Google did not manually review the listing prior to publication. Standard Chrome Web Store policy subjects most new software submissions to a brief automated scan alongside fundamental static code analysis. Deeper scrutiny is generally reserved for extensions that explicitly request elevated permissions, such as access to active browser tabs, the system clipboard, local file systems, or browsing history.
Because legitimate wallet extensions frequently manage to bypass these specific warning flags by operating securely within localized iframes or utilizing approved APIs, Safery managed to stay comfortably within those permitted operational bounds.
Even after users began raising serious concerns, the critical window of time between initial reporting and ultimate takedown stretched on long enough for extensive financial damage to occur. Part of this delay is structural; the Chrome ecosystem rarely acts on flagged extensions instantaneously unless there is an overwhelming community consensus or readily identifiable malware signatures. In this scenario, the payload relied entirely on obfuscated JavaScript interacting with public blockchain infrastructure rather than external host servers, allowing it to evade traditional signature-based malware detection methods.
This security incident is far from the first time browser extensions have been weaponized to target cryptocurrency assets. Previous widespread scams have involved fake Ledger Live applications prompting users to input recovery phrases, or the compromise of legitimate extensions through hijacked developer publishing credentials. What fundamentally distinguished the Safery incident, however, was the remarkable smoothness of its facade and the complete absence of traditional backend infrastructure. There was no external phishing website to take down, and no malicious server IP to block—just a single browser extension quietly moving secrets onto a public blockchain network and walking away.
For affected individuals, remediation options remained narrow and time-sensitive. Those who acted swiftly could limit their overall exposure by immediately rotating seed phrases, revoking outstanding transaction approvals, and transferring remaining assets to a secure wallet using a completely clean device. For users who failed to notice the silent exfiltration in time, or those who maintained large balances within vulnerable hot wallets, asset recovery remained virtually impossible.
Cybersecurity researchers and independent developers are now increasing pressure on platform operators to implement stronger automated heuristics. Proposed solutions include programming the Chrome store to automatically flag any extension that incorporates user interface elements prompting for a standard 12- or 24-word recovery phrase. Additional recommendations call for mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the codebase behind an established wallet brand. Furthermore, experts advocate for much tighter manual inspection of wallet permissions, regardless of whether those permissions trigger traditional dangerous access patterns.
For end users navigating the Web3 space, security analysts continue to emphasize the importance of thorough due diligence. Before installing any cryptocurrency extension, users are advised to review the publisher’s history, verify authentic associations with known software projects, inspect review patterns for suspicious bursts of identical text, confirm the existence of real official websites tied to public code repositories, and scrutinize the permissions tab for sweeping system access. As the Safery incident demonstrated, a clean name and high user rating are no longer enough to guarantee safety in an increasingly complex digital landscape.
Raul Delapena Setiawan 
Muslim 
Siti Muinah