By Layla Zulfa 
For a few critical days last November, the digital asset community witnessed a masterclass in modern social engineering and covert software distribution. A malicious Chrome extension titled “Safery: Ethereum Wallet” managed to climb the Chrome Web Store rankings until it secured the fourth position for the heavily searched keyword phrase “Ethereum wallet.” Behind its polished facade, clean iconography, and deceptive security-adjacent branding lay a highly sophisticated, purpose-built attack mechanism designed to extract recovery seed phrases from unsuspecting users and systematically empty their linked cryptocurrency portfolios.
The malicious application was brought to light and thoroughly dissected by Socket, a prominent security tooling company specializing in the safety and integrity of open-source software supply chains. Following the initial discovery, researchers at Socket installed and reverse-engineered the extension to understand how it successfully evaded the automated safeguards of the Chrome Web Store, manipulated the platform’s search algorithm, and exfiltrated sensitive user credentials without triggering traditional network alerts. The resulting postmortem report not only outlines the attacker’s unique methodology but also serves as a stark warning to the broader Web3 ecosystem that browser extensions remain a dangerously overlooked blind spot in decentralized finance security.
What sets this particular incident apart from typical cryptocurrency scams is the deliberate departure from conventional phishing tactics. Historically, malicious actors in the Web3 space rely heavily on brand spoofing—creating convincing replicas of established market leaders like MetaMask or establishing lookalike domains designed to trick visitors. In contrast, the creators of the Safery extension took a decidedly different path. They invented an entirely new brand identity from scratch, avoiding the legal and technical tripwires associated with impersonating known entities. To build instant credibility, the publishers deployed a blitz of fake or botted five-star reviews to artificially inflate their ratings and drive the listing up the search result pages, establishing the software as a legitimate, newly launched alternative for asset management.
Because the extension did not mimic an existing brand, the listing page presented virtually no immediate red flags for casual browsers. There was no broken grammar, no suspicious redirection to obscure phishing domains, and no demand for excessive or unusual permissions that might catch a cautious user’s eye. The publisher account itself featured a clean history with zero prior complaints, and its designated support URL directed traffic to an off-platform website that security trackers had not yet flagged at the time of the analysis.
For the average user looking for a straightforward way to interact with decentralized applications, the installation process appeared entirely routine. The extension requested permission to run on all websites—a standard operational requirement for browser-based wallets that must communicate with various decentralized finance protocols. It refrained from prompting for supplementary privileges or injecting complex content scripts that typically provoke aggressive warnings from modern web browsers. The user interface adhered to minimalist design standards, featuring a matching informational website and a standard onboarding flow that invited users to either generate a fresh seed phrase or import an existing one.
The Seed Heist, Broadcast Over Sui
The true mechanics of the attack were triggered the moment a user inputted their sensitive recovery phrase. Rather than executing standard malicious procedures—such as transmitting the cleartext data directly to a centralized command-and-control server via HTTP requests or WebSockets, which would likely have been intercepted by browser telemetry or antivirus software—the extension adopted an entirely novel exfiltration channel. It silently fragmented the stolen seed phrase, encoding the individual pieces into what appeared to be innocuous, randomized wallet addresses.
According to Socket’s technical breakdown, these encoded fragments were subsequently embedded directly into transactions on the Sui blockchain. The extension executed microscopic SUI token transfers—amounts so negligible that they would completely escape human notice—directed toward addresses fully controlled by the attackers. Embedded deep within these micro-transactions, either hidden inside memo fields or masked within the obfuscated transaction architecture, were the exact pieces of the victim’s compromised recovery phrase.
This tactical innovation provided the perpetrators with significant advantages. By leveraging a widely used, highly efficient layer-1 blockchain as an invisible communication medium, the malware avoided any requirement for outbound connections to suspicious external servers. The sensitive payload departed the victim’s device disguised as a completely normal, legitimate blockchain transaction. Once permanently recorded on the public Sui ledger, the data was freely accessible to the attackers, who could retrieve the fragments at their leisure, reconstruct the seed phrases, and methodically sweep funds from the victims’ wallets across various other networks without ever needing to interact with the infected device a second time.
In effect, the operation weaponized the high-speed confirmation times and minimal transaction fees of the Sui blockchain, transforming a public distributed ledger into a low-latency messaging bus. Socket was able to trace multiple iterations of these seed-fragment transactions, confirming a direct causal link between the entry of credentials into the Safery extension and the subsequent draining of assets stored on Ethereum and other foundational layer-1 networks where the victims maintained balances. Evidence uncovered during the investigation suggests that the developers had thoroughly tested this methodology in private builds, experimenting with simpler data leaks before perfecting the Sui encoding technique that ultimately made its way into the official Chrome Web Store.
By the time security researchers and community members began sounding the alarm on social media platforms like Reddit and Telegram, the extension had already accumulated enough installations to secure a coveted spot on the Chrome Web Store’s trending tier, further cementing its deceptive visibility among everyday traders searching for accessibility tools.
How the Chrome Algorithm Let It Happen
The unprecedented visibility and distribution of the Safery wallet were heavily facilitated by the automated mechanics of the Chrome Web Store’s internal search algorithm. The ranking logic heavily weighs factors such as precise keyword matching, total install counts, review velocity, average user ratings, and the recency of the last software update. When an application experiences a sudden surge of activity within a specialized category, it can ascend rapidly through the rankings, particularly if established, vetted competitors fail to push frequent updates. Safery capitalized on this dynamic by pairing an optimized search title with automated positive reviews and a recent upload timestamp.
Significantly, available evidence indicates that the listing underwent no manual review by Google personnel prior to publication. Standard protocol for the Chrome Web Store involves a preliminary automated scan combined with basic static code analysis. Deeper scrutiny is typically reserved for extensions that request elevated browser permissions, such as monitoring clipboard activity, reading local file systems, or tracking browsing history. Because the Safery extension deliberately operated within the standard confines permitted for conventional web wallets, it successfully slipped past these automated barriers.
Even after concerned users began reporting suspicious activity, the lag time between the initial flags and the eventual takedown of the extension proved long enough for substantial financial damage to occur. This delay is structural; the platform rarely initiates immediate takedowns without an overwhelming consensus of malicious telemetry or the presence of pre-existing malware signatures. Because the extension relied on obfuscated JavaScript interacting directly with public blockchain infrastructure rather than traditional hosting providers, legacy detection tools failed to recognize the underlying threat.
Security professionals point out that while browser-based extensions have frequently been exploited in past cryptocurrency scams—ranging from fraudulent Ledger Live applications to compromised developer publishing keys—the Safery incident represents a notable evolution in operational stealth. The absence of traditional backend infrastructure meant there were no malicious servers to seize or phishing domains to block, leaving a silent pipeline that moved sensitive secrets directly onto a public ledger.
Affected users who realized the breach in time had limited options to mitigate their losses, primarily involving the rapid rotation of seed phrases, the immediate revocation of open token approvals, and the transfer of remaining assets to completely secured wallets managed on uncompromised hardware devices. However, for those who remained unaware of the background exfiltration or kept substantial balances in vulnerable hot wallets, the financial recovery path was effectively non-existent.
The Real Trouble Begins Before the Wallet Ever Loads
In the wake of this sophisticated breach, developers and security analysts are intensifying calls for structural platform reforms, urging Google to implement more advanced heuristics capable of automatically flagging any browser extension that deploys user interface components designed to prompt for standard recovery phrases. Additional proposals include mandatory publisher attestation systems to verify the true identity behind established wallet brands, alongside more rigorous inspections of wallet-related permissions regardless of whether they trigger traditional high-risk warnings.
For end users navigating the complex ecosystem of browser-based tools, security firms continue to emphasize the importance of thorough due diligence. Verifying a publisher’s historical track record, confirming direct associations with reputable open-source projects, analyzing review patterns for unnatural bursts of identical feedback, and cross-referencing official websites with verified public code repositories remain critical defenses. A clean minimalist interface and high star ratings, as demonstrated by the Safery incident, are no longer sufficient guarantees of safety.
The episode reignites broader industry discussions regarding the inherent risks of relying on web browsers as the primary interface for decentralized finance. While browser wallets achieved widespread adoption due to their unmatched convenience and seamless interaction with decentralized applications, that accessibility has simultaneously exposed users to an array of complex threats, ranging from session hijacking and clipboard manipulation to covert blockchain-based exfiltration.
As the dust settles on the Safery incident, wallet developers are increasingly re-evaluating distribution strategies, with some teams actively discouraging browser-store installations in favor of standalone desktop binaries or dedicated mobile applications. Ultimately, the event underscores the sobering reality that while Web3 is built on the promise of absolute self-sovereignty, the tools used to access it remain vulnerable to sophisticated exploitation—and standard platform defenses cannot always prevent malicious code from slipping through the cracks.
Raul Delapena Setiawan 
Muslim 
Siti Muinah