By Siti Muinah 
For a few critical days in November, a meticulously crafted malicious Chrome extension managed to rank as the fourth organic search result for the term “Ethereum wallet” on the official Chrome Web Store. The application, which was given the deceptively reassuring name “Safery: Ethereum Wallet,” was designed to look polished and professional enough to pass completely as a legitimate piece of Web3 software. It featured a clean, modern icon, a generic title coupled closely with security-oriented terminology, a rapid influx of five-star user reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a cryptocurrency wallet.
However, behind this polished and unassuming frontend lay a purpose-built cyberattack. The extension was engineered to steal sensitive user seed phrases and rapidly empty connected cryptocurrency wallets by encoding the stolen secrets directly into micro-transactions on the high-speed Sui blockchain.
The threat was uncovered, installed, and subsequently analyzed by Socket, a prominent security tooling company focused heavily on open-source software supply chains. Following the discovery, Socket published a comprehensive technical report detailing how the "Safery" extension successfully evaded automated and manual detection mechanisms, climbed the competitive Chrome Store search rankings, and exfiltrated sensitive seed phrases without raising immediate alarms among users or platform monitors. The findings serve simultaneously as a technical postmortem of the security failure and a stark warning to the broader cryptocurrency community that browser extensions remain a dangerously overlooked blind spot in digital asset security.
This particular case is especially noteworthy within the cybersecurity and blockchain spaces because the malicious actors behind it did not resort to traditional tactics. Stealing seed phrases is, unfortunately, a well-trodden territory of crypto-related cybercrime, but hackers typically rely on specific playbooks. Usually, they spoof an existing, trusted wallet brand by creating a MetaMask lookalike or by deploying a recycled phishing domain designed to trick unsuspecting visitors.
By contrast, Safery took an entirely different and more insidious route. It invented a completely new identity from scratch, utilized bought or botted fake reviews to artificially inflate its search rankings, and launched itself quietly into the ecosystem as a novel wallet option. This strategic approach meant that the extension’s store listing showed virtually no immediate red flags to casual observers. There was no broken English or awkward grammar in the descriptions, no obviously suspicious permission requests, and no sudden redirections to shady external domains. Furthermore, the Chrome Web Store publisher page had no prior complaints logged against it, and the designated support URL led to an off-platform website that had not yet been flagged by any security tracking services at the time of Socket’s analysis.
Given its highly polished appearance and professional presentation, most users looking for a quick wallet solution would not have hesitated before clicking the “Add to Chrome” button. Like many standard Web3 tools, the extension requested permission to run on all websites—a common operational requirement for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, however, it did not prompt users for extra, unusual permissions, nor did it attempt to inject aggressive content scripts that might have triggered Chrome’s more rigorous security warnings. The overall branding was minimalist, the companion website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one, matching standard industry behavior entirely.
The Seed Heist, Broadcasted Over Sui
The real financial damage began the moment an unsuspecting user entered their private seed phrase into the extension interface. Rather than storing the recovery phrase locally or utilizing standard encryption methods for user access, the extension silently intercepted the text, split it into discrete fragments, and encoded those pieces to mimic completely random wallet addresses.
According to Socket’s technical research, these encoded fragments were then systematically inserted into live Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so small that they would never draw the attention of the user or network monitors—directed straight to addresses completely controlled by the attacker. Hidden deep inside those blockchain transactions, either tucked away neatly within memo fields or cleverly obfuscated as transaction addresses, were the sequential pieces of the user’s valuable seed phrase.
This calculated approach provided the hackers with major tactical advantages. By leveraging the blockchain itself, the extension completely eliminated the need to send outbound network requests to external malicious servers. There was no suspicious command-and-control beacon operating in the background, nor was there any data exfiltration conducted over standard HTTP or WebSockets protocols that an antivirus program or browser monitoring tool might easily flag and block.
Instead, the payload left the user’s local device disguised as a completely normal, everyday blockchain transaction, which was then routed efficiently through a widely used, low-fee layer-1 network. Once successfully recorded on-chain, the data was publicly accessible, permitting the attacker to retrieve it at their convenience, painstakingly reconstruct the full seed phrase, and sweep the victim’s assets across various blockchains without ever needing to touch the user’s device again.
In effect, the sophisticated scam utilized the Sui blockchain itself as an alternative communications channel. And because the Sui network boasts extremely fast transaction confirmation times alongside negligible fees, it functioned remarkably well as a low-latency message bus for the thieves. Socket successfully traced multiple concrete examples of these seed-fragment transactions, definitively confirming the direct link between entering a seed phrase into the fake extension and the subsequent loss of digital assets. While the actual thefts of funds occurred off-chain—primarily on Ethereum or other major layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the robberies were hidden securely in plain sight on Sui.
Before releasing the final version that ultimately landed in Chrome’s top wallet search results, the publisher likely tested this novel methodology in private environments. Evidence uncovered during the investigation shows that earlier, preliminary builds experimented with much simpler data leaks before the Sui encoding technique was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to comfortably reach Chrome’s coveted “trending” tier, which further boosted its public visibility and credibility. Reports confirmed that the Safery wallet managed to sit comfortably among the top search results for Ethereum wallets even as early warnings and reports of suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm typically weighs a combination of keyword matching, overall installation counts, review velocity, average user ratings, and update recency.
Extensions that experience a sudden, sharp burst of activity—especially within specialized or niche categories like cryptocurrency—can climb search rankings rapidly if their more established, better-vetted competitors are not updated with equal frequency. In this particular instance, Safery benefited greatly from a name that scored well for high-volume search queries, a coordinated blitz of positive reviews (many of which were templated or duplicated), and a remarkably fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to its publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief automated security scan accompanied by fundamental static analysis. Deeper scrutiny is generally reserved for extensions that explicitly request highly elevated permissions, such as broad access to user tabs, system clipboards, local file systems, or browsing history.
Because crypto wallet extensions frequently manage to bypass these specific warning flags by operating cleanly within isolated iframes or by utilizing approved application programming interfaces, Safery stayed safely within acceptable bounds. Even when vigilant users raised concerns and submitted reports, the operational lag between the initial reporting and the eventual store takedown stretched on long enough for the malicious actors to cause substantial financial damage. Part of that lag is structural: the Chrome platform typically does not act on flagged extensions instantly unless there is an overwhelming consensus of abuse or well-known malware signatures detected. Because the payload consisted of heavily obfuscated JavaScript relying entirely on legitimate blockchain infrastructure rather than external malicious hosts, traditional automated malware detection methods failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to target cryptocurrency users. Previous notable scams have included fake Ledger Live companion apps that prompted users to input their secret recovery phrases, as well as instances where legitimate, trusted extensions were hijacked because attackers managed to compromise the original developer’s publishing keys.
What made the Safery incident distinct, however, was the remarkable smoothness of its digital facade and the complete absence of traditional backend infrastructure. There was no vulnerable phishing website that law enforcement or security firms could easily take down, and no centralized server to block—just a single browser extension quietly moving secret data onto a public blockchain network and walking away without a trace.
Affected users still had limited courses of action available if they acted with extreme urgency. Those who realized they had interacted with the malicious software could limit their overall exposure by immediately rotating their seed phrases, revoking outstanding token approvals, sweeping remaining digital assets to a completely new wallet created on a separate, clean device, and monitoring their associated addresses closely. However, for everyday users who failed to notice the silent data exfiltration in time, or for those who stored large amounts of capital directly in vulnerable hot wallets, financial recovery remained highly unlikely.
Security researchers, developers, and industry watchdogs are now calling for significantly stronger heuristics from browser operators like Google. One widely proposed solution involves automatically flagging and restricting any extension that incorporates user interface elements prompting for a standard 12- or 24-word recovery phrase. Another suggested approach is to mandate publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher officially controls the codebase behind an established wallet brand. Furthermore, industry experts are advocating for much tighter security inspections of wallet-related permissions, even when those permissions do not explicitly include traditional dangerous access patterns.
For end users navigating the web, security firms like Socket have published practical checklists for safer extension management. Before installing any cryptocurrency extension, users are strongly advised to carefully review the publisher’s history, verify direct associations with known and trusted projects, closely inspect review patterns for artificial bursts of identical feedback, check for real website links backed by public GitHub code repositories, and scrutinize the permissions tab for vague or sweeping access requests. Ultimately, a clean name and a high star rating are simply no longer enough to guarantee safety.
This troubling case raises much broader, uncomfortable questions regarding the browser’s expanding role in the cryptocurrency ecosystem. Browser-based wallets originally gained immense popularity due to their high accessibility and ease of use, enabling everyday users to interact smoothly with complex decentralized applications without needing to switch platforms or download separate desktop applications.
However, that unmatched accessibility has come at a severe cost to overall security exposure. The modern web browser remains a notoriously high-risk environment subject to constant threats, including extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain exfiltration.
As a result, wallet developers are increasingly likely to rethink their long-term distribution models. Some forward-thinking development teams already actively discourage Chrome Web Store installations, preferring instead to direct users exclusively toward dedicated mobile applications or standalone desktop binaries. Others may soon implement native warnings for users attempting to install software from unverified sources.
The core systemic problem persists: software distribution remains heavily fragmented, and the vast majority of everyday users simply do not possess the technical expertise required to distinguish a legitimate, secure wallet from a polished, malicious clone. The Safery extension proved conclusively that attackers no longer need to mimic established giants like MetaMask or Phantom to succeed; they can simply build their own brand from the ground up, seed artificial trust signals, and construct an invisible digital backdoor that utilizes a public blockchain as a courier. This reality demands a fundamental rethinking of how trust is established in cryptocurrency user experiences, and how close to the underlying operating system even casual tools like browser extensions truly operate.
Raul Delapena Setiawan 
Muslim 
Layla Zulfa