By Raul Delapena Setiawan 
For a few critical days in November, a malicious software disguise managed to claim the fourth position in search results for the term “Ethereum wallet” on the official Chrome Web Store. The fraudulent extension, titled “Safery: Ethereum Wallet,” was crafted with enough technical polish and visual finesse to easily pass as a legitimate tool to any unsuspecting digital asset investor. It featured a clean, professional icon, a generic name cleverly positioned alongside trusted security terminology, a heavy influx of five-star reviews, and boilerplate introductory descriptions that are entirely familiar to anyone who has ever downloaded a cryptocurrency wallet application.
Beneath that polished frontend, however, lay a purpose-built cyberattack mechanism designed explicitly to harvest private seed phrases and entirely empty user wallets. Instead of relying on traditional hacking methods, the extension encoded stolen user secrets into micro-transactions routed directly across the Sui blockchain.
The threat was brought to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and conducted a thorough analysis of the extension following its initial discovery. The primary objective of the security team was to understand how "Safery" successfully bypassed automated detection protocols, climbed the competitive Chrome Store search rankings, and exfiltrated sensitive seed phrases without triggering immediate security alarms. Furthermore, the team sought to identify what preventive actions users could take to spot similar threats in the future. The resulting report serves as both a detailed technical postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
This particular incident stands out because the malicious actors behind it did not simply rely on spoofing an existing, well-known wallet brand. Unlike previous attacks that utilized MetaMask lookalike interfaces or recycled phishing domains to trick users, Safery chose to invent an entirely new identity from scratch. The perpetrators bought or generated bot-driven fake reviews to artificially inflate the listing’s search rankings and launched the product as a brand-new, independent wallet option.
This calculated approach ensured the store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no suspicious or overreaching permissions requested upfront, and no redirection to obscure or shady external domains. The Chrome Web Store publisher page carried zero prior complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by security tracking services at the time of Socket’s analysis.
Given its highly convincing appearance, the average user would likely experience no hesitation before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a standard and necessary requirement for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, the software did not prompt for extra, unwarranted permissions or attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding remained minimalist, the accompanying website matched the exact name of the extension, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one, mimicking entirely standard industry behavior.
The Real Damage Begins Behind the Scenes
The true financial damage commenced the moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or encrypting it properly for user access, the extension silently fragmented the phrase into smaller pieces. It then encoded these fragments to look precisely like random wallet addresses.
According to Socket’s technical research, these fragmented pieces were systematically inserted into genuine Sui blockchain transactions. Specifically, the extension issued minuscule SUI token transfers—such trivial amounts of cryptocurrency that they would never draw scrutiny—to various destination addresses completely controlled by the attacker. Hidden safely inside those transactions, either tucked away within memo fields or obfuscated directly inside the altered addresses, were the critical components of the victim’s seed phrase.
This tactical strategy offered massive advantages to the hackers. It completely eliminated the need for the extension to send outbound network requests to overtly malicious external servers. There was no traditional command-and-control beacon or data exfiltration routed over standard HTTP or WebSockets channels that a modern web browser, firewall, or local antivirus program might easily flag.
Instead, the payload safely departed the user’s local device disguised as an entirely normal-looking blockchain transaction, routed securely through a widely utilized, low-fee blockchain network. Once successfully published on-chain, the data remained publicly accessible, granting the attacker the freedom to retrieve it at their convenience, reconstruct the full seed phrase, and systematically sweep connected wallets clean without ever needing to touch the victim’s device again.
In practice, the scam effectively leveraged the Sui blockchain itself as an unconventional communications channel. Because the Sui network boasts remarkably fast confirmation times and negligible transaction costs, it functioned flawlessly as a low-latency message bus for the perpetrators.
Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct causal link between the entry of a seed phrase into the extension and the subsequent loss of assets. While the actual thefts ultimately occurred off-chain—primarily on Ethereum or other Layer 1 blockchain networks where the victims’ wallets held substantial funds—the coded instructions required to execute the thefts were hidden in plain sight.
Before releasing the final version that successfully penetrated Chrome’s top wallet search results, the publisher likely tested the methodology within private environments. Digital forensics and historical data indicate that earlier builds experimented with simpler data leakage techniques before the Sui encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installs to comfortably reach Chrome’s "trending" tier, which further amplified its visibility to prospective victims. Reports confirmed that the Safery wallet managed to maintain its prominent position among top results for Ethereum wallet searches even as initial warnings regarding suspicious behavior began circulating across community platforms like Reddit and Telegram.
The Vulnerabilities in Chrome’s Search and Review Logic
The ultimate success of the Safery extension hinged entirely on the structural ranking logic utilized by the Chrome Web Store. The store’s search algorithm heavily weighs keyword matching, total install counts, review velocity, average ratings, and the recency of software updates.
Extensions that experience a sudden, concentrated burst of user activity, particularly within niche categories like cryptocurrency tools, can climb search rankings rapidly if more thoroughly vetted competitors fail to update their listings frequently. In this instance, Safery benefited from a strategically chosen name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews that often featured templated or duplicated text, and a very fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to publication. Chrome Web Store policies generally subject newly submitted extensions to a brief automated scan and fundamental static analysis. Extensions only tend to undergo deeper, manual scrutiny when they request highly elevated permissions, such as direct access to user tabs, system clipboards, file systems, or browsing history. Because crypto wallet extensions frequently manage to bypass these specific permission flags by operating within isolated iframes or leveraging officially approved APIs, Safery managed to stay safely within acceptable bounds.
Even after cautious users began raising legitimate concerns, the time lapse between initial public reporting and the eventual takedown of the extension stretched on long enough for substantial financial damage to occur. Part of this delay is inherently structural, as the Chrome ecosystem does not typically act on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or easily identifiable malware signatures. In this case, the underlying payload relied entirely on obfuscated JavaScript interacting with legitimate blockchain infrastructure rather than communicating with known malicious external hosts, allowing it to evade traditional signature-based malware detection methods seamlessly.
This incident is far from the first time that browser extensions have been weaponized to target cryptocurrency holdings. Previous high-profile scams have included fraudulent Ledger Live companion apps that prompted unwary users to input their master recovery phrases, as well as instances where legitimate, established extensions were quietly hijacked to allow malicious actors access to the original developer’s publishing keys.
What made the Safery incident uniquely dangerous, however, was the exceptional smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no easily blockable phishing website to take down and no central command server to neutralize; instead, there was simply a single browser extension quietly translating private user secrets into public blockchain transactions and quietly walking away.
Impacted users retained very limited avenues for recourse. For those who acted with extreme swiftness, mitigating further exposure involved immediately rotating their compromised seed phrases and actively revoking outstanding smart contract transaction approvals. Security firms like Socket quickly published comprehensive triage guidelines advising anyone who had installed the extension to uninstall it immediately, sweep remaining digital assets to a freshly generated wallet utilizing an entirely clean device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent data exfiltration in time, or who maintained substantial funds directly within vulnerable hot wallets, financial recovery remained highly unlikely.
The Ongoing Battle Over Browser Security
In the wake of the incident, security researchers, developers, and industry analysts have begun calling for significantly stronger heuristics from browser providers like Google. Among the most prominent proposed solutions is the implementation of an automated flagging system designed to instantly penalize or block any extension that includes user interface elements prompting for a standard 12-word or 24-word recovery phrase.
Another widely discussed preventative measure involves requiring mandatory publisher attestation for all wallet-related extensions, providing cryptographic proof that a given developer genuinely controls the authentic codebase behind a recognized wallet brand. Furthermore, experts are pushing for much tighter inspection protocols regarding wallet-related permissions, even in cases where those permissions do not explicitly trigger traditional dangerous access patterns.
For the everyday end user, security firms have emphasized the absolute necessity of maintaining rigorous extension management habits. Before installing any software claiming to manage digital assets, users are advised to thoroughly review the publishing history of the creator, verify official associations with known, trusted projects, inspect review patterns for obvious anomalies such as concentrated bursts of identical feedback, and check for verifiable links to public code repositories like GitHub. Ultimately, security advocates stress that a clean name and a superficially high rating are no longer sufficient guarantees of safety.
The incident raises much broader, more philosophical questions regarding the fundamental role of the modern web browser within the cryptocurrency landscape. Browser-based wallets originally gained widespread popularity primarily due to their accessibility and operational ease of use, enabling users to interact effortlessly with complex decentralized applications without requiring them to switch platforms or download standalone desktop applications.
However, that unmatched accessibility has come at a severe cost regarding overall exposure and risk. The web browser inherently functions as a high-risk operational environment that remains constantly vulnerable to extension manipulation, session hijacking, malicious clipboard scrapers, and now covert blockchain-based data exfiltration.
As a direct consequence of these persistent vulnerabilities, wallet developers are increasingly likely to rethink their primary distribution models. While some development teams already actively discourage users from installing software via the Chrome Web Store, preferring to direct them toward dedicated standalone mobile applications or secure desktop binaries, others may begin implementing aggressive in-app warnings for users attempting to source wallets from unverified channels.
The core systemic problem remains deeply entrenched, as software distribution continues to be heavily fragmented, and the vast majority of retail users lack the technical expertise required to reliably distinguish an authentic, secure wallet from a polished clone. The Safery extension demonstrated conclusively that malicious actors no longer need to successfully impersonate industry giants like MetaMask or Phantom to execute massive thefts; they can simply manufacture their own trusted brand identity from the ground up, seed artificial trust signals, and construct an invisible digital backdoor that utilizes a public blockchain as an untraceable courier.
Muslim 
Siti Muinah 
Layla Zulfa