By Basiran 
For a few critical days last November, a sophisticated and malicious browser extension managed to secure the fourth spot in search results for “Ethereum wallet” on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was meticulously designed to bypass automated security checks and human scrutiny alike, presenting a polished frontend that successfully mimicked a legitimate, secure gateway to decentralized finance. Behind its clean user interface, however, lay a purpose-built attack mechanism engineered to intercept seed phrases, break them down into fragments, and covertly exfiltrate user secrets by encoding them into micro-transactions on the Sui blockchain.
The threat was brought to light and thoroughly analyzed by Socket, a security tooling company specializing in the safety of open-source software supply chains. After discovering the malicious listing, security researchers at Socket installed and dissected the extension to understand how “Safery” managed to evade detection, artificially inflate its Chrome Store search rankings, and siphon off sensitive user credentials without raising immediate alarms. Their subsequent report serves not only as a detailed postmortem of the incident, but also as a sobering warning that browser extensions continue to represent a dangerous and frequently overlooked blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy to cybersecurity experts is that the malicious actors behind Safery did not rely on traditional spoofing tactics. Unlike many historical phishing campaigns that attempt to clone existing wallet brands—such as impersonating MetaMask or setting up recycled lookalike phishing domains—Safery invented an entirely original identity. The creators established a fresh brand, purchased or generated a flood of bot-driven five-star reviews to rapidly climb search result rankings, and launched the software as a brand-new, independent wallet option.
Because the extension did not impersonate an existing trademark, its listing page lacked the traditional red flags that security-conscious users usually watch for. There was no broken grammar in the descriptions, no suspicious requests for overly aggressive or unusual permissions, and no redirection to shady, unverified external domains. The official Chrome Web Store publisher page associated with the extension had no prior consumer complaints on record, and its provided support URL led to an off-platform website that had not yet been flagged by any major security trackers at the time of Socket’s investigation.
Given its professional appearance and seamless onboarding process, the average user would likely have felt comfortable clicking the “Add to Chrome” button. The extension requested permission to run on all websites—a standard, necessary requirement for crypto wallets that need to interact dynamically with various decentralized applications across the web. Crucially, it refrained from prompting users for extra administrative permissions and avoided injecting content scripts that might have triggered Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the supporting website mirrored the extension’s name precisely, and the initial setup interface followed standard industry behavior by prompting users to either create a new wallet or import an existing recovery phrase.
The Seed Heist, Broadcasted Over the Sui Network
The true malicious intent of the software manifested the moment a user entered their recovery seed phrase. Instead of storing the sensitive phrase locally in an encrypted format for the user’s sole access, the extension silently dismantled the phrase, breaking it down into discrete fragments. These fragments were then ingeniously encoded to resemble random, innocuous wallet addresses.
According to Socket’s technical analysis, these hidden fragments were subsequently injected directly into Sui blockchain transactions. The extension initiated minuscule SUI token transfers—amounts so negligible that they would effortlessly escape the notice of both the user and automated monitoring tools—directed toward wallet addresses entirely controlled by the attacker. Tucked away inside those routine transactions, either hidden within memo fields or obfuscated directly within the structure of the recipient addresses, were the broken pieces of the user’s private seed phrase.
This tactical approach offered significant advantages to the hackers. By embedding the stolen data into legitimate-looking blockchain interactions, the extension entirely eliminated the need to send outbound HTTP or WebSocket requests to suspicious command-and-control servers. As a result, there were no anomalous network beacons or outbound traffic patterns that a browser extension monitor or local antivirus program might flag as malicious activity.
The payload successfully departed the victim’s device disguised as an ordinary, everyday blockchain transaction, routed smoothly through a widely utilized, low-fee blockchain network. Once recorded on-chain, the data became publicly accessible without requiring any further action from the user’s device. The attacker could retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep assets from the victim’s wallets on Ethereum or other Layer-1 networks without ever needing to touch the compromised device again.
In essence, the scam repurposed the Sui blockchain infrastructure itself to serve as a covert communications channel. Because the Sui network boasts exceptionally fast transaction finality times and negligible network fees, it functioned perfectly as a low-latency message bus for the attackers. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct causal link between the entry of a seed phrase into the fake extension and the subsequent loss of funds. While the actual financial thefts occurred off-chain on networks where the victims maintained balances, the critical instructions required to execute the thefts were hidden entirely in plain sight.
Before deploying the version that ultimately climbed to the top of Chrome’s wallet search results, the publisher likely tested the methodology in private environments. Historical evidence reviewed by researchers indicates that earlier, preliminary builds experimented with simpler data leakage techniques before the Sui encoding mechanism was fully refined. By the time the active, malicious extension was finally flagged and reported, it had accumulated a sufficient number of installations to reach the Chrome Web Store’s coveted "trending" tier, which further amplified its visibility to unsuspecting users. Reports from industry outlets confirmed that the Safery wallet remained prominently featured among top results for Ethereum wallet searches even as initial warnings began circulating across communities on Reddit and Telegram.
How the Chrome Store Algorithm Enabled the Exploit
The ultimate success of the Safery extension relied heavily on the mechanics of the Chrome Web Store’s search and ranking algorithms. The store’s ranking logic evaluates several key metrics, including keyword relevance, total installation counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden burst of activity and user acquisition, particularly within specialized or niche categories, can ascend rapidly through the rankings, especially if more established and thoroughly vetted competitors fail to update their listings frequently. In this particular instance, Safery benefited from an optimized name that targeted high-traffic search terms, a coordinated blitz of positive, templated reviews, and a very recent upload timestamp.
Available evidence does not indicate that Google manually reviewed the listing prior to its publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan and foundational static code analysis. Deeper scrutiny is generally reserved for extensions that request elevated or inherently risky permissions, such as direct access to browser tabs, the system clipboard, the local file system, or browsing history.
Because crypto wallet extensions frequently operate within isolated iframes or rely on officially approved APIs, they often manage to bypass these specific high-risk flags. Safery carefully operated within those permitted bounds to avoid tripping automated alarms.
Even when vigilant users began to flag the extension and raise concerns within the community, the time lag between initial reporting and the eventual takedown by store administrators stretched on long enough for substantial financial damage to occur. Part of this delay is structural; the Chrome ecosystem rarely acts on flagged extensions instantaneously unless there is an overwhelming consensus of reports or a match with known malware signatures.
Furthermore, because the extension’s payload consisted of obfuscated JavaScript that interacted exclusively with public blockchain infrastructure rather than external host servers, traditional malware detection signatures failed to catch it.
This incident is part of a broader, ongoing trend of malicious actors leveraging browser extensions to target cryptocurrency users. Past schemes have ranged from fake desktop application wrappers that prompted users for recovery phrases to compromised legitimate extensions where attackers managed to hijack the original developer’s publishing credentials.
What set Safery apart was the sheer sophistication of its facade and the complete absence of traditional backend infrastructure. There was no external phishing website to shut down and no centralized server IP address to block—merely a browser extension quietly translating private secrets onto a public blockchain network and walking away.
For users who fell victim to the scheme, recovery options were severely limited and hinged entirely on swift action. Security analysts from Socket and other firms outlined urgent triage steps for anyone who had installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets to a completely new wallet generated on a separate, clean device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent data exfiltration or who maintained substantial capital balances in vulnerable hot wallets, asset recovery remained virtually impossible.
The Broader Implications for Web3 Security
In the wake of the incident, cybersecurity researchers and developers have intensified calls for stronger heuristics and more rigorous safety measures from browser operators. One prominent proposal is the introduction of automated flags for any extension that incorporates user interface elements specifically designed to prompt for 12-word or 24-word recovery phrases.
Another suggested defense involves implementing mandatory publisher attestation for wallet-related extensions, providing cryptographic proof that a given publisher officially controls the codebase for an established and recognized wallet brand. Additionally, experts are advocating for tighter supervisory inspections of wallet permissions, even when those applications do not explicitly request dangerous system access patterns.
For everyday end users, security firms continue to stress the importance of rigorous personal verification habits. Before installing any cryptocurrency extension, users are advised to thoroughly research the publisher’s history, verify direct associations with publicly known and audited projects, inspect review patterns for artificial bursts of identical feedback, cross-reference real project websites with active public code repositories like GitHub, and carefully scrutinize the permissions tab for vague or overly broad access requests. A clean name and a high star rating alone are no longer sufficient guarantees of safety.
This latest security breach underscores deeper, unresolved questions regarding the fundamental role of web browsers in the decentralized finance space. Browser-based wallets originally gained widespread adoption due to their accessibility and convenience, allowing users to seamlessly interact with complex decentralized applications without the friction of switching platforms or installing standalone desktop applications.
However, that accessibility has introduced severe exposure risks. The modern web browser remains a high-risk environment vulnerable to malicious extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
As a result, wallet developers and security architects are expected to critically reevaluate traditional software distribution models. While some development teams already discourage the use of browser store installations in favor of standalone mobile applications or verified desktop binaries, others may soon implement native warnings for users attempting to install wallet software from unverified sources.
The core challenge remains that software distribution is heavily fragmented, and the average user lacks the technical tools required to easily distinguish a legitimate financial vault from a polished, malicious clone.
The Safery extension did not need to imitate established market leaders like MetaMask or Phantom to achieve its goals. By constructing an entirely original brand, manufacturing artificial trust signals, and utilizing an invisible blockchain-based backdoor, the attackers demonstrated how easily standard user experience paradigms can be exploited.
The incident highlights the ongoing struggle to establish verifiable trust in crypto user interfaces, serving as a reminder that browser wallets function less like secure digital vaults and more like open ports—and that automated platform protections will not always catch threats before they slip through.
Raul Delapena Setiawan 
Muslim 
Siti Muinah