By Lina Hope 
For a brief period last November, a malicious software masquerading as a crypto tool managed to secure the fourth position for the search query “Ethereum wallet” on the official Chrome Web Store. The extension, deceptively named “Safery: Ethereum Wallet,” was crafted with enough polish and attention to detail to easily pass as a legitimate piece of financial software. It featured a clean, professional icon, a generic name cleverly positioned adjacent to security-related terminology, a sudden and heavy influx of five-star reviews, and boilerplate descriptions that instantly look familiar to anyone who has ever downloaded a digital asset manager.
Beneath that polished, innocuous frontend, however, lay a purpose-built attack mechanism. The extension was designed explicitly to capture sensitive user data, specifically seed phrases, and immediately empty unsuspecting victims’ wallets by stealthily encoding the stolen secrets into micro-transactions executed on the Sui blockchain.
Security tooling firm Socket, an organization closely focused on open-source software supply chains, installed and analyzed the extension shortly after its malicious nature was uncovered by vigilant community members. Their primary objective was to understand how “Safery” successfully evaded automated detection systems, climbed the competitive Chrome Store search rankings, and exfiltrated sensitive seed phrases without raising immediate alarms, while also providing actionable insights on how users might spot comparable threats in the future. The resulting technical report walks readers through the attacker’s sophisticated approach, functioning simultaneously as a comprehensive postmortem and a stark warning that web browser extensions continue to represent a dangerous and vulnerable blind spot within the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy is that the malicious actors behind it did not rely on traditional spoofing tactics. Targeting existing wallet brands by creating lookalike extensions or recycled phishing domains has unfortunately become well-trodden territory in the crypto threat landscape. Instead, Safery invented an entirely new identity from scratch. The perpetrators bought or artificially generated fake reviews through bot networks to rapidly climb the store’s search rankings, launching themselves as a completely "new" and independent wallet option.
This calculated approach meant that the store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no obviously suspicious permissions requested during the installation phase, and no redirection links pointing users toward shady external domains. Furthermore, the Chrome Web Store publisher page carried no prior user complaints or warning flags, and the designated support URL directed traffic to an off-platform website that had not yet been flagged by major security trackers at the time Socket conducted its analysis.
Given its remarkably polished appearance, the average web user would likely have felt little hesitation before clicking the “Add to Chrome” button. Like many standard web-based crypto tools, the extension requested permission to run on “all websites,” which is a routine functional requirement for applications that need to interact seamlessly with various decentralized finance applications and protocols. Notably, it did not prompt users for extra, high-risk permissions or attempt to inject complex content scripts that might otherwise trigger Google Chrome’s more aggressive automated warnings. Its branding remained minimalist, its companion website matched the extension’s exact name, and the initial setup screen naturally prompted users to create a brand-new wallet or import an existing one—behavior that mimics standard, legitimate industry practices.
The Seed Heist, Broadcasted Quietly Over Sui
The real financial damage began immediately after a user entered their recovery seed phrase. Instead of storing the phrase locally on the machine or encrypting it for authorized user access, the malicious extension silently split the recovery words into tiny fragments and cunningly encoded them as what appeared to be completely random, innocuous wallet addresses.
Detailed research published by Socket revealed that these sensitive fragments were directly inserted into active Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—amounts so small they would naturally draw zero attention from users or basic monitoring tools—sending them directly to wallet addresses controlled entirely by the attacker. Hidden safely inside those on-chain transactions, either tucked away inside memo fields or obfuscated directly within the structure of the addresses themselves, were the piecemeal components of the victim’s private seed phrase.
This tactical methodology offered severe advantages to the perpetrators. Crucially, it eliminated the need for the extension to send outbound network requests to external, malicious servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration occurring over standard HTTP protocols or WebSockets that a modern web browser or antivirus software package might readily flag and intercept.
Instead, the stolen payload departed the user’s local device disguised as a completely normal-looking blockchain transaction, routed safely through a widely used, highly efficient, and low-fee layer-1 network. Once permanently recorded on-chain, the data became publicly accessible, enabling the attacker to quietly retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the scam creatively utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network boasts exceptionally fast confirmation times alongside negligible transaction costs, it functioned flawlessly as a low-latency message bus for the thieves. Socket successfully traced multiple concrete examples of these peculiar seed-fragment transactions, definitively confirming the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts ultimately occurred off-chain—typically on Ethereum or other major layer-1 networks where the victims’ wallets conveniently held significant balances—the exact instructions required to carry out the robberies were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher almost certainly tested the underlying method in private environments. Forensic evidence indicates that earlier, unreleased builds experimented with simpler, noisier data leaks before the Sui encoding mechanism was eventually refined and perfected. By the time the active, malicious extension was finally flagged and reported by security researchers, it had already accumulated enough installations to break into Chrome’s coveted “trending” tier, which further amplified its visibility to unsuspecting users. Reports highlighted that the Safery wallet comfortably maintained a position among the top search results for Ethereum wallets even as early warnings and discussions regarding its suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Allowed the Scam to Flourish
The ultimate success of the Safery extension hinged heavily on the underlying ranking logic utilized by the Chrome Web Store search engine. The store’s algorithm dynamically weighs keyword matching, total installation counts, review velocity, average user ratings, and the recency of software updates.
Extensions that experience a sudden, concentrated burst of user activity—particularly within niche categories where established, better-vetted competitors are not updated frequently—can climb search rankings at an alarming pace. In this specific scenario, Safery benefited from a strategically chosen name that scored exceptionally well for common user search queries, a coordinated blitz of positive ratings featuring templated or duplicated text, and a remarkably fresh upload date.
Available evidence indicates that Google did not manually review the listing prior to its public publication. Standard Chrome Web Store policies dictate that most newly submitted extensions are subjected only to a brief automated software scan and fundamental static analysis before being cleared for the public store.
Typically, extensions undergo deeper manual scrutiny only when they explicitly request elevated, high-risk permissions, such as continuous access to active browser tabs, system clipboards, local file systems, or browsing histories. Wallet extensions frequently manage to bypass these specific warning flags by carefully operating within isolated iframes or by relying strictly on approved, standard application programming interfaces. Safery strictly stayed within those permissible structural bounds.
Even when concerned users began raising alarms and reporting the application, the operational lag between the initial reports and the eventual store takedown stretched on long enough for substantial financial damage to occur. Part of that delay is structural: the Chrome Web Store ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of danger or the software matches previously cataloged malware signatures. In this instance, because the payload consisted of heavily obfuscated JavaScript that relied exclusively on legitimate public blockchain infrastructure rather than external malicious hosts, traditional automated malware detection mechanisms failed to catch it.
This incident is far from an isolated event; historically, browser extensions have frequently been weaponized to target digital asset holders. Previous high-profile scams have included fraudulent Ledger Live applications prompting users to enter private recovery phrases, as well as instances where legitimate, established extensions were temporarily hijacked after attackers compromised the original developer’s publishing credentials.
What fundamentally distinguished Safery from past attacks, however, was the remarkable smoothness of its digital facade and the complete absence of traditional backend infrastructure. There was no external phishing website that authorities could easily seize, nor was there a centralized command server to block; there was simply a single browser extension quietly translating private secrets onto a public blockchain network and walking away without a trace.
Victims of the exploit still had limited avenues for recourse if they reacted with extreme urgency. Those who acted quickly could mitigate their exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across various decentralized finance protocols. Socket and other responding security firms quickly published clear triage steps for anyone who had mistakenly installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets to a freshly generated wallet utilizing an entirely clean and secure device, and carefully monitor associated addresses for unauthorized activity. For users who failed to notice the silent exfiltration in time, or for those who maintained substantial balances within vulnerable hot wallets, asset recovery remained an impossibility.
Security researchers and independent software developers are now loudly calling for much stronger heuristics and automated safeguards directly from Google Chrome itself. One widely discussed proposal involves automatically flagging and quarantining any extension that includes user interface elements specifically designed to prompt for 12-word or 24-word recovery phrases. Another suggested approach involves requiring mandatory publisher attestation for all wallet-related extensions, providing cryptographic, verifiable proof that a listed publisher genuinely controls the underlying codebase associated with a known wallet brand. Furthermore, industry experts are advocating for much tighter, more rigorous inspections of wallet-related permissions, even when those permissions do not overtly invoke traditionally dangerous access patterns.
For everyday end users, security firms have emphasized the importance of maintaining strict operational hygiene and practical checklists for browser extension management. Before installing any decentralized finance or cryptocurrency extension, users are urged to thoroughly review the publisher’s history, independently verify genuine associations with recognized projects, inspect review patterns for obvious anomalies like bursts of identical text, check for legitimate corporate website links accompanied by public source code repositories, and carefully scrutinize the permissions tab for sweeping or vague system access requests.
Ultimately, the Safery incident reinforces the uncomfortable reality that a clean application name and a high star rating are no longer sufficient guarantees of safety in the modern web era. The episode raises profound, systemic questions regarding the browser’s expanding role as a primary financial interface. Browser-based wallets originally gained widespread popularity largely due to their accessibility and sheer ease of use, allowing everyday people to interact seamlessly with complex decentralized applications without needing to switch operating platforms or download standalone desktop software.
However, that high degree of accessibility has come at a severe cost to user security. The modern web browser remains an inherently high-risk computing environment susceptible to malicious extension manipulation, active session hijacking, invisible clipboard scrapers, and now, covert blockchain-based data exfiltration. As threats continue to evolve in sophistication, wallet developers will likely be forced to fundamentally rethink their distribution models. Some crypto teams already actively discourage users from utilizing Chrome Web Store installations altogether, preferring to steer communities toward dedicated mobile applications or standalone desktop binaries. Others may soon implement aggressive native warnings designed to intercept users attempting to install wallet software from unverified or newly minted sources.
The underlying structural problem, however, persists: software distribution across the web remains heavily fragmented, and the vast majority of retail users lack the technical expertise required to reliably distinguish a legitimate, secure financial tool from a polished, malicious clone. The Safery extension proved conclusively that attackers no longer need to successfully spoof established giants like MetaMask or Phantom to steal funds; they can simply invent an entirely new brand, manufacture artificial trust signals, and construct an invisible digital backdoor that utilizes a high-speed public blockchain as its courier. That realization demands a comprehensive rethinking of how trust is established and maintained across the cryptocurrency user experience, reminding participants that in the wrong hands, a standard browser wallet functions less like a secure digital vault and more like an open port—one that popular browsers may not always warn you about before something slips completely through.
Basiran 
Raul Delapena Setiawan 
Muslim