By Reynand Wu 
For several days last November, a malicious browser extension masquerading as a crypto wallet managed to secure the fourth position in search results for the term “Ethereum wallet” on the official Chrome Web Store. The application, which called itself “Safery: Ethereum Wallet,” was meticulously designed to mirror legitimate software. It featured a clean, professional icon, a generic name strategically combined with security-adjacent terminology, a rapid influx of five-star reviews, and boilerplate descriptions that instantly look familiar to anyone who has ever navigated the decentralized finance ecosystem to download a digital asset manager.
Beneath this polished exterior, however, the extension harbored a purpose-built attack mechanism. Rather than operating as a genuine utility, it was engineered to covertly harvest user seed phrases and systematically empty victim wallets by encoding the stolen secrets directly into micro-transactions executed on the Sui blockchain.
The security tooling firm Socket, which specializes in monitoring and protecting open-source software supply chains, installed and analyzed the extension shortly after its malicious nature was uncovered. The primary objective of the investigation was to understand how "Safery" managed to slip past automated security checks, climb the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without raising immediate alarms, while also determining what precautions users could take to identify comparable threats. The resulting security report functions simultaneously as a postmortem analysis and an urgent warning that browser extensions remain a critically vulnerable blind spot within the broader cryptocurrency landscape.
What makes this particular incident notably distinct within the history of crypto exploits is that the perpetrators did not rely on traditional brand spoofing. Unfortunately, impersonating established projects is well-trodden territory for digital thieves. Typically, malicious actors deploy MetaMask lookalikes or exploit recycled phishing domains designed to trick unsuspecting visitors. Safery, by contrast, chose an entirely different vector. It fabricated a completely new identity, utilized purchased or automated bot-generated reviews to artificially inflate its search rankings, and launched itself as a seemingly novel wallet option available to the public.
This calculated approach meant the store listing lacked the classic warning signs that seasoned cryptocurrency users usually look for. There was no broken grammar in the descriptions, no requests for bizarre or excessive permissions, and no suspicious redirections pointing users toward shady external domains. Furthermore, the Chrome Web Store publisher page carried no prior user complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by security tracking services at the time Socket conducted its analysis.
Given the high level of polish and the absence of glaring red flags, the average web user would likely feel little hesitation before clicking the "Add to Chrome" button. Like many standard web-based crypto tools, the extension requested permission to run across "all websites," which is a routine functional requirement for applications that need to interface seamlessly with various decentralized applications. Notably, the software avoided prompting users for extra permissions or attempting to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The overall branding remained minimalist, the accompanying website mirrored the extension’s title down to the letter, and the initial setup screen guided users through the standard process of either creating a fresh wallet or importing an existing one—behavior indistinguishable from any legitimate application.
The Seed Heist, Broadcast Over Sui
The true damage began the moment a user inputted their recovery seed phrase. Instead of storing the phrase locally within the browser storage or encrypting it securely for user access, the malicious extension silently divided the phrase into discrete fragments and encoded them to resemble ordinary, randomized wallet addresses.
According to Socket’s technical research, these fragmented pieces of sensitive data were subsequently embedded directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so negligible that they would never draw the attention of the account holder—directed toward wallet addresses under the direct control of the attackers. Hidden neatly inside those transactions, whether packed into transaction memo fields or disguised within obfuscated addresses, were the broken components of the user’s seed phrase.
This operational methodology provided the hackers with substantial tactical advantages. Crucially, the extension did not need to dispatch outbound network requests to malicious command-and-control servers. There were no suspicious beacons or data exfiltration attempts carried out over HTTP or WebSockets that a modern web browser or traditional antivirus software might easily flag and intercept. Instead, the malicious payload left the user’s device packaged as a completely normal-looking blockchain transaction, successfully routed through a widely utilized, low-fee decentralized network. Once the data successfully landed on-chain, it was publicly accessible, permitting the attackers to retrieve the pieces at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to interact with the victim’s device a second time.
In effect, the scam repurposed the Sui blockchain infrastructure to function as an alternative communications channel. Because the Sui network offers rapid transaction confirmation times alongside negligible execution costs, it operated effectively as a low-latency message bus for the thieves. Socket successfully traced multiple instances of these seed-fragment transactions and definitively confirmed the direct causal link between entering the recovery phrase into the extension and the subsequent loss of funds. While the actual thefts took place off-chain—primarily targeting Ethereum or other Layer-1 networks where the victims held substantial cryptocurrency balances—the precise instructions required to carry out the robberies were hidden in plain sight on an entirely separate ledger.
Before deploying the specific version that ultimately claimed a prominent spot in Chrome’s trending wallet results, the publisher almost certainly tested the underlying methodology in private. Evidence indicates that earlier, unreleased builds experimented with far simpler data leakage techniques before the Sui-based encoding mechanism was fully perfected. By the time the active iteration of the extension was flagged by security researchers, it had accumulated a sufficient volume of installations to propel it into Chrome’s coveted "trending" tier, which further amplified its visibility to unsuspecting users. Reports highlighted that the Safery wallet remained prominently featured among the top search results for Ethereum wallets even as early warnings and discussions regarding its suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged primarily on the underlying mechanics of Chrome’s search and ranking logic. The Web Store search algorithm continuously evaluates a combination of factors, including exact keyword matches, total installation counts, review velocity, average user ratings, and the recency of the last software update. Applications that experience a sudden, sharp burst of user activity, particularly within specialized niches like cryptocurrency, can climb search rankings rapidly if their more thoroughly vetted competitors have not updated their listings recently. In this specific scenario, Safery combined a highly optimized name that performed well against common search queries, a coordinated blitz of positive reviews—many of which were templated or duplicated—and a fresh upload timestamp that signaled ongoing maintenance.
Available evidence indicates that Google did not manually review the listing prior to its publication. The Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan alongside fundamental static analysis. Deeper scrutiny is generally reserved for extensions that request highly elevated permissions, such as direct access to active browsing tabs, system clipboards, file systems, or complete browsing history. Wallet extensions frequently manage to bypass these aggressive flags by executing their interfaces within localized iframes or relying on officially approved application programming interfaces. Safery strictly operated within these permissible boundaries.
Even after concerned users began raising alarms, the critical window of time stretching between the initial reporting and the final store takedown proved long enough for significant financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not automatically disable flagged extensions instantly unless there is an overwhelming consensus of reports or a match against known malware signatures. In this instance, the payload consisted of heavily obfuscated JavaScript that leveraged standard blockchain infrastructure rather than communicating with malicious external hosts, meaning traditional malware detection heuristics failed to catch it.
This incident is far from the first time browser extensions have been weaponized to target cryptocurrency assets. Past security campaigns have utilized deceptive Ledger Live web applications designed to prompt users for recovery phrases, or involved the compromise of legitimate extensions to siphon publishing keys from unsuspecting developers. What set Safery apart was the sheer smoothness of its user-facing facade and the total absence of traditional backend infrastructure. There was no conventional phishing website to take offline, and no remote server to block—just a single browser extension quietly translating secrets onto a public blockchain before walking away.
For impacted individuals, remedial actions were limited. Those who acted with extreme urgency could mitigate their exposure by immediately rotating seed phrases and revoking outstanding token approvals. Security firms like Socket published clear triage instructions for anyone who had installed the extension, advising them to uninstall the software immediately, revoke active token approvals, transfer remaining assets to a freshly generated wallet utilizing an uncompromised device, and continuously monitor associated blockchain addresses. For users who failed to notice the silent exfiltration in time or kept substantial balances stored within vulnerable hot wallets, financial recovery remained highly unlikely.
The episode has intensified calls from security researchers and developers for the implementation of stronger heuristics directly within the Chrome platform. Proposed solutions include automatically flagging any extension that features user interface components prompting for standard 12- or 24-word recovery phrases. Additional recommendations involve enforcing publisher attestation requirements for wallet extensions, providing cryptographic proof that a specific publisher legitimately controls the codebase behind a recognized brand. Calls have also been made for more rigorous inspection of wallet-related permissions, even when those requests avoid triggering traditional dangerous access patterns.
For everyday users, security analysts continue to emphasize the importance of rigorous due diligence when managing browser extensions. Before installing any cryptocurrency-related tool, users are advised to carefully investigate the publisher’s history, verify authentic associations with recognized projects, inspect review patterns for anomalies like clusters of identical text, confirm the existence of legitimate web links tied to public code repositories, and thoroughly review the permissions tab for vague or overly broad access requests. A clean aesthetic and a high user rating are no longer sufficient guarantees of safety.
The incident underscores ongoing tensions regarding the browser’s dual role as a gateway to decentralized finance. Browser-based wallets exploded in popularity largely due to their high accessibility and ease of use, allowing individuals to interact with decentralized applications effortlessly without needing to switch platforms or install standalone software. However, that convenience has introduced profound security exposure. The modern web browser remains a high-risk environment uniquely vulnerable to extension manipulation, session hijacking, clipboard scrapers, and covert blockchain exfiltration.
As a result, cryptocurrency developers are increasingly re-evaluating their distribution models. Some teams already actively discourage users from relying on Chrome Web Store installations, preferring to direct traffic toward dedicated mobile applications or verified desktop binaries. Others may soon introduce automated warnings for users attempting to install applications from unverified sources. The foundational challenge persists: digital distribution remains heavily fragmented, and the vast majority of users lack the technical expertise required to easily distinguish a legitimate financial tool from a polished clone.
The Safery extension did not need to masquerade as an established industry giant to succeed; it simply engineered its own brand, manufactured artificial trust signals, and constructed an invisible backdoor that utilized a public blockchain as its courier. This reality demands a fundamental reassessment of how trust is established within cryptocurrency user experiences, and serves as a stark reminder of how deeply integrated casual browser tools have become with users’ core financial assets. In the digital economy, users frequently assume that Web3 technologies guarantee sovereignty and self-custody, but in compromised hands, a simple browser extension functions less like a secure vault and more like an open port—one that a major web browser may not always warn you about before something slips through.
Lina Hope 
Basiran 
Raul Delapena Setiawan