By Reynand Wu 
For a brief and alarming window of time last November, a sophisticated malicious Chrome extension managed to climb its way to the fourth position in the Chrome Web Store search results for the high-value query "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," was engineered with an extraordinary degree of polish, easily fooling casual observers into believing it was a legitimate piece of financial software. It featured a clean, professional icon, a generic name paired with security-adjacent terminology, a heavy influx of five-star user reviews, and standard boilerplate descriptions that immediately felt familiar to anyone accustomed to downloading cryptocurrency wallets.
However, hiding directly behind this clean, unassuming frontend was a purpose-built attack mechanism. The extension was designed to capture sensitive seed phrases and completely empty user wallets by cleverly encoding stolen confidential secrets into tiny, micro-transactions executed on the Sui blockchain.
The operation came to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and closely analyzed the extension following its initial discovery in the wild. The objective of their investigation was to understand how "Safery" managed to completely evade automated detection systems, successfully manipulate the Chrome Store search rankings, and exfiltrate sensitive seed phrases without ever raising internal security alarms. Furthermore, the firm sought to outline what users could do to spot remarkably similar threats in the future. The resulting technical report walks through the attacker’s unique methodology, serving simultaneously as a forensic postmortem and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case so noteworthy is that the malicious actors did not simply resort to stealing seed phrases—a criminal endeavor that is, unfortunately, already well-trodden territory in the crypto sector. Rather, what sets it apart is that Safery did not spoof an existing, trusted wallet brand. It was not a clumsy MetaMask lookalike or a recycled phishing domain designed to catch typos. Instead, it invented an entirely new identity, utilized purchased or automated bot-generated fake reviews to rapidly climb search result rankings, and launched itself cleanly as a "brand new" wallet option for unsuspecting users.
This strategic approach ensured that the listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no odd or frightening permission requests, and no suspicious redirection to shady external domains. The Chrome Web Store publisher page carried no prior history of complaints, and its designated support URL directed traffic to an off-platform website that had not yet been flagged by security trackers at the time Socket performed its deep-dive analysis.
Given its polished appearance and professional layout, most everyday users would not have hesitated for even a single second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is an exceptionally common and expected request for cryptocurrency wallets that need to seamlessly interact with various decentralized applications across the web.
Notably, the extension did not prompt users for extra permissions or attempt to inject intrusive content scripts that would typically trigger Google Chrome’s more aggressive security warnings. Its branding remained entirely minimalist, its accompanying website precisely matched the extension’s exact name, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—again, completely standard behavior for legitimate software in this category.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their confidential seed phrase into the interface. Instead of storing the phrase locally or encrypting it securely for user-only access, the malicious extension silently split the critical phrase into distinct fragments. It then systematically encoded these fragments to look precisely like random, ordinary wallet addresses.
Detailed research conducted by Socket demonstrated that these data fragments were covertly inserted directly into Sui blockchain transactions. Specifically, the extension initiated tiny, minuscule SUI token transfers—amounts so small they would naturally draw zero attention—to various addresses directly controlled by the attacker. Hidden safely inside those innocuous transactions, either tucked away inside memo fields or cleverly obfuscated within the recipient addresses themselves, were the fractured pieces of the user’s private seed phrase.
This clever approach provided the attackers with significant tactical advantages. Crucially, it meant the extension did not need to send outbound network requests to malicious, external servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration over standard HTTP or WebSockets that a modern web browser or traditional antivirus software might easily flag and block.
Instead, the malicious payload left the user’s local device disguised as a completely normal-looking blockchain transaction, smoothly routed through a widely utilized, low-fee blockchain network. Once successfully recorded on-chain, the data became publicly accessible, granting the attacker the luxury of retrieving it at their leisure, reconstructing the complete seed phrase, and systematically sweeping the victims’ funds without ever needing to touch the user’s device a second time.
In effect, the scam creatively weaponized the Sui blockchain itself, turning it into a dedicated communications channel. And because the Sui network boasts remarkably fast confirmation times alongside negligible transaction costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple distinct examples of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts ultimately occurred off-chain—taking place on Ethereum or other Layer-1 networks where the victims’ wallets conveniently held valuable funds—the explicit instructions required to carry them out were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher likely tested this novel methodology in private. Technical evidence indicates that earlier, unreleased builds experimented with much simpler data leaks before the Sui encoding technique was thoroughly refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to comfortably reach Chrome’s "trending" tier, which only served to further boost its visibility and attract more victims. Industry tracking previously reported that the "Safery" wallet sat securely among the top results for Ethereum wallet searches even as frantic reports of suspicious behavior and sudden asset drain began circulating across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged heavily on the underlying ranking logic of the Chrome Web Store search engine. The store’s algorithm carefully weighs factors such as keyword matches, total install counts, review velocity, average star ratings, and the recency of the last software update.
Extensions that experience a sudden, manufactured burst of activity, particularly within specialized or niche categories, can climb search rankings with alarming rapidity if better-vetted, established competitors are not updated frequently. In this specific scenario, "Safery" possessed a name that scored exceptionally well for common user search queries, a blitz of positive reviews—many of which were clearly templated or duplicated—and a very fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policies dictate that most newly submitted extensions receive only a brief automated scan and fundamental static analysis before being cleared for the public market.
Extensions typically undergo much deeper scrutiny when they explicitly request elevated, dangerous permissions, such as broad access to user browser tabs, system clipboards, local file systems, or browsing history. Wallet extensions routinely manage to avoid triggering these heavy security flags by operating safely within isolated iframes or by utilizing officially approved application programming interfaces. "Safery" carefully stayed strictly within those permitted bounds.
Even when vigilant users raised serious concerns about the software, the critical time gap between the initial reports being filed and the eventual takedown of the listing stretched on for long enough to allow substantial financial damage to occur. Part of that operational lag is structural: the Chrome Web Store does not automatically act on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or clearly identifiable malware signatures.
In this case, however, the malicious payload consisted entirely of heavily obfuscated JavaScript that relied exclusively on legitimate blockchain infrastructure rather than external, malicious web hosts. Traditional malware detection methods simply failed to catch it in time.
This security incident is far from the first time that browser extensions have been exploited as a vector to steal cryptocurrency from unwary users. Previous high-profile scams have included fake Ledger Live applications that improperly prompted users to enter their recovery phrases, or the hijacking of otherwise legitimate extensions that allowed attackers to gain unauthorized access to a developer’s official publishing key.
What ultimately made "Safery" uniquely dangerous was the sheer smoothness of its front-end facade combined with the complete absence of traditional backend infrastructure. There was no external phishing website to take down, no rogue server to block or seize—just a single browser extension quietly moving secrets onto a public blockchain and walking away cleanly.
Affected users still possessed some narrow avenues of recourse. If they acted with extreme urgency, they could limit their overall exposure by immediately rotating their seed phrases and revoking prior transaction approvals.
Security firms like Socket quickly published practical triage steps for anyone who had mistakenly installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets over to a completely new wallet utilizing a clean, uncompromised device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent exfiltration in time, or who stored massive amounts of capital directly in vulnerable hot wallets, financial recovery remained highly unlikely.
Security researchers and independent software developers are now calling for much stronger heuristic checks directly from Google Chrome itself. One prominent proposed solution involves automatically flagging any browser extension that includes user interface elements prompting individuals to input a 12- or 24-word recovery phrase.
Another heavily discussed approach is to mandate strict publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase behind a known, trusted wallet brand. There are also growing industry calls for much tighter inspection of wallet-related permissions, even in instances where those permissions do not explicitly include dangerous access patterns.
For everyday end users, Socket published a comprehensive, practical checklist for safe extension management. Before installing any cryptocurrency-related extension, users are strongly advised to thoroughly review the publisher’s historical track record, verify official associations with known and respected projects, closely inspect the pattern of user reviews—keeping an eye out for suspicious bursts of identical text—check for real, verifiable website links backed by public GitHub repositories, and carefully scan the permissions tab for vague or sweeping access requests.
As this incident demonstrates, a clean name and a high star rating are simply no longer enough to guarantee safety.
This troubling case raises much broader, uncomfortable questions regarding the browser’s expanding role in the cryptocurrency ecosystem. Browser-based wallets originally gained immense popularity primarily due to their accessibility and sheer ease of use, enabling individuals to interact seamlessly with decentralized applications without forcing them to switch platforms or download separate desktop applications.
However, that unprecedented accessibility has come at a severe cost to user security and exposure. The modern web browser remains an inherently high-risk computing environment that is constantly vulnerable to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based exfiltration.
Wallet developers are now expected to seriously rethink their traditional distribution models. Some forward-thinking teams already actively discourage Chrome Web Store installations, preferring instead to direct users exclusively toward standalone mobile applications or verified desktop binaries. Others may soon implement built-in warnings for users attempting to install software from unverified sources.
The core underlying problem persists: software distribution remains heavily fragmented, and the vast majority of everyday users lack the technical expertise required to distinguish a legitimate financial wallet from a polished, malicious clone.
The "Safery" extension proved that it did not need to impersonate an industry giant like MetaMask or masquerade as Phantom to succeed. It simply created its own credible brand, seeded fake trust signals, and constructed an invisible digital backdoor that ingeniously used the Sui blockchain as its courier.
That reality should force a profound industry-wide rethink of how trust is established within cryptocurrency user experiences, and just how close to the metal even casual tools like browser extensions truly operate. Crypto users frequently operate under the assumption that Web3 technology inherently guarantees sovereignty and self-custody. Yet, in the wrong hands, a browser wallet functions less like a secure digital vault and more like an open port—and Google Chrome will not always warn you before something dangerous slips right on through.
Pevita Pearce 
Lina Hope