By Nana Wu 
For a few days in November, a malicious browser extension managed to infiltrate the Chrome Web Store, climbing all the way to the fourth position for the heavily contested search term "Ethereum wallet." Disguised under the name "Safery: Ethereum Wallet," the application was engineered with a level of polished deception that allowed it to easily bypass casual scrutiny. It featured a clean, professional icon, a generic name cleverly positioned alongside security-related terminology, a sudden influx of five-star reviews, and boilerplate descriptions that instantly looked familiar to anyone accustomed to downloading cryptocurrency software.
Beneath this deceptively standard frontend, however, lay a purpose-built attack mechanism. The extension was designed to capture seed phrases entered by unsuspecting users, systematically drain their connected assets, and exfiltrate the stolen secrets by encoding them directly into micro-transactions on the Sui blockchain. The operation came to light after security tooling firm Socket, which specializes in open-source software supply chains, installed and analyzed the extension following its discovery in the wild.
Socket’s investigation aimed to dissect how "Safery" successfully evaded detection, manipulated the Chrome Web Store’s search rankings, and spirited away sensitive seed phrases without triggering automated alarms. Furthermore, the security team sought to outline actionable steps users could take to spot similar threats in the future. The resulting technical report serves simultaneously as a detailed postmortem of the security failure and a stark warning that browser extensions continue to represent a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident stand out among cybersecurity researchers is that the threat actors behind "Safery" did not rely on traditional spoofing tactics. Rather than attempting to mimic an established, trusted wallet brand—such as creating a MetaMask lookalike or deploying a recycled phishing domain—the hackers chose to invent an entirely new identity. They purchased or generated bot-driven fake reviews to artificially inflate the listing’s search rankings and launched the software as a completely novel wallet option on the market.
Because the extension did not impersonate a known entity, its listing displayed virtually none of the standard red flags that vigilant users have learned to watch out for. There was no broken grammar in the descriptions, no suspicious permission requests that immediately raised eyebrows, and no redirections to shady, unverified external domains. The publisher page on the Chrome Web Store had no prior complaints logged against it, and its designated support URL directed traffic to an off-platform website that security trackers had not yet flagged at the time of Socket’s analysis.
Given its remarkably polished appearance, the average user would likely have felt little hesitation before clicking the "Add to Chrome" button. Much like legitimate crypto utilities, the extension requested permission to run on "all websites"—a standard operational requirement for tools that need to interact with various decentralized applications across the web. Notably, it refrained from prompting for extra, highly privileged permissions or attempting to inject complex content scripts that might have tripped Chrome’s more aggressive automated security warnings. Its branding remained minimalist, its companion website mirrored the extension’s exact name, and its onboarding setup screen naturally prompted users to either create a brand-new wallet or import an existing one, mimicking entirely standard behavior.
The Seed Heist, Broadcast Over Sui
The true damage of the operation began the moment a user inputted their private recovery seed phrase. Rather than storing the sensitive phrase locally or encrypting it for legitimate user access, the extension silently fractured the phrase into discrete pieces. It then encoded these fragments to resemble random, innocuous wallet addresses.
Socket’s forensic research demonstrated that these fragmented pieces were systematically injected into Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers—amounts so small they would naturally draw zero attention—to various addresses directly controlled by the attackers. Hidden neatly inside those transactions, either tucked away within memo fields or embedded in obfuscated destination addresses, were the broken-down components of the victim’s seed phrase.
This tactical approach offered significant advantages to the malicious actors. By routing the data through the blockchain, the extension avoided making outbound HTTP or WebSocket requests to suspicious command-and-control servers. There was no outward-facing network beacon that a browser or local antivirus software might easily flag and intercept. Instead, the stolen payload left the user’s device disguised as a completely normal-looking blockchain transaction, seamlessly routed through a widely utilized, low-fee network. Once the data successfully landed on-chain, it was publicly accessible, enabling the attacker to quietly retrieve it at their leisure, reconstruct the seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the scammers repurposed the Sui blockchain itself to function as a clandestine communications channel. Because the Sui network boasts exceptionally fast confirmation times alongside negligible transaction costs, it operated with the efficiency of a low-latency message bus. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct correlation between seed entry and subsequent asset loss. While the actual thefts occurred off-chain—primarily on Ethereum or other Layer-1 networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the thefts were hidden entirely in plain sight.
Before releasing the final version that managed to secure a spot in Chrome’s top wallet search results, the publisher likely tested the methodology within a controlled, private environment. Evidence gathered by researchers indicates that earlier builds experimented with much simpler data leaks before the Sui encoding technique was fully refined. By the time the active, malicious extension was finally flagged and scrutinized, it had accumulated enough installations to break into Chrome’s coveted "trending" tier, which further amplified its visibility to prospective victims. Reports confirmed that the "Safery" wallet maintained a prominent position among the top results for Ethereum wallet searches even as anxious users began circulating warnings about suspicious behaviors on platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" operation hinged heavily on the underlying mechanics of Chrome’s search and ranking logic. The Web Store search algorithm primarily weighs keyword matches, total install counts, review velocity, average star ratings, and how recently an extension was updated. Consequently, extensions that experience a sudden burst of activity—particularly within niche categories where better-vetted competitors are not updated frequently—can climb the rankings at a rapid pace. In this instance, "Safery" combined a keyword-optimized name that scored well for common queries with a blitz of positive reviews, many of which were clearly templated or duplicated, alongside a fresh upload date.
Available evidence indicates that Google did not conduct a manual human review of the listing prior to its publication. The Chrome Web Store policy typically processes most new extension submissions through a brief automated scan alongside fundamental static analysis. Deeper scrutiny is generally reserved for extensions that request explicitly elevated permissions, such as access to browsing tabs, system clipboards, local file systems, or web history. Wallet extensions frequently manage to bypass these stricter flags by operating safely within iframes or utilizing officially approved application programming interfaces, boundaries that "Safery" carefully respected.
Even after concerned users began raising alarms, the crucial window of time stretching between initial reporting and eventual platform takedown remained long enough for substantial financial damage to occur. Part of this lag is structural; the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or definitive, known malware signatures. Because the payload in this case relied on obfuscated JavaScript interacting directly with public blockchain infrastructure rather than external host servers, traditional malware detection signatures failed to catch it.
This incident is far from the first time browser extensions have been weaponized to target cryptocurrency holdings. Previous high-profile scams have involved fake Ledger Live applications prompting users to enter recovery phrases, or legitimate extensions that were hijacked after attackers managed to compromise a developer’s publishing key. What set "Safery" apart, however, was the immaculate smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no external phishing site to dismantle, and no rogue server IP address to block—just a single browser extension quietly moving secrets onto a public ledger and walking away.
Users caught in the crossfire still retained a narrow window of recourse. Those who acted rapidly could limit their overall exposure by immediately rotating their seed phrases and revoking outstanding transaction approvals across their connected accounts. Socket and other security entities published clear triage steps for anyone who inadvertently installed the software: uninstall the extension immediately, revoke token approvals, sweep remaining assets to a fresh wallet generated on a secure and clean device, and closely monitor associated addresses. For users who failed to notice the silent exfiltration in time, or those who stored large asset balances in hot wallets, full financial recovery remained highly unlikely.
Security researchers and independent developers are now pushing for the implementation of stronger heuristics directly within the Chrome platform. One prominently proposed solution involves automatically flagging any extension that features user interface elements prompting individuals to input 12- or 24-word recovery phrases. Another recommended approach is to require mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the codebase behind a recognized wallet brand. Additional calls have been made for tighter inspections of wallet-associated permissions, even when those permissions do not explicitly incorporate traditionally dangerous access patterns.
For end users, security firms have emphasized the need for heightened vigilance and practical checklist management. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s historical track record, verify concrete associations with known and trusted projects, inspect review patterns for artificial bursts of identical feedback, check for legitimate website links backed by public code repositories, and scrutinize the permissions tab for sweeping or vague access requests. Ultimately, a clean name and a high star rating are no longer sufficient guarantees of safety.
The episode raises much broader, uncomfortable questions regarding the fundamental role of web browsers in the modern cryptocurrency landscape. Browser-based wallets originally surged in popularity due to their high accessibility and ease of use, allowing everyday individuals to seamlessly interact with decentralized applications without needing to switch platforms or download standalone desktop applications. However, that vital accessibility has come at a severe security cost, exposing users to a high-risk digital environment subject to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based exfiltration.
As a result, wallet developers are likely to fundamentally rethink their distribution models moving forward. Some development teams already actively discourage Chrome Web Store installations, preferring instead to direct users toward dedicated mobile applications or verified desktop binaries, while others may implement native warnings for users attempting to install software from unverified sources. The core structural problem, however, persists: software distribution remains heavily fragmented, and the vast majority of everyday users lack the technical literacy required to distinguish a legitimate financial tool from a polished, malicious clone.
The "Safery" extension proved that malicious actors no longer need to successfully impersonate industry giants like MetaMask or Phantom to execute large-scale theft. By inventing an entirely new brand, seeding fabricated trust signals, and building an invisible, blockchain-powered backdoor, they demonstrated the vulnerabilities inherent in modern digital infrastructure. This reality forces a profound reassessment of how trust is established within cryptocurrency user experiences, reminding the community that in the wrong hands, a standard browser wallet functions less like a secure digital vault and more like an open port—one that popular browsers may not always warn you about before something slips completely through.
Reynand Wu 
Pevita Pearce