By Siti Muinah 
For a few critical days in November, a malicious software masquerading as a legitimate cryptocurrency utility managed to climb the ranks of the Chrome Web Store, securing the fourth position for the heavily trafficked search term "Ethereum wallet."
The extension, deceptively titled "Safery: Ethereum Wallet," presented a polished, professional facade designed to easily bypass the casual scrutiny of everyday web users. It featured a clean, modern icon, a generic name strategically combined with security-adjacent terminology, a heavy influx of five-star reviews, and boilerplate introductory descriptions that are instantly familiar to anyone who has ever onboarded into a decentralized finance ecosystem.
However, behind this sophisticated and completely benign-looking frontend lay a purpose-built attack mechanism. The extension was engineered to intercept, capture, and exfiltrate user seed phrases, systematically draining associated wallets by encoding stolen sensitive secrets into tiny, inconspicuous micro-transactions executed directly on the Sui blockchain.
The threat was brought to light and thoroughly examined by Socket, a prominent security tooling company that specializes in monitoring open-source software supply chains. Following the discovery, Socket’s security researchers installed and analyzed the extension to decode how "Safery" managed to successfully dodge automated security detections, manipulate the Chrome Web Store search rankings, and siphon off sensitive seed phrases without immediately raising alarms.
The resulting technical postmortem serves as a stark warning to the broader digital asset community, highlighting the ongoing reality that browser extensions remain a dangerous and frequently overlooked blind spot in cryptocurrency security. What makes this particular incident especially noteworthy is that the malicious actors behind Safery did not rely on traditional spoofing tactics. They did not attempt to clone an existing, trusted wallet brand, nor did they deploy a MetaMask lookalike or recycle a malicious phishing domain.
Instead, the perpetrators invented an entirely new digital identity from scratch, utilizing bought or botted fake reviews to artificially inflate their search engine rankings, and officially launching as a novel wallet option. Because of this strategic choice, the extension’s listing page showed virtually no immediate red flags. There was no broken grammar in the descriptions, no requests for bizarre or excessive permissions, and no suspicious redirects to shady external domains.
Furthermore, the Chrome Web Store publisher page had no history of prior complaints or violations. Its designated support URL pointed directly to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket’s analysis.
Given its remarkably polished and professional appearance, the average user would have felt little to no hesitation before clicking the "Add to Chrome" button. Like countless legitimate Web3 tools, the extension requested standard permissions to run across all websites—a functional necessity for any browser-based wallet needing to interact seamlessly with decentralized applications.
Notably, it refrained from prompting users for extra administrative permissions and avoided injecting content scripts that might have tripped Chrome’s more aggressive automated security warnings. The overall branding was minimalist, the accompanying support website precisely matched the extension’s name, and the initial setup screen guided users through standard wallet creation and import procedures.
The Seed Heist, Broadcast Over Sui
The real financial damage began the moment a user typed or pasted their secret recovery phrase into the extension interface. Rather than storing the seed phrase locally on the user’s machine or encrypting it for legitimate user access, the extension silently fragmented the phrase into smaller pieces. It then cleverly encoded these fragments to look like completely random, innocuous wallet addresses.
Socket’s deep-dive research revealed that these encrypted fragments were systematically inserted directly into Sui blockchain transactions. Specifically, the malicious extension executed minuscule SUI token transfers—amounts so negligible they would never draw the attention of a casual observer—routing them to various addresses completely controlled by the attacker.
Concealed deep inside those routine-looking blockchain transactions, hidden within memo fields or obfuscated recipient addresses, were the exact constituent pieces of the victim’s seed phrase. This novel operational approach offered the attackers significant tactical advantages.
The extension completely eliminated the need to send outbound network requests to centralized malicious servers. There was no suspicious command-and-control beacon operating in the background, and no covert data exfiltration routed over traditional HTTP or WebSocket protocols that a modern browser or standard antivirus program might easily flag.
Instead, the stolen payload departed the user’s local device disguised as an entirely normal, legitimate blockchain transaction, neatly routed through a widely used, low-fee blockchain network. Once successfully published on-chain, the fragmented data became publicly accessible, allowing the anonymous attackers to retrieve it at their leisure, reconstruct the complete seed phrase, and systematically sweep external assets clean without ever needing to touch the user’s device again.
In effect, the sophisticated scam weaponized the Sui blockchain itself, turning it into a covert communications channel. Because the Sui network boasts exceptionally fast transaction confirmation times and virtually negligible gas costs, it functioned with the efficiency of a low-latency message bus.
Socket successfully traced multiple historical examples of these seed-fragment transactions, definitively confirming the direct causal link between the entry of the seed phrase and the eventual, devastating loss of assets. While the actual thefts ultimately occurred off-chain—predominantly on Ethereum or other Layer-1 networks where the victims’ wallets held substantial capital—the precise instructions required to carry out the heists were hidden entirely in plain sight.
Before releasing the final version that successfully landed within Chrome’s top wallet search results, the publisher almost certainly tested the methodology in private environments. Digital forensics indicate that earlier, unreleased builds experimented with much simpler data leakage techniques before the Sui-based encoding mechanism was fully perfected.
By the time the active, malicious extension was finally flagged and reported, it had already accumulated enough active installations to surge into Chrome’s coveted "trending" tier, which further amplified its visibility. Industry reports confirmed that the Safery wallet comfortably maintained a position near the top of the search results for Ethereum wallet queries, even as anxious users began circulating urgent warnings regarding suspicious wallet behavior across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery scam hinged almost entirely on the specific mechanics of the Chrome Web Store’s ranking logic. The platform’s search algorithm evaluates multiple signals, including keyword matching frequency, total installation counts, review velocity, average user ratings, and overall update recency.
Extensions that experience a sudden, sharp burst of user activity—particularly within specialized or niche categories—can climb the rankings rapidly if their more thoroughly vetted, legitimate competitors are not updated with equal frequency. In this specific case, Safery benefited from a title optimized for high-volume search queries, a coordinated blitz of positive reviews that often featured duplicated or templated phrasing, and a very fresh upload date.
There is no evidence to suggest that Google manually reviewed the listing prior to publication. Standard Chrome Web Store enforcement policies process most newly submitted extensions through brief automated code scans and fundamental static analysis tools.
Extensions typically face deeper administrative scrutiny only when they request elevated, high-risk permissions, such as direct access to open browser tabs, the system clipboard, local file systems, or browsing history. Crypto wallet extensions frequently manage to avoid triggering these defensive flags by operating carefully within isolated iframes or utilizing standard, pre-approved application programming interfaces. Safery strictly operated within those established regulatory bounds.
Even when vigilant users began raising public concerns about the extension, the operational lag between the initial reporting and the final store takedown stretched on long enough for extensive financial damage to occur. Part of this delay is structural: the Chrome ecosystem does not automatically disable flagged extensions instantly unless there is an overwhelming consensus of reports or definitive, known malware signatures matched by automated systems.
In this scenario, the payload consisted entirely of obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than traditional, centralized external hosts. Consequently, conventional malware detection methods failed to catch it in time.
This incident is far from an isolated event; historically, browser extensions have repeatedly been targeted or weaponized to steal user cryptocurrency. Previous high-profile scams have involved fraudulent Ledger Live applications prompting unsuspecting users to enter master recovery phrases, or legitimate developer accounts being hijacked to push unauthorized updates.
What fundamentally differentiated Safery from these past incidents was the extreme smoothness of its frontend facade and the absolute absence of traditional backend server infrastructure. There was no external phishing website to seize, no command server infrastructure to block, and no centralized database to subpoena—just a single browser extension quietly depositing stolen secrets onto a public ledger and walking away cleanly.
Impactful defensive measures remained available to users who acted with extreme speed. Those who realized they had interacted with the malicious extension quickly enough could limit their ongoing exposure by immediately generating new seed phrases, transferring their assets to entirely clean devices, and revoking all outstanding transaction permissions.
Security firms like Socket quickly published comprehensive triage guidelines for anyone who had installed the extension: uninstall the software immediately, thoroughly revoke active token approvals, sweep remaining digital assets to a brand-new wallet using a sanitized device, and closely monitor all associated addresses for unauthorized activity. However, for everyday users who failed to notice the silent data exfiltration or who maintained substantial capital balances within vulnerable hot wallets, asset recovery remained virtually impossible.
The broader security community, including independent developers and enterprise cybersecurity researchers, are now aggressively calling for more advanced heuristic detection rules directly from browser providers. One prominent proposed solution involves implementing automated flags that immediately trigger whenever an extension introduces user interface elements that explicitly prompt for standard 12-word or 24-word recovery phrases.
Another widely discussed countermeasure is the introduction of mandatory publisher attestation requirements specifically for wallet extensions. This system would provide cryptographic, verifiable proof that a listed publisher genuinely controls the underlying codebase associated with a recognized wallet brand. Additional industry feedback has demanded much tighter inspection of wallet-related permissions, even when those permissions do not explicitly trigger traditional high-risk access patterns.
For the end user, security experts emphasize that a clean visual presentation and high numerical ratings are no longer sufficient guarantees of safety. The ongoing fallout from the Safery incident has reignited profound questions regarding the inherent risks of relying on web browsers as the primary interface for decentralized finance. While browser-based wallets achieved widespread popularity due to their accessibility and convenience—allowing users to interface with complex decentralized applications without requiring separate native desktop applications or platform switches—that convenience has come at a severe security cost.
The modern web browser remains a high-risk operating environment inherently vulnerable to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration. As the web3 ecosystem continues to evolve, wallet developers and infrastructure providers will likely be forced to fundamentally rethink their distribution models, potentially steering users away from browser stores in favor of standalone mobile applications or native desktop binaries equipped with rigorous sandboxing, leaving the broader digital asset community to grapple with the reality that convenience and absolute self-custody remain uneasy allies.
Muslim 
Nana Wu 
Reynand Wu