By Basiran 
For a few critical days last November, a sophisticated malicious Chrome extension managed to climb the ranks of the Chrome Web Store, positioning itself as the fourth organic result for the high-volume search term "Ethereum wallet."
The application, deceptively named "Safery: Ethereum Wallet," was engineered with a level of polish that allowed it to seamlessly blend in with legitimate cryptographic tools. It featured a clean, professional icon, a generic yet security-adjacent name designed to inspire confidence, a rapid influx of five-star reviews, and boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a decentralized finance tool.
Beneath this deceptively calm frontend, however, lay a purpose-built attack mechanism. The extension was designed to systematically steal seed phrases and completely empty user wallets by cleverly encoding stolen confidential secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light after open-source software supply chain security firm Socket installed and analyzed the extension following its sudden discovery. The primary objective of Socket’s investigation was to dissect how "Safery" managed to completely evade automated detection systems, successfully manipulate the Chrome Store search rankings, and exfiltrate sensitive seed phrases without ever raising security alarms. Furthermore, the security team sought to outline actionable steps users could take to spot similar novel threats in the future. The resulting technical report serves simultaneously as a forensic postmortem and a stark warning that browser extensions continue to represent a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy within the annals of crypto security is that the malicious actors did not rely on the well-trodden territory of brand spoofing. Unfortunately, impersonating existing infrastructure is common, but Safery did not attempt to masquerade as a MetaMask lookalike or operate a recycled phishing domain. Instead, the creators invented an entirely new identity, utilized bot-driven or purchased fake reviews to organically climb search rankings, and launched the application as a legitimate, novel wallet option.
This calculated approach meant that the official Chrome Web Store listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no obviously suspicious permissions requested, and no sudden redirections to shady external domains. The official Chrome Web Store publisher page carried zero prior complaints, and its designated support URL directed users to an off-platform website that had completely avoided flags by security trackers at the time of Socket’s analysis.
Given its remarkably polished and professional appearance, the average user would likely experience no hesitation before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for crypto wallets that must interact seamlessly with a wide variety of decentralized applications. Notably, it refrained from prompting for extra, highly privileged permissions or attempting to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding was minimalist, the accompanying website mirrored the extension’s exact name, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one—behavior that mimics standard, trusted industry practices.
The Seed Heist, Broadcast Over Sui
The true damage of the campaign commenced the exact moment a user inputted their sensitive seed phrase. Rather than storing the recovery phrase locally or utilizing standard encryption methods for user access, the extension silently and methodically fractured the phrase into distinct pieces. It then encoded these fragments to look precisely like random wallet addresses.
According to Socket’s comprehensive research, these data fragments were covertly inserted directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—amounts so negligible that they would never draw attention—directed toward addresses completely controlled by the attacker.
Concealed deep inside those transactions, hidden neatly within memo fields or obfuscated recipient addresses, were the individual pieces of the unsuspecting user’s seed phrase.
This tactical approach offered immense strategic advantages to the threat actors. Crucially, it eliminated the need for the extension to send outbound network requests to overtly malicious external servers. There was no traditional command-and-control beacon operating in the background, nor was there any data exfiltration conducted over standard HTTP or WebSockets protocols that an attentive browser environment or desktop antivirus program might easily flag.
Instead, the malicious payload departed the user’s local device disguised as a completely normal, innocuous-looking blockchain transaction. It was routed securely through a widely utilized, low-fee blockchain network. Once successfully recorded on-chain, the data remained publicly accessible yet completely obscured in plain sight, allowing the attacker to retrieve it at their leisure, reconstruct the complete seed phrase, and completely sweep the victims’ assets without ever needing to touch the user’s device again.
In effect, the operation weaponized the Sui blockchain itself, turning it into a dedicated communications channel. Because the Sui network boasts remarkably fast confirmation times alongside negligible transaction costs, it functioned flawlessly as a low-latency message bus.
Socket successfully traced multiple distinct examples of these seed-fragment transactions, definitively confirming the direct causal link between the initial entry of the seed phrase and the eventual, devastating loss of digital assets. While the actual thefts occurred off-chain—primarily targeting Ethereum or other Layer-1 networks where the victims’ wallets conveniently held valuable funds—the precise instructions required to carry out the thefts were smuggled out via another chain entirely.
Before releasing the final version that successfully captured top results in the Chrome Web Store, the malicious publisher almost certainly tested the methodology in private. Evidence gathered during the analysis indicates that earlier, experimental builds utilized much simpler data leaks before the Sui encoding technique was fully refined.
By the time the active extension was finally flagged and reported, it had accumulated enough installations to comfortably reach the Chrome store’s "trending" tier, which further amplified its visibility. Industry reports confirmed that the "Safery" wallet maintained its position among the top search results for "Ethereum wallet" even as early warnings and reports of suspicious behavior began circulating widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" campaign hinged entirely on the underlying ranking logic of the Chrome Web Store search engine. The store’s algorithm continuously weighs multiple factors, including keyword matching, total install counts, review velocity, average user ratings, and the recency of the last update.
Extensions that experience a sudden, aggressive burst of activity—particularly within specialized or niche categories—can climb the visibility ladder rapidly if established, better-vetted competitors are not updated with equal frequency. In this scenario, "Safery" successfully leveraged a name that scored exceptionally well for common user queries, combined with a blitz of positive reviews that were largely templated or duplicated, and paired them with a remarkably fresh upload date.
There is currently no evidence to suggest that Google performed a manual human review of the listing prior to publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief, automated scan alongside fundamental static analysis.
Extensions generally undergo deeper, more rigorous scrutiny only when they request explicitly elevated permissions, such as widespread access to browser tabs, system clipboards, local file systems, or browsing history. Wallet extensions frequently manage to bypass these stricter flags by operating carefully within isolated iframes or utilizing standard, approved application programming interfaces. "Safery" strictly stayed within those permissible bounds.
Even when vigilant users raised immediate concerns, the elapsed time between the initial reporting and the eventual takedown stretched out long enough for substantial financial damage to occur. Part of this lag is structural; the Chrome ecosystem does not act instantly on flagged extensions unless there is an overwhelming consensus of reports or known, identifiable malware signatures.
In this particular instance, the payload consisted of heavily obfuscated JavaScript that relied directly on legitimate blockchain infrastructure rather than external malicious hosts. As a result, traditional, signature-based malware detection methods failed to catch it.
This event is far from an isolated incident, as browser extensions have historically been targeted or utilized to steal cryptocurrency assets. Previous high-profile scams have included fake Ledger Live applications that prompted unsuspecting users to enter their recovery phrases, or the hijacking of legitimate, long-standing extensions to grant attackers access to a developer’s signing key.
What fundamentally differentiates "Safery" from previous attacks, however, is the remarkable smoothness of its operational facade and the near-total absence of traditional backend infrastructure. There was no traditional phishing website that law enforcement or security providers could take down, and no centralized command server to block—just a single extension quietly moving secrets onto a public blockchain and slipping away unnoticed.
Impactful recourse for victims remained exceedingly narrow. For users who acted with extreme swiftness, exposure could sometimes be limited by rapidly rotating seed phrases and manually revoking existing transaction approvals.
Security firms like Socket quickly published practical triage instructions for anyone who had inadvertently installed the extension: uninstall the application immediately, revoke all active token approvals, sweep remaining digital assets to a completely fresh wallet utilizing a secure, clean device, and monitor all associated addresses closely. For users who failed to notice the silent exfiltration in time, or those who maintained substantial capital balances within vulnerable hot wallets, financial recovery remained highly unlikely.
The Real Trouble Begins Before the Wallet Ever Loads
In the wake of the incident, security researchers, developers, and industry observers are strongly advocating for the implementation of much stronger heuristics directly within the Chrome Web Store review pipeline. One prominent proposed solution involves automatically flagging and holding any extension that includes user interface elements explicitly prompting for a standard 12-word or 24-word recovery phrase.
Another suggested defense mechanism is the mandatory requirement of publisher attestation for all wallet-related extensions, which would provide verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase associated with a known, trusted wallet brand. Furthermore, industry experts are calling for significantly tighter inspection protocols regarding wallet-related permissions, even when those permissions do not explicitly trigger traditional, high-risk access patterns.
For end-users navigating the ecosystem, security firms have reiterated practical checklists for safe extension management. Before installing any cryptographic browser extension, users are advised to thoroughly review the publisher’s history, independently verify official associations with recognized projects, inspect review patterns for artificial bursts of identical text, look for legitimate website links accompanied by public repositories, and carefully scan the permissions tab for overly vague or sweeping system access.
As the "Safery" incident starkly demonstrates, a clean, professional name and an artificially inflated rating are simply no longer enough to guarantee safety.
This case raises profound, broader questions regarding the fundamental role of the web browser within the modern cryptocurrency landscape. Browser-based wallets originally gained immense popularity primarily due to their accessibility and ease of use, allowing everyday users to interact seamlessly with decentralized applications without the friction of switching platforms or downloading standalone desktop applications.
However, that unprecedented accessibility has come at a severe cost to security and exposure. The modern web browser is an inherently high-risk environment subject to constant threats, including extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain-based data exfiltration.
Moving forward, wallet developers are likely to fundamentally rethink traditional distribution models. Some prominent development teams already actively discourage Chrome Web Store installations, preferring to direct users exclusively toward native mobile applications or direct desktop binaries. Other teams may soon implement proactive warnings within their official interfaces whenever a user attempts to install software from unverified third-party sources.
The core underlying problem persists: software distribution remains heavily fragmented, and the vast majority of everyday users lack the technical expertise required to reliably distinguish a legitimate, secure wallet from a highly polished clone.
The "Safery" extension did not need to successfully mimic MetaMask or masquerade as Phantom to achieve its goals. It simply fabricated its own credible brand, seeded artificial trust signals into the marketplace, and constructed an invisible backdoor that quietly utilized the Sui blockchain as an untraceable courier.
This sophisticated exploit forces a necessary and overdue reassessment of how trust is established within cryptocurrency user experiences, and just how close to the underlying metal even casual tools like browser extensions truly operate. Crypto users frequently operate under the foundational assumption that Web3 guarantees absolute digital sovereignty and self-custody. Yet, in the wrong hands, an unvetted browser wallet functions less like a secure financial vault and more like an open port—and the browser will not always issue a warning before something slips through.
Suro Senen 
Siti Muinah 
Muslim