By Evan Lee Salim 
For a few critical days in November, a malicious software masquerading as a legitimate browser tool secured a prominent position on the Chrome Web Store, ranking as the fourth overall result for the high-volume search term "Ethereum wallet."
The extension, published under the deceptively reassuring name "Safery: Ethereum Wallet," managed to project an aura of professionalism and safety that easily fooled casual searchers. Featuring a clean, minimalist icon, a generic yet security-adjacent title, and a rapid influx of five-star reviews, the listing closely mirrored the boilerplate descriptions and visual presentation familiar to anyone who has ever downloaded a decentralized finance tool.
Beneath this polished exterior, however, lay a sophisticated, purpose-built attack mechanism engineered to systematically harvest user seed phrases and completely drain associated cryptocurrency holdings. Rather than relying on traditional data exfiltration methods that security software might easily flag, the extension covertly encoded stolen credentials into micro-transactions executed directly on the Sui blockchain.
The threat was brought to light only after security tooling company Socket, which specializes in open-source software supply chains, installed and conducted a thorough forensic analysis of the extension following its discovery. According to Socket’s comprehensive report, the investigation was designed to uncover how "Safery" managed to completely bypass automated safety checks, climb the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without raising immediate alarms. The resulting postmortem serves as a stark warning to the broader digital asset community, highlighting the reality that browser extensions remain a dangerously overlooked blind spot in cryptocurrency security.
What makes this particular incident stand out within the broader landscape of digital asset security is that the threat actors did not rely on traditional spoofing tactics. While stealing recovery phrases is an unfortunately common vector in crypto thefts, malicious actors typically impersonate established, high-profile wallet brands by deploying MetaMask lookalikes or utilizing recycled phishing domains to trick users.
In contrast, Safery invented an entirely new, unbranded identity. The creators purchased or synthetically generated fake reviews to artificially boost search rankings, successfully launching the software as a brand-new option in the crowded marketplace.
Because the project was not explicitly mimicking an existing trademark, the store listing presented virtually no immediate red flags to prospective victims. There was no broken grammar in the descriptions, no demand for suspicious or unusual permissions, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page itself showed no prior complaints or history of infractions, while the provided support URL directed users to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket’s analysis.
Given its professional presentation and polished user interface, the average internet user would have had little reason to hesitate before clicking the "Add to Chrome" button. Upon installation, the extension requested permission to run on all websites—a standard, necessary requirement for crypto wallets that must seamlessly interact with various decentralized applications across the web.
Crucially, the software did not prompt for extra, elevated permissions or attempt to inject complex content scripts that would typically trigger Chrome’s more aggressive automated warnings. The branding was clean and minimalist, the companion website matched the name of the extension precisely, and the initial setup screen guided users through standard procedures like creating a brand-new wallet or importing an existing one.
The Seed Heist, Broadcast Over Sui
The true malicious functionality of the software activated the moment a user entered or generated a recovery seed phrase. Instead of storing the sensitive phrase locally on the device or encrypting it for legitimate user access, the extension silently fragmented the string of words and encoded the pieces into data fields that resembled random, innocuous wallet addresses.
Socket’s technical research revealed that these fragmented secrets were directly embedded into Sui blockchain transactions. Specifically, the extension initiated tiny SUI token transfers—minuscule amounts designed to draw zero attention from account holders—directed straight to addresses entirely controlled by the attacker.
Concealed deep inside those routine blockchain transactions, either hidden within specialized memo fields or integrated into obfuscated destination addresses, were the broken-down pieces of the victim’s master seed phrase.
This tactical execution offered significant advantages for the hackers. By leveraging the blockchain itself, the extension completely eliminated the need to send outbound network requests to external, malicious servers. There was no command-and-control beacon communicating over HTTP or WebSockets, meaning traditional browser monitoring tools and standard antivirus programs had nothing anomalous to flag.
Instead, the stolen payload departed the user’s local device disguised as a completely normal, everyday blockchain transaction, expertly routed through a widely used, low-fee decentralized network. Once permanently recorded on-chain, the data remained publicly accessible, permitting the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep funds from the victim’s wallets without ever needing to touch the user’s device again.
In practice, the scam ingeniously repurposed the Sui blockchain as an alternative communications channel. Because the network boasts exceptionally fast confirmation times alongside negligible transaction costs, it functioned effectively as a low-latency message bus for the thieves.
Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct link between the entry of recovery phrases into the fake extension and the subsequent loss of digital assets. While the actual thefts occurred off-chain—predominantly on Ethereum or other Layer-1 networks where the victims’ compromised wallets held substantial funds—the blueprints and instructions required to execute the thefts were hidden entirely in plain sight.
Evidence gathered during the analysis suggests that the publisher likely tested this methodology in private environments before releasing the finalized version that ultimately captured top search results in the Chrome store. Earlier builds analyzed by researchers showed experimentation with simpler, more crude data leaks before the Sui encoding technique was fully refined.
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough automated installations to reach the Chrome Web Store’s coveted "trending" tier, which further amplified its visibility to unsuspecting users. Reports from industry outlets confirmed that the Safery wallet remained prominently positioned near the top of the search results even as early warnings and discussions regarding its suspicious behavior began circulating across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension relied heavily on the underlying mechanics of Chrome’s proprietary ranking logic. The Web Store search algorithm continuously evaluates a complex combination of keyword relevance, total install counts, review velocity, average star ratings, and the recency of software updates.
Applications that experience a sudden, sharp burst of user activity, particularly within niche categories, can climb search rankings rapidly if their more established, thoroughly vetted competitors are not updated with equal frequency. In this instance, Safery capitalized on a name that scored well for common search queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, freshly uploaded timestamp.
There is currently no evidence to suggest that Google manually reviewed the listing prior to publication. Policies governing the Chrome Web Store typically subject new extensions to a brief automated scan alongside fundamental static code analysis.
Deeper scrutiny is generally reserved for extensions that request heavily elevated permissions, such as expansive access to open tabs, clipboard contents, local file systems, or browsing history. Because cryptocurrency wallet extensions frequently manage to bypass these specific warning flags by operating securely within isolated iframes or leveraging approved application programming interfaces, Safery easily stayed within acceptable operational bounds.
Even after concerned users began raising alarms, the time lapse between initial public reports and the eventual takedown of the extension stretched on long enough for significant financial damage to occur. Part of this lag is structural; the Chrome ecosystem rarely acts on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or the detection of explicitly recognized malware signatures.
In this case, because the payload consisted of heavily obfuscated JavaScript relying entirely on decentralized blockchain infrastructure rather than external hosting servers, traditional malware detection techniques failed to identify the threat in time.
This incident is far from an isolated event within the history of browser-based cryptocurrency thefts. Previous security breaches have seen fraudulent applications masquerading as official desktop tools like Ledger Live to prompt recovery phrase entries, or malicious actors hijacking legitimate, pre-existing extensions after compromising developers’ private publishing keys.
What distinguished Safery from these historical exploits was the sheer smoothness of its operational facade and the complete absence of traditional backend infrastructure. There was no centralized phishing website to shut down and no rogue command server to block—just a single browser extension quietly depositing stolen secrets onto a public ledger and disappearing into the background.
Victims of the exploit still had limited avenues for defense. For those who acted with extreme urgency, exposure could be partially mitigated by immediately rotating seed phrases, revoking outstanding smart contract approvals, and sweeping remaining digital assets to a brand-new wallet generated on a completely clean device.
Security firms including Socket quickly published emergency triage steps for anyone who had installed the software: uninstall the extension immediately, check for unauthorized token approvals, transfer funds away from compromised accounts, and closely monitor associated blockchain addresses. For users who failed to notice the silent exfiltration in time, or for those keeping large balances in vulnerable hot wallets, asset recovery remained virtually impossible.
The unfolding situation has intensified calls from security researchers and software developers urging Google to implement much stronger heuristic checks within the Chrome browser architecture. Among the primary proposals is the implementation of an automated flagging system that immediately restricts any extension containing user interface elements designed to prompt for 12- or 24-word recovery phrases.
Additional recommendations include mandating strict publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a listed publisher genuinely controls the underlying codebase of an established brand. Industry experts are also advocating for much tighter security inspections surrounding the permissions requested by financial applications, even when those permissions do not explicitly involve dangerous system access patterns.
For end users navigating the web, security organizations continue to stress the importance of rigorous due diligence. Before installing any cryptocurrency-related browser extension, users are advised to thoroughly investigate the publisher’s history, independently verify authentic associations with known software projects, inspect review patterns for obvious anomalies like bursts of identical text, locate official website links backed by public code repositories, and meticulously review the permissions tab for sweeping or vague access requests.
A clean name, a professional presentation, and a high star rating are no longer sufficient guarantees of safety.
The incident raises profound structural questions regarding the browser’s expanding role in the cryptocurrency ecosystem. Browser-based wallets originally gained widespread popularity due to their exceptional accessibility and ease of use, allowing everyday participants to interact seamlessly with complex decentralized applications without requiring separate software downloads or platform switches.
However, that unmatched accessibility has come at a severe security cost. The modern web browser remains an inherently high-risk operating environment susceptible to extension manipulation, session hijacking, clipboard scrapers, and covert blockchain-based data exfiltration.
As a result, major wallet developers are expected to fundamentally rethink their distribution models. While some teams already actively discourage users from relying on Chrome Web Store installations in favor of standalone mobile applications or native desktop binaries, others may soon implement aggressive internal warnings for anyone attempting to source financial software from unverified listings.
The core vulnerability persists: software distribution remains heavily fragmented, and the vast majority of retail users lack the technical expertise required to easily distinguish a polished, malicious clone from a legitimate decentralized finance tool.
The Safery extension did not need to impersonate an industry giant like MetaMask or Phantom to achieve its goals. By constructing an entirely fabricated brand, seeding artificial trust signals, and engineering an invisible backdoor that utilized a high-speed public blockchain as a courier service, the creators successfully bypassed traditional security paradigms.
The event underscores an urgent need to reevaluate how trust is established within cryptocurrency user experiences, reminding the digital asset community that browser wallets function less like secure digital vaults and more like open ports—and that automated platform protections will not always catch threats before they slip through.
Basiran 
Suro Senen 
Siti Muinah