By Jia Lissa 
For a few critical days last November, a sophisticated malicious Chrome extension managed to climb the ranks of the Chrome Web Store, securing the fourth-position spot for the high-intent search query "Ethereum wallet." Operating under the deceptively reassuring moniker "Safery: Ethereum Wallet," the application was engineered with a level of polish sufficient to bypass the initial skepticism of ordinary web users. It featured a clean, professional icon, a generic name carefully positioned adjacent to security-oriented language, a sudden and overwhelming influx of five-star reviews, and boilerplate descriptions that instantly feel familiar to anyone who has ever navigated the landscape of digital asset management.
However, beneath this meticulously crafted frontend lay a purpose-built attack mechanism. The extension was not designed to assist users with decentralized finance or token storage; rather, it was engineered to systematically steal seed phrases and empty user wallets by cleverly encoding stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light and thoroughly examined by Socket, a prominent security tooling company specializing in the safety of open-source software supply chains. Security researchers at Socket installed and dissected the extension shortly after its discovery to understand how "Safery" managed to completely evade early detection systems, steadily climb the competitive Chrome Store search rankings, and exfiltrate sensitive seed phrases without triggering automated alarms or user suspicions. Their subsequent analytical report serves simultaneously as a forensic postmortem of the attack and as a sobering warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular incident especially noteworthy to cybersecurity professionals is that the malicious actors behind Safery did not rely on traditional tactics such as spoofing an existing, trusted wallet brand. It was neither a crude MetaMask lookalike nor a recycled phishing domain designed to catch careless typists. Instead, the developers chose a more insidious route: they invented an entirely new digital identity, purchased or utilized bot networks to generate fake reviews to rapidly scale search rankings, and launched the software as a legitimate, brand-new wallet option.
This calculated approach meant that the extension’s listing displayed virtually no immediate red flags. There was no broken grammar in the descriptions, no bizarre or over-reaching permissions requested upfront, and no suspicious redirection loops pointing to shady external domains. The Chrome Web Store publisher page possessed no prior consumer complaints or historical flags, and the provided support URL directed traffic to an off-platform website that security trackers had not yet flagged at the time of Socket’s investigation.
Given its sleek and professional appearance, the average crypto user would have had little reason to hesitate before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and mandatory request for legitimate crypto wallets that must interact seamlessly with various decentralized applications across the web. Notably, it refrained from prompting users for extra, suspicious permissions or attempting to inject complex content scripts that would typically trip Chrome’s more aggressive security warnings and heuristics. The visual branding was minimalist and clean, the accompanying website matched the extension’s name precisely, and the initial setup screen simply prompted users to create a brand-new wallet or import an existing one—behavior that is entirely indistinguishable from legitimate market offerings.
The Seed Heist, Broadcasted Quietly Over Sui
The real financial damage began the exact moment a user entered their recovery seed phrase into the interface. Instead of securely storing the phrase locally on the device or properly encrypting it for user-exclusive access, the extension silently partitioned the sensitive phrase into smaller fragments. It then encoded these fragments to look deceptively like random, ordinary wallet addresses.
Socket’s comprehensive research revealed that these broken-down fragments were systematically inserted directly into Sui blockchain transactions. Specifically, the extension initiated minuscule SUI token transfers—negligible financial amounts designed to draw zero attention from users or network monitors—directed toward blockchain addresses directly controlled by the attackers. Embedded deep within those routine-looking transactions, either hidden inside memo fields or cleverly obfuscated within the transaction addresses themselves, were the vital pieces of the victim’s seed phrase.
This tactical strategy offered massive advantages to the perpetrators. Crucially, it eliminated the need for the extension to send outbound network requests to malicious command-and-control servers. There was no suspicious beaconing activity or data exfiltration over standard HTTP protocols or WebSockets that a traditional web browser or local antivirus software might automatically flag and block.
Instead, the malicious payload left the user’s local device disguised as a completely normal, everyday blockchain transaction, effortlessly routed through a widely used and low-fee layer-one network. Once successfully logged on-chain, the data became publicly accessible yet completely obscured to the untrained eye, allowing the attacker to retrieve the pieces at their convenience, reconstruct the full seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the sophisticated scam weaponized the Sui blockchain itself, turning a distributed ledger into an encrypted communications channel. Because the Sui network boasts exceptionally fast confirmation times and near-zero transaction costs, it functioned flawlessly as a low-latency message bus for the thieves.
Socket successfully traced multiple historical examples of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the subsequent, rapid loss of assets. While the actual thefts of funds occurred off-chain—taking place on Ethereum or other foundational layer-one networks where the victims’ wallets held substantial balances—the precise instructions required to carry out the robberies were hidden securely in plain sight on an entirely different ledger.
Before releasing the final version that managed to secure top-tier placement in Chrome’s wallet search results, the publisher likely experimented with and tested this methodology in private. Forensic evidence suggests that earlier, unreleased builds experimented with much simpler data leaks before the Sui encoding technique was fully optimized and refined.
By the time this active extension was finally flagged and reported by vigilant community members, it had already accumulated enough installations to break into Chrome’s coveted "trending" tier, which further amplified its visibility to unsuspecting users. Reports from industry outlets confirmed that the Safery wallet remained prominently featured among the top results for Ethereum wallet searches even as growing warnings and complaints began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Facilitated the Oversight
The eventual success of the Safery extension hinged entirely on the structural mechanics of Chrome’s internal search ranking algorithm. The Web Store search architecture heavily weighs factors such as keyword matching, cumulative install counts, review velocity, average user ratings, and overall update recency.
Extensions that experience a sudden, manufactured burst of user activity—particularly within specialized, high-demand niches like cryptocurrency—can climb search results rapidly, especially if better-vetted, legitimate competitors are not updated with high frequency. In this specific scenario, Safery benefited from a title that scored exceptionally well for common user queries, a rapid blitz of positive ratings that were largely templated or duplicated, and a fresh upload date that signaled active maintenance.
Available evidence does not indicate that Google manually reviewed this specific listing prior to its automated publication. The standard Chrome Web Store policy subjects most newly submitted extensions to little more than a brief automated scan and basic static code analysis.
Extensions typically undergo much deeper, manual scrutiny only when they explicitly request elevated and potentially dangerous permissions, such as unrestricted access to browsing tabs, system clipboards, local file systems, or complete browsing history. Legitimate crypto wallet extensions frequently manage to bypass these elevated risk flags by operating entirely within localized iframes or relying on standard, approved browser APIs. Safery carefully stayed well within those permissible operational bounds.
Even when concerned users eventually raised formal flags and security queries, the operational lag between initial reporting and ultimate takedown stretched on for long enough for significant financial damage to occur. Part of that delay is structural: the Chrome ecosystem does not act instantly on reported extensions unless there is an overwhelming consensus of abuse or recognizable malware signatures present in the code.
In this particular instance, the malicious payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than centralized, external hosting providers. Traditional malware detection methods simply failed to catch it.
This incident is far from the first time that browser extensions have been maliciously exploited to target cryptocurrency holders. Previous high-profile scams have included fraudulent Ledger Live companion apps that prompted unsuspecting users to type in their recovery phrases, or the compromise of legitimate, long-standing extensions through hijacked developer publishing keys.
What fundamentally set Safery apart was the sheer smoothness of its user-facing facade and the total absence of traditional backend infrastructure. There was no vulnerable phishing website to shut down and no central command server to block; there was merely a single browser extension quietly shuttling encrypted secrets onto a public blockchain and walking away cleanly.
Victims still retained minimal options for recourse. For those who acted with extreme speed, limiting further exposure required immediately rotating seed phrases, revoking all active smart contract transaction approvals, and sweeping remaining digital assets to an entirely new wallet generated on a separate, clean device. However, for users who failed to notice the silent data exfiltration in real time or who maintained substantial balances in vulnerable hot wallets, financial recovery remained virtually impossible.
Security researchers and independent software developers are now pushing for the implementation of much stronger heuristics directly within the Chrome browser architecture. One primary solution frequently proposed is the automated flagging of any browser extension that introduces user interface elements explicitly prompting for standard 12-word or 24-word recovery phrases.
Another recommended approach involves mandating formal publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a recognized publisher genuinely controls the underlying codebase associated with a known wallet brand. Furthermore, industry experts are calling for much tighter inspection protocols surrounding wallet permissions, even when those permissions do not explicitly trigger traditional dangerous access patterns.
For end-users navigating this high-risk environment, security organizations have emphasized the need for rigorous extension management checklists. Before installing any cryptocurrency-related browser extension, users are advised to thoroughly research the publisher’s historical background, verify direct associations with established open-source projects, carefully inspect review patterns for artificial bursts of identical praise, look for verifiable links to active public code repositories, and scrutinize the permissions tab for sweeping system access.
As this incident demonstrates, a clean interface design and a high star rating are no longer reliable indicators of software safety. The case raises broader, existential questions regarding the inherent role of standard web browsers in the custody of digital assets. Browser-based wallets originally gained widespread popularity due to their high accessibility and frictionless user experience, allowing individuals to interact effortlessly with decentralized applications without switching platforms or downloading standalone desktop software.
Yet, that vital accessibility has come at a severe security cost. The modern web browser remains an inherently high-risk computing environment susceptible to extension manipulation, session hijacking, clipboard scraping, and now, covert blockchain-based data exfiltration. As a result, wallet developers are increasingly likely to rethink their primary distribution models, with some teams already discouraging Chrome Web Store installations entirely in favor of dedicated mobile applications or standalone desktop binaries. Until the broader ecosystem resolves these foundational distribution challenges, users will continue facing the difficult task of distinguishing legitimate financial tools from polished, malicious clones operating in plain sight.
Evan Lee Salim 
Basiran 
Suro Senen