By Siti Muinah 
For a few critical days in November, a malicious software disguise managed to secure a prominent spot on the Chrome Web Store, ranking as the fourth most relevant result for users searching for an "Ethereum wallet."
The extension, deceptively named "Safery: Ethereum Wallet," had been crafted with enough digital polish to easily pass as a legitimate tool to the average web surfer. It featured a clean, professional icon, a generic and trustworthy-sounding name immediately adjacent to vital security language, a rapid influx of five-star reviews, and standard, boilerplate descriptions that are entirely familiar to anyone who has ever downloaded a cryptocurrency wallet to interact with decentralized applications.
Beneath that polished frontend, however, lay a purpose-built attack mechanism engineered specifically to steal sensitive seed phrases and completely empty user wallets. Instead of relying on traditional, easily trackable methods of data exfiltration, the malicious software encoded the stolen secrets directly into micro-transactions executed on the Sui blockchain.
The threat was brought to light after security tooling company Socket, which focuses heavily on open-source software supply chains, installed and analyzed the extension following its initial discovery. The primary objective of their investigation was to understand how "Safery" managed to completely evade automated detection systems, successfully climb the official Chrome Store search rankings, and exfiltrate stolen seed phrases without raising any immediate alarms. Furthermore, the security team sought to determine what everyday users could do to spot similar threats in the future. The resulting technical report walks thoroughly through the attacker’s sophisticated approach, serving simultaneously as a postmortem examination of the security failure and a stark warning that browser extensions remain a dangerously overlooked blind spot within the broader cryptocurrency ecosystem.
This particular security incident is notably significant because the malicious actors did not simply rely on traditional tactics. While stealing user seed phrases is, unfortunately, well-trodden territory in the crypto threat landscape, Safery broke new ground in its distribution strategy. It did not spoof an existing, well-known wallet brand. It was not a clumsy MetaMask lookalike or a recycled phishing domain designed to catch careless typos. Instead, it invented a completely novel identity, utilized purchased or automated bot-driven fake reviews to artificially climb search rankings, and successfully launched itself entirely as a "new" wallet option.
This calculated approach meant that the listing showed virtually no immediate red flags to prospective victims. There was no broken grammar, no suspicious or overly broad permissions requested upfront, and no redirection to shady, unverified external domains. The Chrome Web Store publisher page displayed zero prior complaints from users, and its designated support URL led to an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s detailed analysis.
Given its highly polished appearance and professional layout, most everyday users would not have hesitated for even a second before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for crypto wallets that must interact seamlessly with a wide array of decentralized applications across the web.
Notably, it completely avoided prompting users for extra, suspicious permissions or attempting to inject complex content scripts that would typically trigger Chrome’s more aggressive automated security warnings. The branding was minimalist and cohesive, the associated website matched the extension’s exact name, and the setup screen naturally prompted users to either create a brand-new wallet or import an existing one—again, behavior that is entirely standard for legitimate software in this category.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their private seed phrase into the extension interface. Instead of storing the sensitive phrase locally or properly encrypting it for user access, the extension silently fragmented the phrase into smaller pieces. It then cleverly encoded these fragments to look like random, ordinary wallet addresses.
Socket’s rigorous research demonstrates that these fragmented secrets were stealthily inserted directly into Sui blockchain transactions. Specifically, the extension initiated tiny, minuscule SUI token transfers—amounts so small that they would never draw the attention of blockchain monitors—to addresses directly controlled by the attacker. Hidden safely inside those transactions, either tucked away in memo fields or obfuscated within the recipient addresses, were the broken pieces of the user’s private seed phrase.
This clever approach provided the attackers with significant tactical advantages. Crucially, it did not require the extension to send outbound network requests to malicious external servers. There was no command-and-control beacon operating in the background, nor was there any data exfiltration conducted over standard HTTP or WebSockets protocols that a modern browser or antivirus program might easily flag and intercept.
The payload successfully left the user’s device disguised as an entirely normal-looking blockchain transaction, routed smoothly through a widely used, low-fee layer-one blockchain. Once safely on-chain, the data was publicly accessible, allowing the malicious actor to quietly retrieve it at their convenience, reconstruct the complete seed phrase, and systematically sweep the victim’s wallets clean without ever needing to touch the user’s device a second time.
In effect, the scam creatively utilized the Sui blockchain itself as an alternative communications channel. Because the Sui network features remarkably fast confirmation times and negligible transaction costs, it functioned efficiently like a low-latency message bus for the thieves.
Socket successfully traced multiple concrete examples of these seed-fragment transactions and definitively confirmed the direct link between entering a seed phrase into the extension and the eventual loss of digital assets. While the actual thefts occurred off-chain—either on Ethereum or other layer-one networks where the victims’ wallets conveniently held valuable funds—the precise operational instructions for carrying them out were hidden entirely in plain sight on an entirely different blockchain.
Before releasing the final version that managed to land squarely in Chrome’s top wallet search results, the publisher likely tested this novel method in private development environments. Digital evidence indicates that earlier builds experimented with simpler data leaks before the Sui encoding technique was fully refined.
By the time the active extension was finally flagged and reported, it had accumulated enough installations to comfortably reach Chrome’s coveted "trending" tier, which further boosted its overall visibility to unsuspecting users. Reports highlighted that the "Safery" wallet sat comfortably among the top results for "Ethereum wallet" searches even as growing reports of suspicious behavior and asset theft began to circulate widely across community platforms like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the "Safery" extension hinged entirely on the mechanics of Chrome’s internal search ranking logic. The Web Store search algorithm heavily weighs factors such as keyword matching, total install counts, review velocity, average user ratings, and the recency of the last software update.
Extensions that experience a sudden burst of activity, particularly within specialized or niche categories, can climb search rankings rapidly if better-vetted, legitimate competitors are not updated frequently. In this particular instance, "Safery" benefited from a name that scored exceptionally well for common user queries, a rapid blitz of positive reviews that were largely templated or duplicated, and a very fresh upload date.
There is currently no evidence to suggest that Google manually reviewed this specific listing prior to publication. Chrome Web Store policy typically treats most newly submitted extensions with a brief automated scan and fundamental static analysis rather than intensive human review.
Extensions generally undergo deeper scrutiny when they request highly elevated permissions, such as direct access to open tabs, the system clipboard, local file systems, or browsing history. Wallet extensions frequently manage to avoid triggering these specific security flags by operating securely within iframes or by utilizing standard, pre-approved APIs. "Safery" carefully stayed strictly within those permissible bounds.
Even when vigilant users raised serious concerns and reported the listing, the operational time gap between initial reporting and eventual store takedown stretched on long enough for substantial financial damage to occur. Part of that lag is structural: the Chrome Web Store does not act on flagged extensions instantaneously unless there is an overwhelming community consensus or clearly identified malware signatures present in the code.
In this case, however, the malicious payload consisted of heavily obfuscated JavaScript that relied entirely on decentralized blockchain infrastructure rather than external hosting servers. Traditional malware detection methods simply failed to catch it.
This security incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency from unwary consumers. Previous high-profile scams have included fake Ledger Live companion apps that prompted unsuspecting users to enter their master recovery phrases, or the hijacking of legitimate, long-standing extensions that allowed attackers to gain unauthorized access to a developer’s private publishing key.
What truly differentiates "Safery" from these past incidents is the remarkable smoothness of its digital facade and the complete absence of traditional backend infrastructure. There was no vulnerable phishing website for authorities to take down, and no rogue server to block; there was merely a single browser extension quietly moving secrets onto a public blockchain and walking away cleanly.
Affected users still had some limited avenues for recourse. If they acted with extreme urgency, they could minimize their total exposure by immediately rotating their seed phrases and revoking any outstanding transaction approvals associated with their accounts.
Security firms like Socket quickly provided clear triage steps for anyone who had mistakenly installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining digital assets to a brand-new wallet using an entirely clean and unaffected device, and closely monitor all associated addresses for unauthorized activity. For those users who failed to notice the silent data exfiltration in time, or who stored large amounts of capital in vulnerable hot wallets, asset recovery remained highly unlikely.
Security researchers and independent software developers are now calling for much stronger heuristic checks directly from Google Chrome. One prominent proposed solution involves automatically flagging and blocking any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase.
Another widely discussed approach is to require formal publisher attestation for all wallet-related extensions, which would provide verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase behind a recognized wallet brand. There are also persistent calls for much tighter inspection of wallet-related permissions, even in cases where those permissions do not explicitly include dangerous access patterns.
For everyday end users, security organizations continue to emphasize the importance of rigorous due diligence. Before installing any cryptocurrency extension, users are advised to thoroughly review the publisher’s historical track record, verify official associations with known and trusted projects, carefully inspect review patterns for artificial bursts of identical feedback, check for real website links backed by public GitHub repositories, and scrutinize the permissions tab for vague or sweeping access requests.
A clean name and a high star rating are simply no longer enough to guarantee safety in the Web3 space. The incident raises much broader, more fundamental questions regarding the browser’s expanding role in cryptocurrency management. Browser-based wallets originally gained immense popularity due to their high accessibility and ease of use, enabling users to interact effortlessly with decentralized applications without needing to switch platforms or download separate, standalone desktop applications.
However, that unprecedented level of accessibility has come at a severe cost to overall security exposure. The modern web browser remains a fundamentally high-risk environment that is continually subject to extension manipulation, session hijacking, malicious clipboard scrapers, and now, covert blockchain-based exfiltration techniques.
Cryptocurrency wallet developers are now very likely to rethink their primary distribution models entirely. Some development teams already actively discourage users from installing software via the Chrome Web Store, preferring instead to direct them toward dedicated mobile applications or standalone desktop binaries. Other teams may soon implement built-in warnings for users attempting to install software from unverified sources.
The core underlying problem remains stubbornly persistent: software distribution is heavily fragmented, and the vast majority of everyday users simply do not possess the technical expertise required to reliably distinguish a legitimate, secure wallet from a polished clone designed to steal their funds.
The "Safery" extension proved that malicious actors no longer need to successfully mimic established market leaders like MetaMask or Phantom to achieve their goals. By simply creating an entirely new brand, seeding artificial trust signals, and building an invisible backdoor that utilized the Sui blockchain as a silent courier, they demonstrated a sophisticated new vector for digital theft. This development forces a profound industry-wide rethink of how trust is established in cryptocurrency user interfaces, and how closely integrated casual tools like browser extensions truly are to the financial infrastructure they access.
Cryptocurrency users naturally operate under the foundational assumption that Web3 technology guarantees absolute sovereignty and self-custody over their assets. Yet, in the wrong hands, a browser wallet ceases to function as a secure vault and instead behaves like an open port—one that Google Chrome may not always warn you about before something slips quietly through.
Jia Lissa 
Evan Lee Salim 
Basiran