By Ammar Sabilarrohman 
For a few critical days in November, a malicious Google Chrome extension masquerading as an Ethereum wallet managed to climb the ranks of the Chrome Web Store, briefly securing the fourth position for the highly competitive search query "Ethereum wallet."
The extension, titled "Safery: Ethereum Wallet," was engineered with enough technical polish and visual finesse to easily pass as a legitimate tool to the average web user. It featured a clean, professional icon, a generic name strategically flanked by security-oriented language, a heavy influx of five-star reviews, and boilerplate descriptions that instantly look familiar to anyone who has ever navigated the world of decentralized finance and downloaded a crypto wallet.
Beneath this deceptively standard frontend, however, lay a purpose-built attack mechanism. The application was designed to harvest user seed phrases and systematically drain crypto wallets by cleverly encoding stolen secrets into micro-transactions executed on the Sui blockchain.
Security tooling firm Socket, which specializes in open-source software supply chains, installed and analyzed the extension shortly after its discovery in the wild. The primary objective of the security researchers was to understand how "Safery" managed to dodge automated detection systems, successfully manipulate the Chrome Web Store search rankings, and exfiltrate sensitive seed phrases without raising immediate alarms. Furthermore, the firm sought to highlight what everyday users could do to spot and protect themselves against similar emerging threats. The resulting incident report walks through the attacker’s sophisticated approach, serving simultaneously as a postmortem of the breach and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.
What makes this particular case deeply noteworthy for cybersecurity professionals is that the malicious actors did not simply resort to established playbooks. Stealing seed phrases is, unfortunately, well-trodden territory in the crypto crime landscape. However, Safery deviated from traditional scams by refusing to spoof an existing, well-known wallet brand. It was not a clumsy MetaMask lookalike or a recycled phishing domain designed to catch users making a careless typo. Instead, the creators invented a completely new identity, purchased or generated bot-driven fake reviews to artificially boost search rankings, and launched the application as a brand-new, independent wallet option.
This unique approach ensured that the store listing displayed virtually no immediate red flags. There was no broken grammar, no bizarre permission requests, and no suspicious redirection to shady external domains. The Chrome Web Store publisher page carried zero prior complaints from users, and its designated support URL pointed toward an off-platform website that had not yet been flagged by any security trackers at the time of Socket’s comprehensive analysis.
Given its remarkably polished and professional appearance, the vast majority of web users would not have hesitated for even a second before clicking the "Add to Chrome" button. Upon installation, the extension merely requested permission to run on "all websites"—a ubiquitous request for crypto wallets that genuinely need programmatic access to interact with various decentralized applications across the web.
Crucially, the application did not prompt for any extra, intrusive permissions, nor did it attempt to inject content scripts that would typically trigger Chrome’s more aggressive security warnings. Its branding remained minimalist and cohesive, the official website matched the exact name of the extension, and the initial setup screen naturally prompted users to create a brand-new wallet or import an existing one. From a user experience standpoint, it mirrored standard, expected behavior.
The Seed Heist, Broadcast Over Sui
The real financial damage began the exact moment a user entered their private seed phrase. Rather than storing the recovery phrase locally or securely encrypting it for user accessibility, the malicious extension silently fragmented the sensitive text and encoded the individual pieces into what appeared to be completely random, innocuous wallet addresses.
Data gathered during Socket’s research demonstrates that these fragmented strings were quietly injected directly into Sui blockchain transactions. Specifically, the extension autonomously executed minuscule SUI token transfers—amounts so small they would effortlessly draw zero attention from victims or observers—to external addresses under the direct control of the attackers.
Hidden discreetly inside those blockchain transactions, tucked away inside memo fields or cleverly obfuscated addresses, were the broken pieces of the user’s private seed phrase.
This tactical approach offered significant advantages to the hackers. It completely eliminated the need for the extension to send outbound network requests to malicious, external servers. There was no command-and-control beacon operating in the background, and no data exfiltration occurring over traditional HTTP or WebSockets channels that a modern browser or standard antivirus program might easily flag and intercept.
Instead, the payload safely left the user’s local device disguised as a completely normal, legitimate-looking blockchain transaction, smoothly routed through a widely used, low-fee layer-1 blockchain network. Once the data successfully landed on-chain, it was publicly accessible, permitting the attacker to retrieve the fragments at their leisure, reconstruct the complete seed phrase, and systematically sweep external wallets clean without ever needing to touch the user’s device a second time.
In effect, the sophisticated scam creatively repurposed the Sui blockchain infrastructure itself to serve as a covert communications channel. Because the Sui network boasts remarkably fast transaction confirmation times and negligible fees, it functioned flawlessly as a low-latency message bus for the thieves.
Socket successfully traced multiple distinct examples of these seed-fragment transactions, definitively confirming the direct technical link between seed entry and subsequent asset loss. While the actual thefts occurred off-chain—typically on Ethereum or other layer-1 networks where the unsuspecting victims’ wallets held substantial funds—the operational instructions required to carry them out were hidden entirely in plain sight.
Before releasing the final version that successfully landed in Chrome’s top wallet search results, the publisher likely tested the underlying methodology in private environments. Digital evidence indicates that earlier, experimental builds had tested simpler data leaks before the Sui encoding technique was fully refined and optimized.
By the time the active, dangerous extension was finally flagged and reported, it had accumulated enough installs to comfortably reach Chrome’s "trending" category, which further amplified its visibility to prospective victims. Reports confirmed that the Safery wallet continued to sit comfortably among the top search results for "Ethereum wallet" searches even as growing reports of suspicious behavior began circulating widely across community forums like Reddit and Telegram.
How the Chrome Algorithm Let It Happen
The ultimate success of the Safery extension hinged heavily on the underlying ranking logic of the Chrome Web Store. The store’s search algorithm evaluates multiple core metrics, including keyword matches, overall install counts, review velocity, average star ratings, and the recency of updates.
Extensions that experience a sudden, concentrated burst of user activity—particularly within niche categories—can climb the search rankings rapidly if their better-vetted competitors are not updated with equal frequency. In this specific instance, Safery benefited from a name that scored exceptionally well for common user queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, fresh upload date.
There is currently no evidence indicating that Google manually reviewed the listing prior to publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated software scan and fundamental static code analysis.
Deeper scrutiny is typically reserved for extensions that request heavily elevated permissions, such as continuous access to browser tabs, system clipboards, local file systems, or complete browsing history. Wallet extensions frequently manage to bypass these stricter automated flags by operating carefully within isolated iframes or by utilizing officially approved browser APIs. Safery carefully stayed strictly within those boundaries.
Even when concerned users began raising alarms and reporting the extension, the operational lag between initial reporting and eventual store takedown stretched on long enough for extensive financial damage to occur. Part of that delay is structural: the Chrome ecosystem does not automatically pull or disable flagged extensions instantly unless there is an overwhelming consensus of reports or a match against known malware signatures.
In this case, the payload consisted entirely of obfuscated JavaScript code that relied entirely on decentralized blockchain infrastructure rather than traditional external web hosts. Traditional, legacy malware detection systems simply failed to catch it.
This incident is far from the first time that browser extensions have been weaponized to steal cryptocurrency. Previous security scams have involved fake Ledger Live desktop apps prompting users to recover phrases, or hijacked legitimate developer accounts that allowed malicious actors to push malicious code updates to existing extensions.
What fundamentally distinguished Safery was the sheer smoothness of its operational facade and the absolute absence of traditional backend infrastructure. There was no vulnerable phishing website to take down, and no rogue server IP address to block—just a single browser extension quietly moving secrets onto a public blockchain and walking away.
Victims still maintained limited avenues for recourse if they acted with extreme speed. By moving quickly, they could minimize their exposure by rotating seed phrases and revoking outstanding smart contract transaction approvals.
Socket and other cybersecurity entities subsequently published clear triage steps for anyone who had inadvertently installed the extension: uninstall the software immediately, revoke all active token approvals, sweep remaining assets to a completely new wallet generated on a secure device, and closely monitor associated addresses. For users who failed to notice the silent exfiltration in time, or for those who stored large amounts of capital directly in vulnerable hot wallets, asset recovery remained an impossibility.
Security researchers and independent developers are now calling for significantly stronger heuristics directly from Google Chrome. One prominent proposal is the introduction of automated flags for any browser extension that includes user interface elements prompting for standard 12-word or 24-word recovery phrases.
Another suggested defense involves requiring mandatory publisher attestation for wallet extensions, providing cryptographically verifiable proof that a specific publisher genuinely controls the underlying codebase associated with a recognized wallet brand. Additional appeals have been made for tighter regulatory inspection of wallet-related permissions, even when those permissions do not explicitly incorporate hazardous access patterns.
For everyday users, security firms continue to emphasize practical checklists for extension management. Prior to installing any cryptocurrency-related browser extension, users are advised to thoroughly review the publisher’s history, verify concrete associations with known and trusted projects, inspect review patterns for artificial bursts of identical text, check for real website links backed by public code repositories, and scrutinize the permissions tab for vague or sweeping access requests.
A clean name and a high star rating are no longer enough to guarantee safety.
This latest security case raises broader, fundamental questions regarding the web browser’s expanding role in the cryptocurrency ecosystem. Browser-based wallets gained widespread popularity primarily due to their accessibility and ease of use, enabling users to seamlessly interact with complex decentralized applications without needing to switch platforms or download standalone desktop applications.
However, that unmatched accessibility has come at a severe cost to security and exposure. The modern web browser remains an inherently high-risk environment subject to extension manipulation, session hijacking, clipboard scrapers, and now, covert blockchain exfiltration.
As a result, crypto wallet developers are increasingly likely to rethink their primary distribution models. Some industry teams already actively discourage Chrome Web Store installations, preferring to guide users exclusively toward dedicated mobile applications or signed desktop binaries. Others may soon introduce native warnings within their ecosystems for users attempting to install wallet software from unverified sources.
The core underlying problem persists: software distribution remains heavily fragmented, and the vast majority of retail users simply do not possess the technical expertise required to distinguish a legitimate, secure wallet from a polished, malicious clone.
The Safery extension did not need to impersonate MetaMask or masquerade as Phantom. It successfully manufactured its own brand, seeded artificial trust signals, and constructed an invisible digital backdoor utilizing the Sui blockchain as a silent courier.
That reality should force a thorough reassessment of how trust is established within cryptocurrency user experiences, and how deeply integrated casual tools like browser extensions have become. Crypto users naturally assume that Web3 technologies guarantee absolute digital sovereignty and self-custody. Yet, in the wrong hands, a standard browser wallet functions less like a secure financial vault and more like an open port—and Google Chrome will not always warn users before something slips through.
Raul Delapena Setiawan 
Muslim 
Siti Muinah