For a brief period in November, a sophisticated and malicious browser extension managed to rank as the fourth organic result for the keyword "Ethereum wallet" on the official Chrome Web Store. The application, which was given the deceptively reassuring name "Safery: Ethereum Wallet," was designed with enough visual polish and functional design to easily pass as a legitimate tool to even moderately cautious digital asset investors. It featured a clean, professional icon, a generic name paired with security-adjacent terminology, a rapid accumulation of five-star reviews, and standard boilerplate descriptions that are instantly familiar to anyone who has ever downloaded a decentralized cryptocurrency wallet.<\/p>\n
However, behind that polished frontend lay a purpose-built attack mechanism designed specifically to capture recovery seed phrases and completely empty unsuspecting user wallets. Rather than relying on traditional methods of data exfiltration, the extension covertly encoded the stolen secrets into micro-transactions executed directly on the Sui blockchain. The threat was uncovered and brought to light by Socket, a security tooling company that focuses heavily on open-source software supply chains. Security researchers at the firm installed and thoroughly analyzed the extension shortly after its suspicious behavior came to light.<\/p>\n
Their primary objective was to understand how "Safery" managed to completely evade initial automated detection mechanisms, steadily climb the competitive Chrome Store search rankings, and successfully exfiltrate sensitive seed phrases without triggering immediate security alarms. Furthermore, the analysis aimed to determine what everyday users could do to spot similar emerging threats in the future. The resulting technical report walks through the attacker\u2019s unconventional approach, serving as both a postmortem examination and a sobering warning that browser extensions continue to represent a dangerous and frequently overlooked blind spot in the broader cryptocurrency ecosystem.<\/p>\n
This particular security incident is especially noteworthy because the malicious actors did not simply rely on stealing seed phrases through standard means\u2014a tactic that is, unfortunately, well-trodden territory in the crypto crime landscape. What truly sets this case apart is that Safery did not spoof an existing, well-known wallet brand. It was not a clumsy MetaMask lookalike, nor did it rely on a recycled phishing domain designed to catch users making typographical errors. Instead, the creators invented an entirely new identity, purchased or generated bot-driven fake reviews to artificially boost its search rankings, and launched the application as a brand-new, standalone wallet option on the market.<\/p>\n
This calculated approach meant that the extension’s store listing displayed virtually no immediate red flags that users have been trained to look out for. There was no broken English or awkward grammar in the description, no unusual or overly aggressive permission requests, and no sudden redirections to shady, unverified external domains. The Chrome Web Store publisher page associated with the listing had no prior complaints logged against it, and its designated support URL led directly to an off-platform website that had not yet been flagged by any security trackers or threat intelligence feeds at the time of Socket\u2019s initial analysis.<\/p>\n
Given its clean and professional appearance, most everyday users would not have hesitated for even a moment before clicking the "Add to Chrome" button. The extension requested permission to run on "all websites," which is a completely standard and necessary request for crypto wallets that need to interact seamlessly with various decentralized applications across the web. Notably, the extension did not prompt users for extra, unusual permissions, nor did it attempt to inject complex content scripts that would typically trigger Chrome\u2019s more aggressive automated warnings. The branding was minimalist, the accompanying website matched the extension\u2019s exact name, and the initial setup screen naturally prompted users to either create a brand-new wallet or import an existing one\u2014again, entirely standard behavior for legitimate software.<\/p>\n
The real damage began the moment an unsuspecting user entered their recovery seed phrase. Instead of storing the sensitive phrase locally or securely encrypting it for authorized user access, the extension silently fragmented the phrase into smaller pieces. It then cleverly encoded these fragments into what appeared to be completely random, innocuous wallet addresses. Socket\u2019s detailed research demonstrates that these fragmented pieces were systematically inserted directly into Sui blockchain transactions. Specifically, the extension issued tiny token transfers of minuscule amounts of SUI\u2014amounts so small that they would never draw the attention of the user or network monitors\u2014to specific addresses controlled directly by the attacker.<\/p>\n
Hidden securely inside those seemingly ordinary transactions, either embedded within memo fields or obfuscated directly within the structure of the addresses, were the broken-down pieces of the user\u2019s private seed phrase. This tactical approach offered distinct operational advantages for the hackers. Crucially, it did not require the browser extension to send any outbound network requests to external malicious servers. There was no traditional command-and-control beacon communicating over the internet, and there was no data exfiltration occurring over standard HTTP or WebSockets channels that a modern browser or third-party antivirus software might easily flag and intercept.<\/p>\n
Instead, the payload left the user\u2019s device disguised as a completely normal, legitimate-looking blockchain transaction, routed securely through a widely used, low-fee layer-1 chain. Once the data successfully landed on-chain, it was publicly accessible, allowing the malicious actor to retrieve the information at their leisure, reconstruct the original seed phrase, and systematically sweep the victim’s associated wallets clean without ever needing to touch the user\u2019s compromised device a second time. In effect, the scam creatively used the Sui blockchain itself as an alternative communications channel. Because the Sui network boasts extremely fast confirmation times and negligible transaction costs, it functioned efficiently as a low-latency message bus for the attackers.<\/p>\n
Socket successfully traced multiple distinct examples of these seed-fragment transactions and definitively confirmed the direct causal link between the entry of a seed phrase into the extension and the eventual loss of assets. While the actual thefts occurred off-chain\u2014typically on Ethereum or other layer-1 networks where the victims’ wallets held their primary funds\u2014the operational instructions required to carry out the thefts were hidden entirely in plain sight on an entirely different blockchain. Before releasing the final version that managed to capture top search results in the Chrome store, the publisher almost certainly tested the underlying method in private. Evidence uncovered by researchers indicates that earlier, unreleased builds experimented with much simpler data leakage techniques before the Sui encoding mechanism was fully refined.<\/p>\n
By the time the active, malicious extension was finally flagged and reported, it had accumulated enough installations to comfortably reach Chrome\u2019s "trending" tier, which served to further boost its public visibility and credibility. Industry reports noted that the Safery wallet remained prominently positioned among the top results for "Ethereum wallet" searches even as reports concerning its suspicious behavior began circulating widely across community platforms like Reddit and Telegram.<\/p>\n
The ultimate success of the Safery extension hinged primarily on the underlying mechanics of Chrome\u2019s search and ranking logic. The Web Store search algorithm constantly weighs variables such as exact keyword matches, total install counts, review velocity, average user ratings, and update recency. Browser extensions that experience a sudden, sharp burst of user activity\u2014particularly within specialized or niche categories\u2014can climb the rankings with surprising rapidity if better-vetted, established competitors are not updated with equal frequency. In this specific scenario, Safery benefited from a name that scored exceptionally well for common user search queries, a coordinated blitz of positive reviews featuring templated or duplicated text, and a very fresh upload date.<\/p>\n
Available evidence does not indicate that Google manually reviewed this specific listing prior to publication. Standard Chrome Web Store policy subjects most new extension submissions to a brief automated scan and fundamental static analysis rather than intensive human review. Extensions typically undergo deeper scrutiny only when they explicitly request highly elevated permissions, such as direct access to open browser tabs, the user’s system clipboard, local file systems, or browsing history. Wallet extensions frequently manage to avoid triggering these stricter automated flags by operating securely within iframes or by utilizing officially approved browser APIs. Safery carefully stayed well within those permitted bounds throughout its lifecycle.<\/p>\n
Even when vigilant users began raising urgent concerns and reporting the extension, the lag time between the initial reporting and the eventual takedown by store administrators stretched on long enough for significant financial damage to occur. Part of that operational delay is structural: the Chrome platform does not act on flagged extensions instantaneously unless there is an overwhelming consensus of reports or a known, previously cataloged malware signature. In this specific case, the payload consisted of heavily obfuscated JavaScript that cleverly relied on third-party blockchain infrastructure rather than external hosting servers, meaning traditional malware detection methods largely failed to catch it.<\/p>\n
Security researchers and developers are now calling for significantly stronger heuristics from browser operators like Google. One widely discussed proposed solution involves automatically flagging any extension that includes user interface elements prompting individuals to input a 12- or 24-word recovery phrase. Another suggested approach is to mandate strict publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher actually controls the official codebase behind a recognized wallet brand. Furthermore, there are renewed calls for much tighter inspection of wallet-related permissions, even in cases where those permissions do not explicitly include overtly dangerous access patterns.<\/p>\n
For everyday end users, security firms have published practical checklists for safer extension management. Before installing any cryptocurrency-related browser extension, users are strongly advised to carefully review the publisher\u2019s historical track record, verify direct associations with known and trusted software projects, inspect review patterns for anomalies like bursts of identical five-star ratings, check for authentic website links backed by public code repositories, and thoroughly examine the permissions tab for vague or sweeping access requests. Ultimately, security analysts emphasize that a clean name and a high star rating are simply no longer enough to guarantee safety in the Web3 space.<\/p>\n","protected":false},"excerpt":{"rendered":"
For a brief period in November, a sophisticated and malicious browser extension managed to rank…<\/p>\n","protected":false},"author":22,"featured_media":1139,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[295],"tags":[6,316,4,314,967,286,965,1035,5,1034,310],"class_list":["post-1140","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blockchain-hacks-exploits","tag-blockchain","tag-chrome","tag-crypto","tag-exploits","tag-extension","tag-hacks","tag-malicious","tag-phrases","tag-security","tag-seed","tag-steal"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1140"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1140\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/1139"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}