For several days last November, a malicious browser extension managed to climb the ranks of the Chrome Web Store, positioning itself as the fourth organic search result for the high-traffic keyword "Ethereum wallet." <\/p>\n
The extension, deceptively named "Safery: Ethereum Wallet," was engineered to look polished and trustworthy enough to pass for a legitimate crypto management tool. It featured a clean, professional icon, a generic name paired with security-adjacent terminology, a heavy influx of five-star reviews, and boilerplate introductory descriptions that are immediately familiar to anyone who has ever downloaded a decentralized finance (DeFi) application or browser-based wallet. <\/p>\n
However, beneath this clean frontend lay a purpose-built attack mechanism designed to systematically steal recovery seed phrases and completely drain user funds. Rather than relying on traditional, easily trackable command-and-control servers, the malware ingeniously encoded stolen secrets directly into micro-transactions executed on the high-speed Sui blockchain.<\/p>\n
The sophisticated threat was brought to light by Socket, a security tooling firm specializing in open-source software supply chains. Following the discovery of the fraudulent listing, researchers at Socket installed and meticulously analyzed the "Safery" extension to understand how it successfully evaded automated detection systems, climbed the Chrome Store search rankings, and exfiltrated sensitive user credentials without raising immediate alarms. Their subsequent security report serves as both a detailed postmortem of the incident and a stark warning that browser extensions remain a dangerous, often overlooked blind spot in the broader cryptocurrency ecosystem.<\/p>\n
What makes this particular incident especially noteworthy is that the malicious actors behind the scheme did not rely on traditional phishing tactics. They did not spoof an existing, well-known wallet brand, nor did they attempt to mimic established market leaders like MetaMask or launch operations from a recycled phishing domain. Instead, the hackers invented an entirely new digital identity from scratch. They purchased or generated artificial bot reviews to artificially inflate the application’s search rankings and launched the software as a fresh, independent wallet option within the marketplace.<\/p>\n
Because of this novel approach, the listing displayed virtually no immediate red flags that users or automated filters typically look for. There was no broken English or awkward grammar in the descriptions, no requests for bizarre or excessive permissions, and no suspicious redirections to shady, unverified external domains. Furthermore, the Chrome Web Store publisher page associated with the extension had no prior consumer complaints or historical flags. Its designated support URL pointed toward an off-platform website that had not yet been flagged by any major security tracking databases at the time of Socket’s initial investigation.<\/p>\n
Given its remarkably polished presentation, the average user would have had little reason to hesitate before clicking the "Add to Chrome" button. Like many standard crypto utilities, the extension requested permission to run on "all websites"\u2014a necessary technical requirement for wallets that need to interact seamlessly with various decentralized applications across the web. Notably, the application did not prompt users for extra permissions or attempt to inject intrusive content scripts that would typically trigger Chrome’s more aggressive security warnings. Its branding remained minimalist, its companion website matched the title of the extension, and its initial setup screen prompted users to either create a brand-new wallet or import an existing one\u2014behavior that is entirely standard across the industry.<\/p>\n
The real financial damage began the moment an unsuspecting user entered their recovery seed phrase into the extension interface. Instead of storing the phrase locally within encrypted browser storage or transmitting it securely for user access management, the malicious extension silently fragmented the sensitive sequence into smaller pieces. It then encoded these fragments to look like random, innocuous wallet addresses.<\/p>\n
Socket\u2019s comprehensive research demonstrated that these fragmented pieces of data were directly inserted into transactions executed on the Sui blockchain. Specifically, the extension initiated minuscule SUI token transfers\u2014amounts so small they would effortlessly blend in with standard network noise\u2014directed toward addresses entirely under the control of the attacker. Hidden deep within those routine transactions, either embedded inside memo fields or masked within obfuscated destination addresses, were the broken-down components of the victim’s private seed phrase.<\/p>\n
This tactical approach offered significant advantages to the hackers. Because the extension did not need to send outbound HTTP requests or establish WebSockets to an external, malicious command-and-control server, it completely bypassed the types of network monitoring that browsers, firewalls, and antivirus software typically flag. <\/p>\n
Instead, the stolen payload left the user\u2019s device disguised as a completely normal, legitimate blockchain transaction, smoothly routed through a widely used and inexpensive layer-1 network. Once successfully recorded on the blockchain, the data remained publicly accessible. This allowed the attacker to quietly retrieve the fragments at their leisure, reconstruct the complete seed phrase, and sweep the victim’s assets across various blockchains without ever needing to interact with the compromised device a second time.<\/p>\n
In effect, the scammers repurposed the Sui blockchain itself to act as a covert communications channel. Because the Sui network boasts remarkably fast confirmation times and near-zero transaction costs, it functioned flawlessly as a low-latency message bus for the exfiltrated data. <\/p>\n
Socket successfully traced multiple instances of these suspicious seed-fragment transactions, definitively confirming the direct link between entering a phrase into the fake wallet and the subsequent loss of funds. While the actual thefts occurred off-chain\u2014frequently on Ethereum or other major layer-1 networks where the victims held substantial crypto balances\u2014the precise instructions required to carry out the thefts were hidden entirely in plain sight.<\/p>\n
Evidence suggests that the publisher rigorously tested this exfiltration method in private before launching the version that eventually captured top placement in Chrome’s wallet search results. Earlier builds examined by researchers showed experimentation with simpler data leaks before the Sui encoding technique was fully refined. By the time the active, malicious extension was finally flagged and removed, it had accumulated enough installations to secure a spot in Chrome\u2019s "trending" tier, which further amplified its visibility. Industry reports confirmed that the "Safery" wallet remained prominent in search results even as early warnings about its suspicious behavior began circulating widely across community platforms like Reddit and Telegram.<\/p>\n
The rapid success of the "Safery" extension hinged heavily on the inner workings of Chrome\u2019s internal search ranking logic. The Web Store search algorithm evaluates a complex mix of factors, including exact keyword matches, total installation counts, review velocity, average user ratings, and the recency of the last software update. <\/p>\n
Extensions that experience a sudden, sharp burst of activity\u2014particularly within niche categories where established competitors are updated infrequently\u2014can climb search results with alarming speed. In this instance, "Safery" benefited from a name optimized for common user queries, a rapid injection of positive reviews (many of which were clearly templated or duplicated), and a very recent upload date.<\/p>\n
There is no evidence to suggest that Google conducted a manual security review of the listing prior to its publication. Standard Chrome Web Store policy subjects most newly submitted extensions to a brief automated scan alongside basic static analysis. <\/p>\n
Deeper scrutiny is typically reserved for extensions that request clearly elevated permissions, such as access to browsing tabs, system clipboards, local file systems, or browsing history. Because crypto wallet extensions frequently bypass these specific flags by operating safely within iframes or utilizing approved developer APIs, "Safery" managed to stay strictly within those regulatory boundaries.<\/p>\n
Even after concerned users began raising alarms about the extension’s behavior, the time gap between initial public reporting and the eventual takedown by platform administrators stretched out long enough for substantial financial damage to occur. Part of this lag is structural; the Chrome ecosystem rarely acts on flagged extensions instantaneously unless there is an overwhelming consensus of abuse or easily identifiable malware signatures. Because the payload in this case relied on obfuscated JavaScript interacting directly with legitimate blockchain infrastructure rather than external malicious hosts, traditional automated detection tools failed to catch it.<\/p>\n
This incident is far from the first time browser extensions have been weaponized to target cryptocurrency assets. Previous high-profile scams have included fraudulent Ledger Live applications that tricked users into divulging recovery phrases, or instances where legitimate, trusted extensions were hijacked after attackers compromised the original developer’s publishing credentials. <\/p>\n
What truly distinguished the "Safery" scheme was the remarkable smoothness of its frontend facade combined with the complete absence of traditional backend infrastructure. There was no centralized phishing website for security teams to take down, and no rogue server IP address to block\u2014just a single browser extension quietly moving classified secrets onto a public ledger and disappearing into the background.<\/p>\n
For victims who acted with extreme urgency, some recourse remained available. Those who realized they had been compromised quickly enough could limit their total exposure by immediately rotating their seed phrases and revoking active smart contract transaction approvals. <\/p>\n
Security firms like Socket quickly published practical triage steps for anyone who had installed the extension: uninstall the software immediately, revoke all existing token approvals, sweep any remaining digital assets to a brand-new wallet using a completely clean device, and closely monitor associated blockchain addresses for unauthorized activity. However, for users who failed to notice the silent exfiltration or who maintained large balances within vulnerable hot wallets, asset recovery remained virtually impossible.<\/p>\n
The incident has prompted developers and security researchers to advocate for stricter heuristic checks within the Chrome Web Store itself. Among the proposed solutions is the implementation of automated flags for any extension that includes user interface elements prompting for a standard 12- or 24-word recovery phrase. <\/p>\n
Additional recommendations include requiring mandatory publisher attestation for all wallet-related extensions, providing verifiable cryptographic proof that a given publisher genuinely controls the underlying codebase of a recognized project. Calls have also intensified for more rigorous inspections of wallet-related permissions, even when those applications do not explicitly request traditionally dangerous access patterns.<\/p>\n
For everyday users, security experts continue to emphasize the importance of rigorous due diligence. Before installing any cryptocurrency extension, users are advised to carefully review the publisher’s historical track record, verify official associations with known and trusted projects, and inspect review patterns for anomalous bursts of identical phrasing. Checking for real, verifiable website links backed by public code repositories and scrutinizing the permissions tab for vague or sweeping access remains critical. Ultimately, a clean name and a high star rating are no longer enough to guarantee safety in the Web3 era.<\/p>\n","protected":false},"excerpt":{"rendered":"
For several days last November, a malicious browser extension managed to climb the ranks of…<\/p>\n","protected":false},"author":6,"featured_media":2605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[295],"tags":[6,316,206,969,36,968,1074,314,967,286,965,966,5,282,689,115],"class_list":["post-2606","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blockchain-hacks-exploits","tag-blockchain","tag-chrome","tag-data","tag-detection","tag-ethereum","tag-evades","tag-exfiltration","tag-exploits","tag-extension","tag-hacks","tag-malicious","tag-safery","tag-security","tag-store","tag-using","tag-wallet"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2606"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/2606\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/2605"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}