In a sophisticated supply-chain attack that highlights ongoing vulnerabilities in browser-based cryptocurrency tools, a malicious Chrome extension managed to rank as the fourth result for "Ethereum wallet" on the official Chrome Web Store during a multi-day window in November. <\/p>\n
The extension, deceptively named "Safery: Ethereum Wallet," was engineered with enough technical polish and aesthetic deception to easily pass as a legitimate financial product. Featuring a clean icon, a generic name paired with reassuring security language, an influx of five-star reviews, and boilerplate descriptions immediately familiar to anyone who has ever downloaded a decentralized finance tool, the application masked a deeply malicious backend. Behind its clean frontend interface lay a purpose-built attack mechanism designed to silently harvest user seed phrases and systematically drain victim wallets by encoding the stolen credentials directly into micro-transactions on the Sui blockchain.<\/p>\n
The threat was brought to light after open-source software supply chain security firm Socket installed and analyzed the extension following its discovery. According to the firm’s findings, the primary objective of the investigation was to understand how "Safery" successfully bypassed automated and manual detection mechanisms, climbed rapidly through the Chrome Web Store search rankings, and exfiltrated sensitive seed phrases without triggering immediate security alarms. The resulting forensic report serves as both a detailed postmortem of the incident and a stark warning that browser extensions remain a dangerously overlooked blind spot in the broader cryptocurrency ecosystem.<\/p>\n
What makes this particular campaign especially notable to security analysts is that the hackers behind it did not rely on traditional phishing tactics. While stealing seed phrases is unfortunately common territory in the crypto threat landscape, Safery did not spoof an existing, well-known wallet brand. It was not a MetaMask lookalike or a recycled phishing domain designed to catch typos. Instead, the attackers invented a completely novel identity, utilized bot networks or purchased fake reviews to artificially inflate its search rankings, and launched the software as a brand-new, independent wallet option. <\/p>\n
This calculated approach meant the extension’s listing displayed virtually no immediate red flags. There was no broken English in the descriptions, no suspicious or overly broad permissions requested during installation, and no redirection to shady external domains. The publisher page on the Chrome Web Store had no prior complaints logged against it, and the designated support URL led to an off-platform website that had not yet been flagged by automated security trackers at the time of Socket\u2019s analysis. <\/p>\n
Given its remarkably polished exterior, the average user would likely experience no hesitation before clicking the "Add to Chrome" button. Like many standard crypto tools, the extension requested permission to run on "all websites," a routine requirement for applications designed to interact seamlessly with decentralized applications across the web. However, it notably refrained from prompting for extra permissions or attempting to inject complex content scripts that might have tripped Chrome\u2019s more aggressive automated warnings. The branding was minimalist, the accompanying website mirrored the extension\u2019s exact name, and the initial setup screen naturally prompted users to either create a new wallet or import an existing one\u2014behavior indistinguishable from any legitimate software launch.<\/p>\n
The true mechanics of the scam initiated the moment a user entered their sensitive recovery seed phrase. Rather than storing the phrase locally on the device or encrypting it for user accessibility, the extension executed a silent, multi-step exfiltration process. It divided the recovery phrase into small, fragmented pieces and cleverly encoded them into what appeared to be entirely random, innocuous wallet addresses.<\/p>\n
Socket\u2019s technical research revealed that these hidden fragments were subsequently inserted directly into Sui blockchain transactions. Specifically, the extension executed minuscule SUI token transfers\u2014amounts so negligible that they would never draw the attention of a user or automated monitoring tool\u2014to addresses completely controlled by the attacker. Embedded quietly inside those outgoing transactions, either hidden within memo fields or disguised as obfuscated destination addresses, were the exact pieces of the user’s secret recovery phrase.<\/p>\n
This tactical design offered significant advantages to the threat actors. Because the data left the device as a standard-looking blockchain transaction routed through a widely used, low-fee layer-1 chain, the extension did not need to send outbound network requests to malicious command-and-control servers. There were no suspicious HTTP beacons or WebSocket connections that a local browser extension monitor or standard antivirus program might flag. Once the data reached the public Sui blockchain, it was permanently and publicly accessible, allowing the attackers to retrieve the fragments at their leisure, reconstruct the seed phrases, and comprehensively sweep the victims’ balances across various networks without ever needing to touch the user’s device again.<\/p>\n
In effect, the perpetrators turned the Sui blockchain into an unblockable communications channel. Because the Sui network boasts fast transaction confirmation times and virtually negligible gas fees, it functioned perfectly as a low-latency message bus for stolen data. Socket successfully traced multiple instances of these seed-fragment transactions, definitively confirming the direct causal link between entering a seed phrase into the fake extension and the subsequent loss of digital assets. While the actual thefts occurred off-chain on Ethereum or other layer-1 networks where the victims’ funds were stored, the instructions required to execute those thefts had been broadcast in plain sight.<\/p>\n
Evidence suggests that before releasing the final iteration that captured top placement in the Chrome store, the developers tested their methodology through private, experimental builds. Earlier versions likely experimented with simpler data leakage methods before the Sui encoding scheme was fully refined. By the time the active extension was flagged and analyzed, it had amassed enough automated installs to propel it into the Chrome Web Store’s trending tier, further cementing its visibility. Industry reports confirmed that the Safery wallet maintained a prominent position among search results for Ethereum wallets even as early warnings began circulating within online communities like Reddit and Telegram.<\/p>\n
The rapid rise and success of the Safery extension ultimately hinged on the mechanics of Chrome\u2019s internal search ranking logic. The Web Store search algorithm heavily weighs factors such as precise keyword matches, total install counts, review velocity, average user ratings, and the recency of updates. Extensions that experience a sudden burst of download activity, particularly within niche categories, can climb rapidly if better-vetted competitors are not updated with equal frequency. In this scenario, Safery combined a high-value search term in its title, a coordinated blitz of positive reviews featuring templated or duplicated text, and a pristine, recently uploaded timestamp.<\/p>\n
Crucially, available evidence indicates that Google did not subject this specific listing to rigorous manual review prior to publication. Chrome Web Store policies dictate that most newly submitted extensions receive only a brief automated scan alongside fundamental static analysis. Deeper scrutiny is typically reserved for extensions that request explicitly elevated permissions, such as access to browser tabs, local clipboards, underlying file systems, or browsing history. Because crypto wallet extensions frequently bypass these specific flags by operating within isolated iframes or utilizing standard, approved application programming interfaces, Safery managed to stay entirely within permissible regulatory bounds.<\/p>\n
Even after vigilant users began raising concerns and reporting the anomalous behavior, the operational lag between the initial reports and the eventual takedown of the extension stretched on long enough for substantial financial damage to occur. Part of this delay is structural; the Chrome ecosystem does not act instantly on user-reported extensions unless there is an overwhelming consensus of complaints or a pre-existing malware signature match. Because Safery relied on obfuscated JavaScript interacting directly with public blockchain infrastructure rather than external, blockable web hosts, traditional heuristic malware detection methods failed to catch it in time.<\/p>\n
Security researchers point out that while this incident is part of a longer history of malicious browser extensions targeting cryptocurrency users\u2014such as fake Ledger Live applications or hijacked developer accounts\u2014Safery stands out due to the sheer elegance of its facade and the complete absence of traditional backend infrastructure. There was no phishing server to seize, no malicious domain to sinkhole, and no external command center to block. There was merely a browser extension quietly translating confidential user secrets into blockchain transactions and walking away.<\/p>\n
For those who fell victim to the exploit, remediation options were severely limited. Security analysts from Socket and other firms outlined immediate triage steps for anyone who had installed the extension: uninstall the application immediately, revoke any outstanding token approvals associated with the compromised addresses, sweep remaining funds to a freshly generated wallet using an entirely clean device, and continuously monitor associated accounts. However, for users who failed to notice the silent exfiltration in time or who maintained substantial capital in vulnerable hot wallets, asset recovery remained virtually impossible.<\/p>\n
As a result of this incident, industry professionals are urging browser developers to implement more robust heuristic checks. Proposed solutions include automatically flagging any extension user interface that attempts to prompt for a standard twelve or twenty-four-word recovery phrase, requiring strict publisher attestation to verify that a developer genuinely controls the codebase for an established brand, and tightening inspection protocols surrounding wallet-related permissions. Until structural distribution models evolve, the burden largely remains on end users to meticulously audit developer histories, examine review patterns for artificial inflation, and treat browser-based financial tools with extreme caution, recognizing that convenience in the decentralized finance space frequently comes at the cost of heightened exposure.<\/p>\n","protected":false},"excerpt":{"rendered":"
In a sophisticated supply-chain attack that highlights ongoing vulnerabilities in browser-based cryptocurrency tools, a malicious…<\/p>\n","protected":false},"author":20,"featured_media":893,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[295],"tags":[6,316,4,314,967,286,965,1035,966,5,1034,310,240],"class_list":["post-894","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blockchain-hacks-exploits","tag-blockchain","tag-chrome","tag-crypto","tag-exploits","tag-extension","tag-hacks","tag-malicious","tag-phrases","tag-safery","tag-security","tag-seed","tag-steal","tag-used"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/894","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=894"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/894\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/893"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}