Security researchers warn that a top-ranked Chrome Web Store wallet uses stealthy blockchain transactions to exfiltrate user secrets.
High-Ranking Chrome Extension Exposed as Crypto Theft Tool
A dangerous browser extension posing as a secure Ethereum wallet has been discovered on the Chrome Web Store, raising urgent concerns for crypto users. The extension, named “Safery: Ethereum Wallet,” appears as a legitimate tool for managing digital assets—but a new report from blockchain security platform Socket reveals that it is designed to steal seed phrases through an advanced hidden mechanism.
Top Search Result, Hidden Threat
Alarmingly, the extension currently appears as the fourth search result for “Ethereum Wallet,” ranking just behind established products like MetaMask and Enkrypt. This positioning increases the likelihood that unsuspecting users might download the malicious tool.
The extension claims to offer safe and efficient Ethereum asset management, but Socket researchers uncovered a backdoor specifically engineered to exfiltrate seed phrases.
According to Socket, the extension “encodes seed phrases into Sui-style addresses and broadcasts tiny Sui transactions,” allowing attackers to extract the private data without raising suspicion.
This technique disguises the stolen mnemonic inside normal blockchain activity, making it unusually difficult for victims to detect.
How the Backdoor Steals Wallet Secrets
The extension presents two dangerous attack paths:
- New Wallet Creation:
When a user creates a new wallet, the seed phrase is immediately encoded and transmitted via a 0.000001 SUI microtransaction to addresses linked to the attacker. - Importing Existing Wallets:
Users who import a wallet and enter their BIP-39 seed phrase unknowingly send the information directly to the threat actor through the same microtransaction method.
Socket explains: “By decoding the recipients, the attacker reconstructs the seed phrase and drains user assets.”
Once compromised, the attacker can empty funds at any time.
Red Flags Users Should Watch For
Despite its high search ranking, the extension shows multiple signs of illegitimacy:
- Zero user reviews
- Weak branding and grammatical errors
- No official website
- Developer listed with a Gmail address
These indicators strongly suggest poor credibility—yet the listing continues to appear alongside reputable wallets, putting users at heightened risk.
Staying Safe Against Scam Extensions
Users are urged to exercise caution when installing crypto-related tools.
Never enter a seed phrase into unfamiliar platforms, always verify developer identities, and regularly monitor wallet activity—even small transactions can signal malicious behavior.
Security experts recommend relying on well-established wallets with verified authenticity and maintaining strong cybersecurity practices.
The discovery of the Safery wallet extension highlights an evolving threat: scammers using sophisticated blockchain techniques to steal seed phrases undetected. As crypto usage grows, so does the importance of verifying every tool before trusting it with sensitive information.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.