A fake Chrome extension called Safery: Ethereum Wallet slipped into the Chrome Web Store and tricked users into handing over their entire crypto life. This article breaks down how the scam worked, why it matters for everyday users, and what you can do right now to stay safe. The goal is to help you understand the threat and give you clear steps to defend your money.
Quick Facts
- A fake Chrome extension stole seed phrases by hiding them inside fake Sui blockchain addresses.
- Attackers gained full control of any Ethereum wallet imported into the extension.
- The extension looked legitimate and ranked near trusted tools like MetaMask.
- All stolen data was hidden inside tiny blockchain transactions, not a server.
- Users must remove the extension, change all seed phrases, and update security tools.
What This Scam Really Is
The Safery: Ethereum Wallet extension first appeared on the Chrome Web Store in November 2024. It looked polished and harmless, which made it easy to trust. The listing presented it as a simple Ethereum wallet, and many users assumed it worked like MetaMask or Enkrypt. The danger came from the way it silently stole seed phrases during the setup process.
Cybersecurity analysts later uncovered the extension’s real purpose. It did not protect wallets. It harvested them. Victims never saw anything suspicious because the interface behaved exactly like a normal crypto wallet. The takeaway is simple. Dangerous tools do not always look dangerous.
Relevant Source (Google Security Blog): Staying Safe with Chrome Extensions
This post explains how Google reviews and monitors Chrome extensions and gives practical tips to help users avoid malicious extensions that look polished and legitimate.
Relevant Source (Kaspersky Security Blog): 57 suspicious Chrome extensions with 6 million installs
This article shows how dozens of harmful extensions were found inside the official Chrome Web Store, proving that even “legit-looking” plugins can secretly harvest data and abuse user trust.
Why This Threat Matters for Everyday Users
A stolen seed phrase is a stolen wallet. When a user typed in their seed phrase, the extension created a hidden copy and encrypted it into something that looked like a normal Sui blockchain address. This trick bypassed detection and made the theft seem like standard network activity.
The threat actor could then drain every connected account. Savings. DeFi balances. NFTs. Everything. The biggest problem is trust. People rely on official browser stores to filter out threats. This scam shows that even trusted platforms have gaps. Users now face a world where a polished extension can mask a complete financial takeover. Crypto attacks are shifting to tools people trust the most.
How The Scam Works
When a user creates or imports a crypto wallet, they usually type a seed phrase. The malicious extension took that phrase and converted each word into a number using a standard BIP-39 list. The code then turned the numbers into a long string that looked like a real Sui address.
After creating that fake address, the extension sent a tiny blockchain transaction containing the stolen data. These microtransactions looked harmless. The attacker later decoded the data and rebuilt the victim’s seed phrase word by word. Once they had it, they owned the wallet.
In simple terms:
- You typed your seed phrase.
- The extension hid your words inside a fake crypto address.
- It sent that address out in a tiny transaction.
- The hacker decoded it and took your wallet.
Crypto theft is no longer about malware files or phishing. It now lives inside real blockchain activity.
Relevant Source (Ledger): How to keep your 24-word Secret Recovery Phrase and wallet secure
This guide explains what a recovery (seed) phrase is, why it must never be typed into untrusted apps or extensions, and how attackers can steal full wallet access by capturing it.
Relevant Source (Bitdefender): 49 crypto-wallet pickpocketing browser extensions booted from the Chrome Web Store
This research details how malicious browser extensions impersonated crypto wallets to intercept passphrases and private keys, mirroring the same seed theft and exfiltration behavior described in this scam.
What You Should Do Right Now
Anyone who installed the extension or suspects exposure needs to act fast. Once a seed phrase is compromised, the wallet is no longer safe. Recovery only works if you move assets before the attacker does.
Immediate steps to take:
- Create a new Ethereum wallet using a trusted provider.
- Move all funds to the new wallet at once.
- Remove the Safery extension from Chrome.
- Check transaction histories for unknown transfers.
- Change your Chrome permissions and review all active extensions.
Install security extensions from proven developers only. Always check reviews, update logs, and install counts.
Quick action can prevent additional losses even after exposure.
The Bigger Picture: What This Attack Signals
Attacks that hide inside legitimate platforms show a bigger shift in cybercrime. Criminals now use blockchains to smuggle stolen data instead of servers. This method is harder to block and harder to trace. The Safery extension highlights a trend that will continue to grow as attackers learn new ways to hide within trusted systems.
Users must stay alert. Crypto adoption continues to rise, and cybercriminals follow the money. Browser stores will improve their controls, yet no system is perfect. Personal vigilance remains the strongest defense against wallet theft.
Cybercrime evolves with technology and users must evolve with it.
Relevant Source (Google Cloud Threat Intelligence): DPRK Adopts EtherHiding: Nation-State Malware Hiding in the Blockchain
This research explains how attackers now use blockchain itself to store and deliver malicious payloads, showing the wider trend of cybercriminals abusing decentralized platforms instead of traditional servers.
Relevant Source (Springer Journal, International Journal of Information Security): Malicious uses of blockchains by malware
This peer-reviewed paper analyzes how malware families leverage blockchain networks for covert communication and data exfiltration, reinforcing the bigger-picture point that blockchains are becoming tools for hiding and coordinating cyberattacks.
Final Thoughts
Crypto brings freedom and risk. The Safery scam shows how easy it is for a single tool to take everything from a user who trusts the wrong extension. Now is the time to check every wallet, clean up every browser, and strengthen your habits. Do not wait for the next threat. Get ahead of it.
FAQ
How did the attackers hide the stolen seed phrase?
They encoded it into a fake Sui blockchain address and sent it in tiny transactions.
Can victims recover stolen crypto?
Rarely. Crypto transfers are irreversible once made.
Why did the extension look legitimate?
It used clean graphics and ranked high in Chrome’s search results.
Is the Chrome Web Store safe?
Safer than most sources but not perfect. Malicious tools sometimes slip through.
What is the safest way to manage seed phrases?
Use trusted hardware or well-known software wallets and never type them into unknown extensions.
How JENI Helps You Stay Protected
Online threats move fast and target people who trust their everyday tools. This scam shows how simple it is for a polished extension to hide dangerous functions. JENI focuses on helping users stay ahead of these risks by keeping systems clean, monitored, and hardened against hidden threats that build their attack from inside the browser. JENI improves device security so people can focus on their work without worrying about silent compromises.
How JENI Strengthens Your Digital Safety
- Helps detect and remove suspicious files and hidden processes
- Keeps browsers clean by clearing junk data and stale permissions
- Supports better security hygiene with streamlined system optimization
JENI works by improving the stability and safety of your computer so threats have fewer places to hide. Cleaner systems and healthier browser environments reduce the chance of malicious add-ons slipping through. Users gain a stronger understanding of what is running on their devices and can act faster when something feels off.
JENI gives people a safer foundation to manage wallets, browse the web, and protect their data. Stronger systems lead to fewer vulnerabilities and fewer surprises. Now is the right time to use every tool available to keep your crypto and personal information secure.
