Sui Blockchain Seed Stealer: Malicious Chrome Extension Hides Mnemonic Exfiltration in Microtransactions

The Sui Blockchain Seed Stealer story, published on 14 November 2025, reports a malicious Chrome extension posing as an Ethereum wallet that exfiltrates seed phrases by hiding the data inside normal-looking Sui blockchain transactions. The extension, named Safery: Ethereum Wallet, was live on the Chrome Web Store and appeared alongside legitimate wallets such as MetaMask and Enkrypt.

According to Socket Threat Research Team, it encodes the victim’s BIP-39 seed phrase into synthetic Sui addresses and sends 0.000001 SUI from a hardcoded threat actor wallet, with the mnemonic then Base64-decoded inside the extension. The exfiltration occurs entirely on-chain—no HTTP requests or external C2 infrastructure are involved, just stealthy microtransactions that resemble routine activity.

The threat actor later reads the blockchain transactions and decodes the addresses back into the seed phrase, reconstructing the mnemonic word by word. Socket has notified Google, but at the time of the report the extension remained live and downloadable.