Malicious Chrome Extension Grants Full Control Over Ethereum Wallet

Security researchers have uncovered a sophisticated supply chain attack disguised as a legitimate cryptocurrency wallet in a Chrome extension named “Safery: Ethereum Wallet.” According to Socket’s Threat Research Team, the extension was published on the Chrome Web Store on 12 November 2024 and remains visible at the time of reporting.

It encodes the user’s BIP-39 mnemonic into one or two synthetic Sui-style addresses and then sends 0.000001 SUI to those encoded addresses using a hardcoded threat actor mnemonic, allowing the attacker to reconstruct the seed phrase without traditional command-and-control infrastructure. This exfiltration is concealed within legitimate-looking blockchain transactions, making it difficult to detect with conventional monitoring.

The attackers obtain full control of all derived wallets and can drain assets, as the seed phrase never travels in plaintext over HTTP. The incident prompted a takedown request to Google Chrome’s security team, and defenders are advised to treat unusual blockchain RPC calls from the browser as high-risk indicators and to install wallets only from verified publishers.