Chrome extension “Safery” steals Ethereum wallet seed phrases

The malicious Chrome extension “Safery: Ethereum Wallet” was discovered by Socket’s Threat Research Team, posing as a legitimate crypto wallet but designed to steal seed phrases. It was uploaded to the Chrome Web Store on 29 September 2025, with the last update on 12 November 2025, and remains available for download.

The extension supposedly appears user-friendly and private, showing as a secure option for easy transactions, yet hides stolen seed phrases inside blockchain transactions by encoding a BIP-39 mnemonic into synthetic Sui‑style addresses. Each seed word is mapped to its index, packed into hex, padded to 64 characters, and prefixed 0x; twelve-word seeds yield one address and 24-word seeds two.

On wallet create or import, the extension uses a hardcoded attacker mnemonic to send tiny SUI transactions to these synthetic addresses, allowing the attacker to later reconstruct the exact seed and drain assets. The exfiltration runs in‑memory, using public blockchains as the channel with no plaintext data leaving the browser, meaning typical domain or URL‑based detections may miss it. Researchers have called for Google to remove the extension and suspend the publisher’s account.