Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain

A malicious Chrome extension named “Safery: Ethereum Wallet” has been identified as a front for stealing users’ seed phrases by encoding them into fake Sui addresses and sending micro-transactions to attacker‑controlled wallets. The extension was uploaded to the Chrome Web Store on 29 September 2025 and was updated as recently as 12 November 2025, and it remains available at the time of writing.

Marketed as a simple, secure Ethereum wallet, the add‑on contains a backdoor that exfiltrates seed phrases by embedding them in blockchain transactions, with the attacker’s wallet billing the micro‑transactions and enabling monitoring of the blockchain. The end goal is to smuggle the seed phrase inside normal looking transactions without a C2 server, allowing the attacker to decode the recipient addresses to reconstruct the seed and drain assets.

To counter the risk, users are advised to stick to trusted wallet extensions, and defenders are urged to scan for mnemonic encoders, synthetic address generators, and hard‑coded seed phrases, as well as block those that write on the chain during wallet import or creation, according to Koi Security notes.