Cybersecurity experts have discovered a harmful Chrome extension that masquerades as a genuine Ethereum wallet but contains features designed to extract users’ seed phrases.
The name of the extension is “Safery: Ethereum Wallet,” with the threat actor describing it as a secure wallet for managing Ethereum cryptocurrency with flexible settings. It was added to the Chrome Web Store on September 29, 2025, and received its latest update on November 12. As of this writing, it can still be downloaded.
Kirill Boychenko, a researcher at Socket Security, stated that although it is promoted as a straightforward and secure Ethereum (ETH) wallet, it has a backdoor that extracts seed phrases by encoding them into Sui addresses and sending microtransactions from a Sui wallet controlled by a malicious actor.
The malware in the browser add-on specifically aims to steal wallet mnemonic phrases by encoding them as fictitious Sui wallet addresses read more about Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.