Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain
Cybersecurity experts have discovered a harmful Chrome extension that masquerades as a genuine Ethereum wallet but contains features designed to extract users' seed phrases.
The name of the extension is "Safery: Ethereum Wallet," with the threat actor describing it as a secure wallet for managing Ethereum cryptocurrency with flexible settings. It was added to the Chrome Web Store on September 29, 2025, and received its latest update on November 12. As of this writing, it can still be downloaded.
Kirill Boychenko, a researcher at Socket Security, stated that although it is promoted as a straightforward and secure Ethereum (ETH) wallet, it has a backdoor that extracts seed phrases by encoding them into Sui addresses and sending microtransactions from a Sui wallet controlled by a malic...