Malicious Safery Chrome Extension Steals Ethereum Wallet Seed Phrases via Sui Blockchain

A malicious Chrome extension named Safery: Ethereum Wallet was discovered on the Chrome Web Store, masquerading as a legitimate Ethereum wallet while secretly exfiltrating users' seed phrases. The extension encodes the BIP-39 mnemonic seed phrases into synthetic Sui blockchain addresses and sends microtransactions (0.000001 SUI) from a hardcoded attacker-controlled wallet, embedding the sensitive information within normal-looking blockchain transactions. This method allows the threat actor to later decode the recipient addresses and reconstruct the original seed phrase, enabling them to drain victims' cryptocurrency assets without relying on a traditional command-and-control server.

Security researchers from both Socket and Koi Security analyzed the extension, confirming its backdoor functionality and detailing its technical behavior, including the use of a hardcoded Base64 wallet seed and global exposure of sensitive wallet functions in the browser. The extension remained available for download at the time of reporting, and a takedown request was submitted to Google. Users are advised to avoid untrusted wallet extensions and defenders are recommended to scan for mnemonic encoders, synthetic address generators, and suspicious on-chain writing behaviors in browser add-ons to mitigate similar threats.