Chrome Web Stores No. 4 crypto wallet can steal user seed phrases

A malicious “Safery: Ethereum Wallet” extension is currently live on the Chrome Web Store, using a crafty backdoor to exfiltrate seed phrases. Here's how it works.

Blockchain security platform Socket has warned of a new malicious crypto wallet extension on Googles Chrome Web Store that has a unique way of stealing seed phrases to drain user assets.

The extension is called “Safery: Ethereum Wallet”and claims itself as a “reliable and secure browser extension designed for easy and efficient management” of Ethereum-based assets.

However, as highlighted in a Tuesday report from Socket, the extension is actually designed to steal seed phrases via a crafty backdoor.

“Marketed as a simple, secure Ethereum (ETH) wallet, it contains a backdoor that exfiltrates seed phrases by encoding them into Sui addresses and broadcasting microtransactions from a threat actor-controlled Sui wallet,” the report reads.

Safety Wallet promo images. Source: Chrome Store

Notably, it currently sits as the fourth search result for “Ethereum Wallet” on the Google Chrome store, just a couple of places behind legitimate wallets like MetaMask, Wombat and Enkrypt.

Chrome store search results. Source: Chrome Store

The extension enables users to create new wallets or import existing ones from elsewhere, thereby establishing two potential security risks for the user.

In the first scenario, the user creates a new wallet in the extension and immediately sends their seed phrase to the bad actor via a tiny Sui-based transaction. As the wallet is compromised from day one, the funds can be stolen at any time.

In the second scenario, the user imports an existing wallet and enters their seed phrase, handing it over to the scammers behind the extension, who can again view the information via the small transaction.

“When a user creates or imports a wallet, Safery: Ethereum Wallet encodes the BIP-39 mnemonic into synthetic Sui style addresses, then sends 0.000001 SUI to those recipients using a hardcoded threat actors mnemonic,” Socket explained, adding:

“By decoding the recipients, the threat actor reconstructs the original seed phrase and can drain affected assets. The mnemonic leaves the browser concealed inside normal-looking blockchain transactions.” How crypto users can avoid scam extensions

While this malicious extension appears high in the search results, there are some clear signs that it lacks legitimacy.

The extension has zero reviews, very limited branding, grammatical mistakes in some of the branding, no official website, and links to a developer using a Gmail account.

It is important for people to do significant research before they deal with any blockchain platform and tool, be extremely careful with seed phrases, have solid cybersecurity practices, and research well-established alternatives with verified legitimacy.

Given that this extension also sends microtransactions, it is essential to consistently monitor and identify wallet transactions, as even small transactions could be harmful.