Ethereum

Secure

when

Security

Blockchain security firm Socket has issued an urgent <a href="https://socket.dev/blog/malicious-chrome-extension-exfiltrates-seed-phrases" target="_blank" rel="noopener noreferrer nofollow">warning</a> about a malicious crypto wallet extension circulating on the Google Chrome Web Store, alerting users that the tool is actively stealing seed phrases through a sophisticated backdoor mechanism.&nbsp;
The extension, titled “Safery: Ethereum Wallet,” promotes itself as a secure and user-friendly way to manage Ethereum assets, but Socket’s Threat Research Team says it is engineered to covertly drain user funds.
According to a Tuesday report from Socket, the extension, published on November 12, 2024,functions as a Trojan wallet.&nbsp;
While it appears to operate like a typical <a href="https://hash.media/hashdesk/huobi-founder-launches-1b-ethereum-trust-with-key-backers/" target="_blank" rel="noopener noreferrer nofollow">Ethereum</a> browser extension, it secretly exfiltrates users’ BIP-39 seed phrases by encoding them into synthetic Sui-style addresses and sending tiny microtransactions worth 0.000001 SUI from a threat-actor-controlled wallet.&nbsp;
By decoding these recipient addresses, attackers can fully reconstruct the victim’s seed phrase and take control of their assets at any time.
This exfiltration process happens the moment a user creates a new wallet or imports an existing one. In both scenarios, the seed phrase is immediately transmitted through disguised on-chain activity, leaving no obvious signs of compromise.&nbsp;
Socket notes that the mnemonic “leaves the browser concealed inside normal-looking blockchain transactions,” making detection extremely difficult without specialized analysis.
Despite being malicious, Safery: Ethereum Wallet is currently listed as the fourth result when users search for “Ethereum Wallet” on the Chrome Web Store. It appears alongside reputable extensions such as MetaMask and Enkrypt, giving it significant visibility and an air of legitimacy.&nbsp;
The listing includes polished marketing claims such as “Easy, Fast and Secure Extension,” promises privacy protections, and states that private keys remain on-device, claims that are directly contradicted by its hidden backdoor.
Socket’s analysis shows that the extension behaves convincingly like a real Ethereum wallet, supporting balance checks, transaction history via Etherscan or Ethplorer, and standard ETH transfers.&nbsp;
This realistic interface increases the likelihood that unsuspecting users will trust it with their seed phrases.
Security researchers are urging users to immediately avoid or uninstall the Safery extension and verify the authenticity of any crypto wallet tools before installation.
pay3 (pay3.so) is a crypto payment platform that replaces wallet addresses with usernames. Accept USDT, USDC, ETH, and BNB through one simple link: pay3.so/@yourname

Socket Warns Chrome Users of Seed-Stealing Safery Wallet

Todayq News

Other articles published on Nov 14, 2025

Join our free newsletter for daily crypto updates!