Fake Chrome Extension "Safery" Steals Ethereum Wallet Seed Phrases Using Sui Blo

[btc_angela]

Cybersecurity researchers have uncovered a malicious Chrome extension that poses as a legitimate Ethereum wallet but harbors functionality to exfiltrate users' seed phrases.

The name of the extension is "Safery: Ethereum Wallet," with the threat actor describing it as a "secure wallet for managing Ethereum cryptocurrency with flexible settings." It was uploaded to the Chrome Web Store on September 29, 2025, and was updated as recently as November 12. It's still available for download as of writing.

https://thehackernews.com/2025/11/fake-chrome-extension-safery-steals.html

I do hope that no one has downloaded this wallet so far. If yes, then you need to uninstall it right away as it was found out that it has a backdoor that can extract your seed phrases.

And we all know that once they got a hold of your seed phrases, then it's over for you.

So just be careful moving forward on what we download and just used wallets that has been proven itself already that we can trust.

[JeromeTash]

The good news is that the fake Chrome Extension has been removed. I was checking it out in order to have it reported, but it looks like the news made Google Chrome to remove it quickly.

Code:

https://chromewebstore.google.com/detail/fibemlnkopkeenmmgcfohhcdbkhgbolo

However, this goes to show how unsafe the app stores can be at times. People ought to verify first before using any app available.

[TastyChillySauce00]

Chrome extension store always make me feel uneasy finding wallet from there. quite many shady extensions that I honestly prefer to download from official github repo such as metamask, and so on instead of downloading it off chrome extension store.

Always recheck things and be aware, even extension is not safe. Always use extension from the official links.

[0x000369]

wow thats terrifying thanks for sharing so glad to hear @JeromeTash says its finally removed this kind of stuff is exactly why i hate the chrome store for wallets its just too easy for fakes to sneak in @TastyChillySauce00 is 100% correct i never ever search the chrome store for a wallet i always go to the official website for the project like metamask dot io or phantom dot app and click the download link from there just searching the store is a total gamble youre basically asking to get your wallet drained stay safe out there everyone the scammers are working overtime 

[asriloni]

I'm wondering how long for the extension market to improve their filtering to prevent this kind of scam extension. It has been so many times the scam extension gets passed, and it can be downloaded.

Numerous cases, and still nothing updated to prevent it.

That's why i never ever tries to install anything directly from the extension market. I'd rather  doing it directly from the official site.

[btc_angela]

I'm wondering how long for the extension market to improve their filtering to prevent this kind of scam extension. It has been so many times the scam extension gets passed, and it can be downloaded.

I don't know if they are going to improved or not. It could be worsening though as we have seen a lot of of this kind of fake and dangerous extension in the future. It's good that they have taken it down right away, but the question is, if there are some who have been trapped and lost their crypto with this kind of attack.

Maybe the only solution is to stick with extension or wallet that we have trusted already. No if's no but's, that could be the game changer for us. Don't blatantly trusted anything specially those new releases in the market as we don't know what extent this apps are.

[ultrloa]

I'm wondering how long for the extension market to improve their filtering to prevent this kind of scam extension. It has been so many times the scam extension gets passed, and it can be downloaded.

I don't know if they are going to improved or not. It could be worsening though as we have seen a lot of of this kind of fake and dangerous extension in the future. It's good that they have taken it down right away, but the question is, if there are some who have been trapped and lost their crypto with this kind of attack.

Maybe the only solution is to stick with extension or wallet that we have trusted already. No if's no but's, that could be the game changer for us. Don't blatantly trusted anything specially those new releases in the market as we don't know what extent this apps are.

We should not expect them to act fast or improve those situation since as we can see those fake chrome extension still exist in their platform. What we can do for now is to make sure that we are well feed up with information and make sure not to fall with any of those to avoid losing funds.

Try to verify the extensions they are using is really important to make sure that they are using the real one and not those fake which can put them in harm.

Yeah sticking on trusted extension and wallet is more advisable. Since trying lot of things will not bring any positive result to us.

[Hispo]

Honestly, I don't even know why someone would trust an obscure wallet extension on Google Chrome with a significant amount of money in Ethereum, specially is it is not open source.

Hopefully, anyone with a minimum of common avoided this wallet and nobody lost any significant or life changing amount of money to these scammers. If possible, people should always go for hardware wallets and left hot wallets aside for single digit amounts.

[asriloni]

I'm wondering how long for the extension market to improve their filtering to prevent this kind of scam extension. It has been so many times the scam extension gets passed, and it can be downloaded.

I don't know if they are going to improved or not. It could be worsening though as we have seen a lot of of this kind of fake and dangerous extension in the future. It's good that they have taken it down right away, but the question is, if there are some who have been trapped and lost their crypto with this kind of attack.

Maybe the only solution is to stick with extension or wallet that we have trusted already. No if's no but's, that could be the game changer for us. Don't blatantly trusted anything specially those new releases in the market as we don't know what extent this apps are.

Your solution makes sense, but not all of people aware about how to identify the fake ext properly. Some are also lazy enough just to download it from the official site.

I hope they will improve it. It's very sad for innocent people who lacked of knowledge about how to identify the legit extension to be trapped in this fake extension. Seeing hacker was able in placing their fake extension in the extension market many times proven how it's still having a lot of loopholes.

[Odogwu-Blockchain]

There were a new wallet connection system where you no longer need to download chrome extension and import on metamask, but has to do with synchronizing with any decentralized wallet and confirm the required authentication before signing in on a DeFi platform.

Who has ever used this method, maybe the fake chrome extension by hackers results to this new method of signing in.

[passwordnow]

It's very sad for innocent people who lacked of knowledge about how to identify the legit extension to be trapped in this fake extension. Seeing hacker was able in placing their fake extension in the extension market many times proven how it's still having a lot of loopholes.

They are the main targets of these hackers, those who have less knowledge about knowing which one is legitimate. But there is a solution for this if someone out there who's new and just casually reads the discussions. And that is to not download any unknown extension at all or just don't download any of them at all. I think most of those who got hacked fell for this trap and the other one is with the phishing links.

[hugeblack]

They are the main targets of these hackers, those who have less knowledge about knowing which one is legitimate. But there is a solution for this if someone out there who's new and just casually reads the discussions. And that is to not download any unknown extension at all or just don't download any of them at all. I think most of those who got hacked fell for this trap and the other one is with the phishing links.

Or at least don't use a wallet with a balance with them, as some projects require you to access new wallets or link your wallet to unknown services, and here using a wallet with a zero balance (a few coins as gas fees) would be the ideal solution.

[passwordnow]

They are the main targets of these hackers, those who have less knowledge about knowing which one is legitimate. But there is a solution for this if someone out there who's new and just casually reads the discussions. And that is to not download any unknown extension at all or just don't download any of them at all. I think most of those who got hacked fell for this trap and the other one is with the phishing links.

Or at least don't use a wallet with a balance with them, as some projects require you to access new wallets or link your wallet to unknown services, and here using a wallet with a zero balance (a few coins as gas fees) would be the ideal solution.

Yeah, I agree. Much better not to do that if you have some balance that you're not willing to risk for. But we can't stop people from exploring with all of these new wallets that comes out, don't trust them quickly. Always be cautious with what you use and where you connect, always have a safe way of exploration for those who keeps on doing it.

[Webetcoins]

There were a new wallet connection system where you no longer need to download chrome extension and import on metamask, but has to do with synchronizing with any decentralized wallet and confirm the required authentication before signing in on a DeFi platform.

Who has ever used this method, maybe the fake chrome extension by hackers results to this new method of signing in.

Yes I agree. The rise of fake extension is a possible reason for it but other than that, I think it is also a bit hassle to go to the Chrome extension store, to download and setup an extension, only for us to use an Ethereum Erc-20 wallet. There is still a way to identify a fake extension and that is by looking at that tiny check mark. That means it is verified and the original. We can also refer to the number of downloads and feedbacks. If it is a lot, that should mean that it is legit.

[TastyChillySauce00]

Honestly, I don't even know why someone would trust an obscure wallet extension on Google Chrome with a significant amount of money in Ethereum, specially is it is not open source.

Hopefully, anyone with a minimum of common avoided this wallet and nobody lost any significant or life changing amount of money to these scammers. If possible, people should always go for hardware wallets and left hot wallets aside for single digit amounts.

Some people who aren't really experienced in crypto would search up wallet and use whatever presented to them. Seen this in any stores for mobiles as well, the most random wallet there is could have some installs/download because people just don't know what's better for them.

[hugeblack]

Yeah, I agree. Much better not to do that if you have some balance that you're not willing to risk for. But we can't stop people from exploring with all of these new wallets that comes out, don't trust them quickly. Always be cautious with what you use and where you connect, always have a safe way of exploration for those who keeps on doing it.

I didn't mean that. You don't need to link your main wallet to every unknown site you want to visit. You can create a temporary wallet with enough credit for gas fees (a dollar or two) so that this is the amount you will lose in the worst-case scenario.

[gunhell16]

It's not advisable to just install random wallet extensions on your browser if you're not fully familiar with these browser-based wallet extensions. The only wallet extensions I have installed
are MetaMask and Phantom; previously, I did install Grass, but I removed it later.

Additionally, apart from the ones I mentioned, I haven't installed any other wallet extensions because I've heard and read in articles about unknown wallet extensions
that have experienced hacking of their wallets.