{"id":507406,"date":"2025-11-23T14:00:08","date_gmt":"2025-11-23T14:00:08","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=507406"},"modified":"2026-04-25T19:31:56","modified_gmt":"2026-04-25T18:31:56","slug":"security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/","title":{"rendered":"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases"},"content":{"rendered":"

For a few days in November, a malicious Chrome extension ranked as the fourth result for \u201cEthereum wallet\u201d on the Chrome Web Store.<\/p>\n

The extension, called \u201cSafery: Ethereum<\/a> Wallet,\u201d looked polished enough to pass as legitimate. It had a clean icon, a generic name adjacent to security language, a flood of five-star reviews, and boilerplate descriptions familiar to anyone who\u2019s downloaded a crypto wallet.<\/p>\n

Behind that frontend was a purpose-built attack designed to steal seed phrases and empty user wallets by encoding stolen secrets into micro-transactions on the Sui blockchain.<\/p>\n

Socket, a security tooling company focused on open-source software supply chains, installed and analyzed<\/a> the extension after it was discovered.<\/p>\n

Their aim was to understand how \u201cSafery\u201d avoided detection, climbed the Chrome Store rankings, and moved stolen seed phrases without raising alarms, as well as what users could do to spot similar threats. The report walks through the attacker\u2019s approach and serves as both a postmortem and a warning that browser extensions remain a dangerous blind spot in crypto.<\/p>\n

This case is noteworthy because the hackers didn't just steal seed phrases. That part is, unfortunately, well-trodden territory in crypto.<\/p>\n

What makes it notable is that Safery didn't spoof an existing wallet brand. It wasn't a MetaMask lookalike or a recycled phishing domain. It invented an identity, bought or botted fake reviews to climb search rankings, and launched as a “new” wallet option.<\/p>\n

This approach meant the listing showed no immediate red flags: no broken grammar, no odd permissions, and no redirection to shady domains.<\/p>\n

The Chrome Web Store publisher page had no prior complaints, and its support URL led to an off-platform site that hadn\u2019t been flagged by security trackers at the time of Socket's analysis.<\/p>\n

Given its polished appearance, most users wouldn't have hesitated before clicking “Add to Chrome.” The extension asked to run on \u201call websites,\u201d a common request for crypto wallets that need access to decentralized apps.<\/p>\n

Notably, it didn\u2019t prompt for extra permissions or try to inject content scripts that would trigger Chrome\u2019s more aggressive warnings. The branding was minimalist, the website matched the extension\u2019s name, and the setup screen prompted users to create or import a wallet, again, standard behavior.<\/p>\n

The seed heist, broadcast over Sui<\/h2>\n

The real damage began once a seed phrase was entered. Instead of storing the phrase locally or encrypting it for user access, the extension silently split it into fragments and encoded them as what appeared to be random wallet addresses.<\/p>\n

Socket\u2019s research shows these fragments were inserted into Sui blockchain transactions. Specifically, the extension issued tiny SUI token transfers, minuscule amounts that would draw no attention, to addresses controlled by the attacker.<\/p>\n

Hidden inside those transactions, either in memo fields or obfuscated addresses, were pieces of the user\u2019s seed phrase.<\/p>\n

This approach had tactical advantages. It didn\u2019t require the extension to send outbound requests to malicious servers. There was no command-and-control beacon or exfiltration over HTTP or WebSockets that a browser or antivirus might flag.<\/p>\n

The payload left the user\u2019s device as a normal-looking blockchain transaction, routed through a widely used, low-fee chain. Once on-chain, the data was publicly accessible, allowing the attacker to retrieve it later, reconstruct the seed phrase, and sweep wallets without touching the user\u2019s device again.<\/p>\n

In effect, the scam used the Sui blockchain itself as a communications channel. And because Sui has fast confirmation times and negligible transaction costs, it functioned like a low-latency message bus.<\/p>\n

Socket traced multiple examples of these seed-fragment transactions and confirmed the link between seed entry and eventual asset loss. While the thefts occurred off-chain, either on Ethereum<\/a> or other L1s where the victims\u2019 wallets held funds, the instructions for carrying them out were hidden in plain sight.<\/p>\n

Before releasing the version that landed in Chrome\u2019s top wallet results, the publisher likely tested this method in private. Evidence shows earlier builds experimented with simpler data leaks before the Sui encoding was refined.<\/p>\n

By the time the active extension was flagged, it had enough installs to reach Chrome\u2019s \u201ctrending\u201d tier, further boosting its visibility. Brave New Coin reported that the \u201cSafery\u201d wallet sat among the top results for \u201cEthereum wallet\u201d searches even as reports of suspicious behavior circulated on Reddit and Telegram.<\/p>\n

How the Chrome algorithm let it happen<\/h2>\n

The success of \u201cSafery\u201d hinged on Chrome\u2019s ranking logic. The Web Store search algorithm weighs keyword match, install count, review velocity, average rating, and update recency.<\/p>\n

Extensions with a burst of activity, especially in niche categories, can climb rapidly if better-vetted competitors aren\u2019t updated frequently. In this case, \u201cSafery\u201d had a name that scored well for common queries, a blitz of positive reviews, many templated or duplicated, and a fresh upload date.<\/p>\n

No evidence shows that Google manually reviewed this listing before publication. Chrome Web Store policy treats most new extensions with a brief automated scan and fundamental static analysis.<\/p>\n

Extensions undergo deeper scrutiny when they request elevated permissions, such as access to tabs, clipboard, file systems, or history. Wallet extensions often avoid these flags by operating within iframes or using approved APIs. \u201cSafery\u201d stayed within those bounds.<\/p>\n

Even when users raised concerns, the time between reporting and takedown stretched long enough for damage to occur. Part of that lag is structural: Chrome doesn\u2019t act on flagged extensions instantly unless there\u2019s an overwhelming consensus or known malware signatures.<\/p>\n

In this case, the payload was obfuscated JavaScript that relied on blockchain infrastructure, not external hosts. Traditional malware detection methods didn\u2019t catch it.<\/p>\n

This isn\u2019t the first time Chrome extensions have been used to steal crypto. Previous scams include fake Ledger Live apps that prompted users to enter recovery phrases, or hijacked legitimate extensions that allowed attackers to access the developer\u2019s publishing key.<\/p>\n

What makes \u201cSafery\u201d different is the smoothness of the facade and the absence of backend infrastructure. There was no phishing site to take down, no server to block, just one extension moving secrets onto a public chain and walking away.<\/p>\n

Users still had some recourse. If they acted quickly, they could limit exposure by rotating seeds and revoking transaction approvals.<\/p>\n

Socket and others provided triage steps for anyone who installed the extension: uninstall immediately, revoke any token approvals, sweep assets to a new wallet using a clean device, and monitor associated addresses. For users who didn\u2019t notice the exfiltration or who stored large amounts in hot wallets, recovery remained unlikely.<\/p>\n

The real trouble begins before the wallet ever loads<\/h2>\n

Security researchers and developers are calling for stronger heuristics from Chrome itself. One proposed solution is to automatically flag any extension that includes UI elements prompting for a 12- or 24-word phrase.<\/p>\n

Another approach is to require publisher attestation for wallet extensions, which provides verifiable proof that a given publisher controls the codebase behind a known wallet brand. There are also calls for tighter inspection of wallet-related permissions, even when those don\u2019t include dangerous access patterns.<\/p>\n

For end users, Socket published a practical checklist for extension management. Before installing any crypto extension, users should review the publisher\u2019s history, verify association with a known project, inspect the review pattern, especially bursts of identical reviews, check for real website links with public GitHub repositories, and scan the permissions tab for vague or sweeping access.<\/p>\n

A clean name and high rating aren\u2019t enough.<\/p>\n

This case raises broader questions about the browser\u2019s role in crypto. Browser wallets gained popularity due to accessibility and ease of use. They enable users to interact with decentralized applications without switching platforms or downloading separate apps.<\/p>\n

But that accessibility has come at the cost of exposure. The browser is a high-risk environment subject to extension manipulation, session hijacking, clipboard scrapers, and now covert blockchain exfiltration.<\/p>\n

Wallet developers are likely to rethink distribution models. Some teams already discourage Chrome Web Store installs, preferring mobile apps or desktop binaries. Others may build warnings for users attempting to install from unverified sources.<\/p>\n

The core problem remains: distribution is fragmented, and most users don\u2019t know how to distinguish a legitimate wallet from a polished clone.<\/p>\n

The \u201cSafery\u201d extension didn\u2019t need to look like MetaMask or masquerade as Phantom. It created its own brand, seeded fake trust signals, and built an invisible backdoor that used the Sui blockchain as a courier.<\/p>\n

That should force a rethink of how trust is established in crypto UX, and how close to the metal even casual tools like browser extensions really are.<\/p>\n

Crypto users assume Web3 means sovereignty and self-custody. But in the wrong hands, a browser wallet isn\u2019t a vault, it\u2019s an open port. And Chrome won\u2019t always warn you before something slips through.<\/p>\n","protected":false},"excerpt":{"rendered":"

For a few days in November, a malicious Chrome extension ranked as the fourth result for \u201cEthereum wallet\u201d on the Chrome Web Store. The extension, called \u201cSafery: Ethereum Wallet,\u201d looked polished enough to pass as legitimate. It had a clean icon, a generic name adjacent to security language, a flood of five-star reviews, and boilerplate […]<\/p>\n","protected":false},"author":759,"featured_media":507412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120,16041,9836,60206],"tags":[80747,76679,80748,78525,77945],"post_folder":[],"acf":[],"yoast_head":"\nTop-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases<\/title>\n<meta name=\"description\" content=\"A Chrome wallet called Safery ranked #4 for \u201cEthereum\u201d before draining seeds via Sui. We break down how it worked.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases\" \/>\n<meta property=\"og:description\" content=\"A Chrome wallet called Safery ranked #4 for \u201cEthereum\u201d before draining seeds via Sui. We break down how it worked.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-23T14:00:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-25T18:31:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/11\/chrome-wallet-seed.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Andjela Radmilac\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@andjelaradmilac\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Andjela Radmilac\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/#person\",\"name\":\"Andjela Radmilac\",\"url\":\"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-300x300.jpg\",\"caption\":\"Andjela Radmilac\"},\"jobTitle\":\"Senior Analyst\",\"description\":\"Andjela brings a classical education and politics background to crypto, where she has covered industry news since 2018.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/x.com\/andjelaradmilac\",\"https:\/\/www.linkedin.com\/in\/andjelaradmilac\",\"https:\/\/muckrack.com\/andjela-radmilac\"]},\"headline\":\"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases\",\"datePublished\":\"2025-11-23T14:00:08+00:00\",\"dateModified\":\"2026-04-25T18:31:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\"},\"wordCount\":1469,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"chrome wallet\",\"Hack\",\"safery\",\"Sui\",\"Theft\"],\"articleSection\":[\"Analysis\",\"Hacks\",\"Scams\",\"Wallets\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\",\"url\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\",\"name\":\"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2025-11-23T14:00:08+00:00\",\"dateModified\":\"2026-04-25T18:31:56+00:00\",\"description\":\"A Chrome wallet called Safery ranked #4 for \u201cEthereum\u201d before draining seeds via Sui. We break down how it worked.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/cryptoslate.substack.com\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/advertising\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/699a3980d313687a5551af6b58862d08\",\"name\":\"Andjela Radmilac\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-150x150.jpg\",\"caption\":\"Andjela Radmilac\"},\"description\":\"Armed with a classical education and an eye for news, Andjela dove head deep into the crypto industry in 2018 after spending years covering politics.\",\"sameAs\":[\"https:\/\/twitter.com\/andjelaradmilac\"],\"jobTitle\":\"Senior Analyst\",\"worksFor\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases","description":"A Chrome wallet called Safery ranked #4 for \u201cEthereum\u201d before draining seeds via Sui. We break down how it worked.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/","og_locale":"en_US","og_type":"article","og_title":"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases","og_description":"A Chrome wallet called Safery ranked #4 for \u201cEthereum\u201d before draining seeds via Sui. We break down how it worked.","og_url":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/","og_site_name":"CryptoSlate","article_published_time":"2025-11-23T14:00:08+00:00","article_modified_time":"2026-04-25T18:31:56+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/11\/chrome-wallet-seed.jpg","type":"image\/jpeg"}],"author":"Andjela Radmilac","twitter_card":"summary_large_image","twitter_creator":"@andjelaradmilac","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Andjela Radmilac","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/#person","name":"Andjela Radmilac","url":"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-300x300.jpg","caption":"Andjela Radmilac"},"jobTitle":"Senior Analyst","description":"Andjela brings a classical education and politics background to crypto, where she has covered industry news since 2018.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/x.com\/andjelaradmilac","https:\/\/www.linkedin.com\/in\/andjelaradmilac","https:\/\/muckrack.com\/andjela-radmilac"]},"headline":"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases","datePublished":"2025-11-23T14:00:08+00:00","dateModified":"2026-04-25T18:31:56+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/"},"wordCount":1469,"commentCount":0,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["chrome wallet","Hack","safery","Sui","Theft"],"articleSection":["Analysis","Hacks","Scams","Wallets"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/","url":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/","name":"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2025-11-23T14:00:08+00:00","dateModified":"2026-04-25T18:31:56+00:00","description":"A Chrome wallet called Safery ranked #4 for \u201cEthereum\u201d before draining seeds via Sui. We break down how it worked.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/security-reality-check-top-ranked-chrome-wallet-that-steals-your-seedphrase\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Top-ranked Chrome \u2018wallet\u2019 sneakily steals crypto seedphrases"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/cryptoslate.substack.com","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/advertising\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/699a3980d313687a5551af6b58862d08","name":"Andjela Radmilac","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-andjela-radmilac-150x150.jpg","caption":"Andjela Radmilac"},"description":"Armed with a classical education and an eye for news, Andjela dove head deep into the crypto industry in 2018 after spending years covering politics.","sameAs":["https:\/\/twitter.com\/andjelaradmilac"],"jobTitle":"Senior Analyst","worksFor":"CryptoSlate","url":"https:\/\/cryptoslate.com\/author\/andjela-radmilac\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/507406"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/759"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=507406"}],"version-history":[{"count":9,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/507406\/revisions"}],"predecessor-version":[{"id":532329,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/507406\/revisions\/532329"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/507412"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=507406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=507406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=507406"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=507406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}