Warning: Popular Crypto Wallet Extension Could Steal Your Seed Phrases

Blockchain security platform Socket has issued a warning about a malicious crypto wallet extension available on Google’s Chrome Web Store. This extension employs a unique method to steal users’ seed phrases and deplete their assets.

Key Takeaways

A Chrome extension called “Safery: Ethereum Wallet” is designed to steal seed phrases from users.
It misleads users by claiming to be a reliable wallet for Ethereum-based assets while containing a backdoor.
The extension exploits two scenarios: creating a new wallet or importing an existing one.
Users should be cautious of extensions with zero reviews and other red flags and maintain good cybersecurity practices.

The “Safery: Ethereum Wallet” positions itself as a user-friendly tool for managing Ethereum (ETH) assets, but a report from Socket reveals its true nature: a tool aimed at stealing users' seed phrases through a cleverly disguised backdoor.

Chrome Web Store’s No. 4 crypto wallet can steal user seed phrases

The Mechanism Behind the Scam

According to the report, this extension, which appears to be a straightforward Ethereum wallet, is designed to exfiltrate seed phrases stealthily. It does this by encoding the seed phrases into Sui addresses and executing microtransactions from these addresses using a wallet controlled by the scammer.

Safety Wallet promo images. Source: Chrome Store

Currently, this extension ranks as the fourth result when searching for “Ethereum Wallet” in the Chrome Web Store, trailing behind legitimate options like MetaMask, Wombat, and Enkrypt.

Chrome store search results. Source: Chrome Store

The extension allows users to create new wallets or import existing ones, resulting in two significant security risks.

Creating a New Wallet: When users create a new wallet using this extension, they inadvertently send their seed phrase to a threat actor through a minute Sui transaction. Since the wallet is compromised from the start, any funds can be stolen at any time.
Importing an Existing Wallet: If a user imports an existing wallet and inputs their seed phrase, that information is similarly sent to the scammers through a small transaction.

“As users create or import a wallet, the Safery: Ethereum Wallet encodes the BIP-39 mnemonic into synthetic Sui-style addresses, subsequently sending 0.000001 SUI to those recipients using a hardcoded thief’s mnemonic,” Socket explained.

Protecting Yourself from Scam Extensions

Despite the high visibility of this malicious extension in search results, there are identifiable signs that indicate its illegitimacy.

Lack of Reviews: The extension has no user reviews.
Poor Branding: It features minimal branding and contains grammatical errors.
No Official Website: The extension does not have an official web presence.
Questionable Developer: The developer associated with it uses a Gmail account for contact.

It is crucial for anyone engaging with blockchain platforms and tools to conduct thorough research. Users should exercise care with seed phrases, adopt robust cybersecurity measures, and evaluate proven alternatives with established credibility.

Since this extension triggers microtransactions, it is also important to regularly review wallet transactions, as even small movements can pose risks.

Related Articles:

"Scammers Posed as Australian Police to Steal Crypto, Authorities Warn"
"Help! My robot vac is stealing my Bitcoin’: When smart devices attack"