Briefing
A sophisticated supply chain attack has been identified via a malicious Chrome extension, “Safery → Ethereum Wallet,” which covertly steals user seed phrases upon wallet creation or import. This threat enables full wallet takeover by encoding the victim’s BIP-39 mnemonic into synthetic Sui blockchain addresses and exfiltrating the data via tiny, legitimate-looking microtransactions. The attack’s core innovation is its complete evasion of HTTP-based network monitoring, utilizing the Sui network to broadcast the stolen seed phrase in the recipient field of a 0.000001 SUI transaction.
Context
The prevailing risk landscape for individual digital asset holders remains dominated by social engineering and supply chain compromises targeting the user endpoint. Before this incident, the primary class of wallet-draining vulnerability involved phishing sites or direct injection of JavaScript to send plaintext seed phrases over unencrypted HTTP channels to a central Command-and-Control (C2) server. This reliance on centralized C2 infrastructure was a known choke point for security firms, which this new on-chain exfiltration technique was explicitly designed to bypass.
Analysis
The attack vector is a malicious browser extension that successfully infiltrated the Chrome Web Store and achieved a high search ranking, lending it a false veneer of legitimacy. When a user enters their mnemonic, the extension’s embedded logic converts the BIP-39 word list into a sequence of numeric indices. This sequence is then packed into a hexadecimal string, which is formatted as one or two valid Sui blockchain addresses. The extension then executes a microtransaction of 0.000001 SUI from a hardcoded attacker-controlled wallet to these mnemonic-encoded addresses, thereby using the public, immutable blockchain ledger as a covert, decentralized data exfiltration channel.
Parameters
- Attack Vector → Malicious Chrome Extension (Safery → Ethereum Wallet)
- Exfiltration Method → Seed phrase encoded into Sui transaction recipient address
- Exfiltration Channel → Sui Blockchain Microtransaction
- Exfiltration Cost → 0.000001 SUI per transaction (The negligible cost of the on-chain data transfer)
- Targeted Asset → BIP-39 Mnemonic Seed Phrases (Granting control over all derived Ethereum assets)
Outlook
Immediate mitigation requires all users to audit their browser extensions, uninstall any unknown or unverified wallet applications, and immediately migrate assets from any wallet whose seed phrase was ever entered into a third-party extension. The emergence of on-chain data exfiltration establishes a new, critical security best practice → protocols must now monitor for suspicious, cross-chain microtransactions, and security auditors must treat any unexpected blockchain RPC calls from a front-end as a high-signal threat. This incident signals a strategic shift where threat actors are moving from traditional web-based C2 infrastructure to utilizing the native, decentralized properties of blockchains for covert operations.
Verdict
This innovative attack vector represents a significant escalation in supply chain risk, proving that threat actors can now leverage the immutability of a public ledger to create a decentralized, undetectable seed phrase exfiltration channel.
