Is MetaMask safe to connect?
Self-custody wallet ยท Ethereum, EVM networks, others. Checked 2026-10-25; every line links its source.
Worst case: MetaMask is self-custody: a leaked recovery phrase (or social-login password), or one signed malicious token approval, can let an attacker drain the tokens in that account, and nobody can reverse it.
Safe setup in 3 steps
- Install only from metamask.io/download: Chrome Web Store ID nkbihfbeogaeaoehlefnkodbefgpgknn, Firefox 'ether-metamask', App Store id1438144202, Google Play io.metamask (10M+ downloads). Never install a 'manual' build someone sends you.
- Ignore any email or DM about '2FA', 'verification' or 'migration'. MetaMask doesn't send them. Never enter your recovery phrase on a website.
- Use a separate MetaMask account with a small balance for bots and new dapps, and regularly revoke old token approvals at Revoke.cash.
What it can do with your money
| Who holds the keys | You hold the keys Self-custody with a Secret Recovery Phrase (SRP). Optional social login (Google, Apple or Telegram) stores your SRP online encrypted. The key to decrypt it comes from your password plus shares held by server nodes: 'No single party (not MetaMask, not the data store, not Google, Apple, or Telegram)' other than you can rebuild the SRP. That password must be guarded like the SRP itself. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every send yourself, to any address. source |
| Swaps and third parties | MetaMask Swaps only aggregates quotes. 'MetaMask does not provide the liquidity, execute the trade' itself: DEXs and other swap protocols do. The MetaMask fee is 0.875% on top of the quote and network fee. Bridging is sourced through the Li.fi and Socket aggregators, with bridge providers such as Hop, Celer cBridge and Stargate. source |
Official links
- Website:
metamask.io - Website:
support.metamask.io - X:
@MetaMask - GitHub:
github.com/MetaMask - GitHub:
github.com/MetaMask/metamask-extension - App:
https://chromewebstore.google.com/detail/metamask/nkbihfbeogaeaoehlefnkodbefgpgknn - App:
https://addons.mozilla.org/en-US/firefox/addon/ether-metamask/ - App:
https://apps.apple.com/us/app/metamask-blockchain-wallet/id1438144202 - App:
https://play.google.com/store/apps/details?id=io.metamask
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-01-05 | Phishing emails posing as MetaMask told users to 'enable 2FA', sometimes with a countdown timer, then led to look-alike sites that asked for the recovery phrase. Flagged by SlowMist (third-party report; no domains named in the coverage). | MetaMask doesn't send such emails | source | |
| 2025-08-08 | 'GreedyBear' campaign: 150+ malicious Firefox add-ons impersonating MetaMask, TronLink, Exodus and Rabby, plus fake sites, stole more than $1M (Koi Security, via The Hacker News). | more than $1M | not refunded | source |
| 2025-07-21 | Extension bug: on Chromium browsers, MetaMask kept writing to disk in the background (one user reported ~500 GB/day), wearing out SSDs. Consensys acknowledged 'unusually high disk activity' and rolled out a partial fix. | partly fixed; funds not affected | source | |
| 2025-07-03 | Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating MetaMask, Phantom, Coinbase, Trust Wallet, Exodus and others (third-party report). | reported to Mozilla | source |