Is Rabby Wallet safe to connect?
Self-custody wallet ยท Ethereum, EVM networks. Checked 2026-10-25; every line links its source.
Worst case: Rabby is self-custody: a fake 'Rabby' add-on or a leaked seed gives an attacker the whole wallet, and a signed malicious approval lets them pull the approved tokens. Nobody can reverse either.
Safe setup in 3 steps
- Install only from rabby.io: Chrome Web Store ID acmacodkjbdgmoleebolmdjonilkdbch, App Store id6474381673, Google Play com.debank.rabbymobile. Rabby has no Firefox add-on, so any 'Rabby' or 'Rabb-Wallet' on Firefox is fake.
- Read Rabby's pre-sign simulation and risk warnings before every signature, and revoke stale approvals (Rabby has an approvals view, or use Revoke.cash). Rabby never offers support on Telegram, WhatsApp, SMS or WeChat.
- Use a separate Rabby address with only bot/trading money, and keep long-term holdings on a hardware wallet connected to Rabby.
What it can do with your money
| Who holds the keys | You hold the keys Self-custody: keys and assets are stored 'locally on their own devices'. Rabby will 'never ask you for your private key or secret recovery phrase'. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every send yourself, to any address. source |
| Swaps and third parties | Rabby's terms say that swaps and bridging use 'products, or services of one or more third parties'. ethereum.org lists a 0.25% Rabby swap fee (https://ethereum.org/wallets/find-wallet/rabby-wallet/). source |
Official links
- Website:
rabby.io - X:
@Rabby_io - GitHub:
github.com/RabbyHub - GitHub:
github.com/RabbyHub/Rabby - App:
https://chromewebstore.google.com/detail/rabby/acmacodkjbdgmoleebolmdjonilkdbch - App:
https://apps.apple.com/us/app/rabby-wallet-crypto-evm/id6474381673 - App:
https://play.google.com/store/apps/details?id=com.debank.rabbymobile
Where we confirmed these
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-08-20 | 'Offside Wallet Theft Factory' (Socket Threat Research): 13 Firefox add-ons ran modified Rabby builds that sent keyring data to attackers before it was encrypted. Others captured seed phrases. Names included 'RABB-Wallet Web3 & EVM', 'Rabb-Wallet CryptoPortfolio' and 'Rabbit For Desktop'. Mozilla signing records show activity from March to August 2026 (third-party report; no extension IDs published in the coverage). | losses not reported | source | |
| 2025-08-08 | 'GreedyBear' campaign: 150+ malicious Firefox add-ons impersonating Rabby, MetaMask, TronLink and Exodus stole more than $1M (Koi Security, via The Hacker News). | more than $1M | not refunded | source |