Is Uniswap web app + Uniswap Wallet safe to connect?
Self-custody wallet · Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain, Avalanche, other EVM networks. Checked 2026-10-28; every line links its source.
Worst case: Uniswap is self-custody: a leaked recovery phrase, or one malicious approval or Permit2 signature on a fake Uniswap site (often reached through search ads or fake UNI airdrops), lets an attacker drain the approved tokens or the whole wallet. Uniswap Labs can't reverse it.
Safe setup in 3 steps
- Install only from wallet.uniswap.org: App Store id6443944476, Google Play com.uniswap.mobile, Chrome Web Store nnpmfplkfogfpmcngplhnbdnnilmcdcg (Chrome only), and swap only at app.uniswap.org. Uniswap Labs never asks you to install software or send funds, and supports users only by email at support@uniswap.org.
- Keep your recovery phrase offline ('never in your notes app, email, or Google Docs', per Uniswap's security post) and never show it to anyone. Ignore 'airdrop' tokens that appear in your wallet and links promising free UNI.
- Read every signature: Uniswap warns that 'Any onchain token approval to the Permit2 contract is vulnerable to a malicious signature approval', while its own app's permits last only 30 days. Revoke approvals you no longer need with your block explorer's approval checker, as Uniswap's help center explains.
What it can do with your money
| Who holds the keys | You hold the keys Self-custody. The App Store listing says the recovery phrase is stored in the iPhone secure enclave so it 'never leaves your device without permission', with an optional encrypted iCloud backup. Uniswap says: 'Never share your private keys or recovery phrase with anyone.' The web app holds nothing: you connect your own wallet to it. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign every send and swap yourself, to any address. A token approval or Permit2 signature also lets the approved contract move those tokens. source |
| Swaps and third parties | Swaps go through the on-chain Uniswap protocol. 'As of December 27, 2025 Uniswap Labs does not charge interface fees'; network fees and pool fees still apply, and the protocol fee is set by Uniswap governance. Uniswap Labs screens addresses with third-party blockchain-analytics providers and can block a wallet from using the Uniswap web app or Uniswap Wallet (appeals to compliance@uniswap.org, https://support.uniswap.org/hc/en-us/articles/8671777747597-Address-Screening-Guide). That guide does not say funds are frozen. Revoking an approval is different from disconnecting from a dapp. source |
Official links
- Website:
uniswap.org - Website:
app.uniswap.org - Website:
wallet.uniswap.org - X:
@Uniswap - GitHub:
github.com/Uniswap - GitHub:
github.com/Uniswap/interface - App:
https://chromewebstore.google.com/detail/uniswap-extension/nnpmfplkfogfpmcngplhnbdnnilmcdcg - App:
https://apps.apple.com/app/id6443944476 - App:
https://play.google.com/store/apps/details?id=com.uniswap.mobile
Where we confirmed these
Known fakes
uniswaplp.com· 2022-07-13 sourceapp.uniswapweb-launch.org· 2024-12-16 sourceairdrop-uniswapp.com· 2024-12-16 sourceunlchalindefi.com· 2024-10-15 source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-05-25 | A sponsored Google ad led to a fake Uniswap clone site that drained wallets when they connected; at least ~$400,000 was stolen (community alert by b-block, reported by ForkLog). Security Alliance (SEAL) separately reported blocking 356+ malicious ad links between March 13 and 30 (third-party report; no domain named). | at least ~$400,000 | not recovered (none reported) | source |
| 2025-01-13 | ScaleBit (a BitsLab subsidiary) said a flaw in the Uniswap Wallet mobile app let anyone holding an unlocked phone bypass the wallet's authentication and read the recovery phrase in under three minutes. Cointelegraph could not verify it, and Uniswap did not comment (third-party report). | no losses reported; no fix confirmed in the coverage | source | |
| 2024-10-15 | Google search ads showed the real Unichain URL but sent users to a fake Unichain site (unlchalindefi.com) that pushed wallet transactions; flagged by Scam Sniffer (third-party report). | site taken down quickly; losses unknown | source | |
| 2022-11-17 | The Uniswap web app loaded as a blank page for some users for more than four hours; Uniswap blamed a Cloudflare routing problem and pointed users to its IPFS link. | no impact on funds reported | source | |
| 2022-07-11 | Fake 'UniswapLP' airdrop: a token sent to ~73,399 addresses pointed to uniswaplp.com, where 'claiming' signed a setApprovalForAll that handed over Uniswap V3 liquidity-position NFTs. About 7,574 ETH was taken and 7,500 ETH sent to Tornado Cash. Uniswap Labs said 'there was no exploit' of the protocol. | ~$8M (about 7,574 ETH) | not recovered | source |