MetaMask

Is MetaMask safe?

For what it is, a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary that lives in your browser or phone, yes. MetaMask has been used by tens of millions of people (Consensys reported more than 30 million monthly users in early 2024) and we found no case of users losing funds to a bug in its own code or a compromised official release. We score it 81/100, a B.

The catch is that MetaMask is where most drainerDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary losses happen, simply because it is where most Ethereum users sign things. The wallet cannot stop you from approving a malicious contract if you insist, and it cannot protect a recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary you have typed into a fake website. Since February 2024 it does try much harder to warn you first.

Has MetaMask been hacked?

The wallet itself has a clean record, with one open question.

• June 2022, the "Demonic" flaw. Security firm Halborn found that the browser extension could leave the recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary readable on an unencrypted hard drive if you had used the "show" checkbox during import. MetaMask patched it, paid Halborn a $50,000 bounty and said there was no evidence it had been exploited.
• 2022–2023, the mystery drains. A wave of thefts from old Ethereum wallets was at first reported as a MetaMask bug. MetaMask rejected that, pointing out the stolen addresses came from many different wallets and blockchains. No link to its code was shown.
• 30 September 2026, infrastructure incident. MetaMask said it was responding to "an ongoing security incident affecting part of our infrastructure" and began exiting the Ethereum validators it runs for staking clients, including in Lido, as a precaution. On 1 October it said there was "no indication that MetaMask wallets or customer funds have been affected". Its staking is non-custodialSelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary and it says it does not hold clients' withdrawal keys.

That last event keeps the security score at 88 rather than in the 90s until a post-mortem is out. If it turns out wallet users lost money, the score will drop.

How MetaMask stores your keys

MetaMask creates a standard 12-word secret recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on your device and keeps it in a vault encrypted with your password. Consensys never sees the phrase and cannot reset it for you. The phrase works in almost any other EVM wallet, so you can leave MetaMask at any time.

This is the normal model for a software wallet and earns 80 on key management. Our rubric caps software wallets at 84 here, because a key on an internet-connected device can be reached by malware. It is not a hardware wallet: the key sits on a computer or phone that also browses the web. MetaMask can pair with Ledger and Trezor devices, and then the key stays on the device and every transaction needs a button press there. That is the single biggest upgrade most users can make.

Since 30 June 2026 the app also offers Money Account, which puts stablecoins (as mUSD) to work in outside DeFi protocols for a variable yield of up to 4% and adds a card for spending. MetaMask calls it self-custodialSelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary, but its own terms warn that smart-contract and protocol risk could mean "partial or total loss of funds" and that withdrawals may be delayed. It is not offered in the UK. Like swaps and staking, it sits outside our wallet score: it adds the risk of every protocol your money is lent to.

Does MetaMask protect you from drainers?

Better than it did. Since early 2024 MetaMask's security alerts, built with the security firm Blockaid, check each transaction and signature request before you confirm and show a red "deceptive request" warning if it looks like a drainerDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary. They are on by default on Ethereum, Linea, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche and Base among others, and a phishing-site blocklist runs alongside.

Two limits matter. You can still press confirm on a flagged request, and drainer crews test their contracts against these filters. And because MetaMask runs on the same machine as your browser, it cannot offer the clear signing on a separate trusted screen that a good hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary can.

Is MetaMask open source?

Not in the strict sense. Every line is public on GitHub, but the Consensys licence allows only non-commercial reuse. Anyone can read the code; competitors cannot fork it for profit.

On the plus side, MetaMask runs a HackerOne bug bounty (launched June 2022 with rewards of $1,000 to $50,000) and builds its extension with LavaMoat, its own tool that sandboxes third-party packages so a poisoned npm dependency cannot easily reach your keys. That matters: an npm supply-chain attack in late 2025 led to the hijacked Trust Wallet extension release. What we could not find is a recent, published third-party audit of the core wallet, or a verified reproducible build. WalletScrutiny lists the Android app as ready for verification but not yet verified. So transparency scores 68.

What does Consensys know about you?

No account, no ID check. The main data point is the RPC connection. By default MetaMask sends your requests through Infura, also owned by Consensys. After a privacy backlash in late 2022, Consensys said it logs IP address and wallet address only when you send a transaction, does not store them together, and was cutting retention to about 7 days. You can switch to another node provider in network settings.

The SEC sued Consensys in June 2024, claiming MetaMask Swaps and Staking made it an unregistered broker. In February 2025 the agency agreed to drop the case, and Consensys said there would be no fine. Neither the case nor the swaps business touched how the wallet holds keys.

On 9 September 2026 Consensys Software Inc. said it would split in two. The company that makes the wallet is being renamed MetaMask, with Joe Lubin as chief executive, while its protocols and institutional business (Linea, the Besu client) moves to a new company that keeps the Consensys name. The announcement did not say which side keeps Infura, so check the privacy notice for the company that runs your RPC connection.

How to stay safe with MetaMask

1. Write the recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on paper or metal. Never type it into a website, a "support" chat or a cloud note. MetaMask will never ask for it.
2. Treat a red security alert as a stop sign. If a site insists you disable or ignore it, close the tab.
3. Review and revoke old token approvals regularly, especially unlimited ones.
4. Keep a small spending balance in MetaMask and move savings to a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary, or connect one directly.
5. Install the extension only from the link on metamask.io; fake MetaMask extensions and apps appear in stores regularly.

How we scored it

Security record (88) and scam protection (85) are MetaMask's strongest factors: no losses traced to its own code, and drainerDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary warnings on by default. Transparency (68) is the weakest, because the licence is not truly open and the core wallet has no recent public audit. Compared with Trust Wallet, MetaMask has never shipped a release that cost users money. Trezor scores higher because its keys stay on a dedicated device and its code is fully open source. Ledger also keeps keys safer, but scores a little lower overall because of its 2023 Connect Kit supply-chain attack and customer-data leaks.