Rabby Wallet

Is Rabby Wallet safe?

Yes, for a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary, and it does more than most to stop you signing something harmful. Rabby, built by the team behind DeBank, simulates every transaction and shows what will leave and arrive in your wallet before you confirm. Its code is open under the MIT licence and it publishes fresh audits every year. We score it 81/100, a B.

The catch is a 2022 exploit of Rabby's own swap contract, which cost users about $200,000 before Rabby paid them back. And like any browser or phone wallet, Rabby keeps your keys on a device that also browses the web.

What happened in the 2022 Rabby Swap exploit?

Rabby added an in-wallet swap feature on 14 September 2022. To swap, users approved Rabby's swap contract to spend their tokens. About a month later, on 11 October, an attacker found that the contract would carry out any instruction a caller passed to it without checking it. They used it to tell token contracts to send them whatever users had approved, taking 114 ETH and 179 BNB, about $200,000, and moving the funds through Tornado Cash, according to Revoke.cash. The contract had been audited by PeckShield, which missed the flaw.

Rabby quickly warned users to revoke all approvals to Rabby Swap on every chain and said wallets that had never used Swap were safe. It then repaid affected users from its insurance fund. What it did not do was pause or replace the old contract, which had been deployed on 19 chains. Any approval still pointing at it can be drained.

This was a loss caused by the vendor's own code, so it counts against the security record. It was limited, repaid and openly handled, which puts Rabby in the 70–89 band at 77. We found no other loss traced to Rabby's code in five years of use.

How Rabby protects you before you sign

This is where Rabby stands out. Before you confirm a transaction, it runs a simulation and shows the expected balance changes, so a "claim airdrop" button that actually sends away your tokens looks like what it is. Its security engine checks the contract, the receiving address and the type of approval, and flags phishing addresses, risky contracts and risky approvals. If the simulation fails or a chain is not supported, Rabby says so instead of showing nothing.

A built-in approvals page lists every token allowance across chains and lets you revoke them. That matters because drainersDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary mostly work through old approvals.

The limits are the same as for every software wallet. You can still confirm a flagged request, drainer crews test their contracts against these checks, and the warnings come from DeBank's servers, so they can be briefly unavailable. Rabby cannot show the request on a separate trusted screen; only a hardware wallet can do that. We score scam protection 88.

How Rabby stores your keys

Rabby creates or imports a standard seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary or private key and stores it on your device, encrypted with your password. Neither Rabby nor DeBank holds a copy, and you can export the seed and use it in any EVM wallet. That is the normal model for a hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary and earns 80; our rubric caps software wallets at 84.

The biggest upgrade is a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary. Rabby connects to Ledger, Trezor and other devices, so the key stays on the device and every transaction needs a button press there, while you still get Rabby's simulation.

Is Rabby open source and audited?

The browser extension is on GitHub under the MIT licence, with one extra line reserving the Rabby name and logo. The repos hold audit reports from Least Authority (December 2024 and September 2025) and SlowMist (December 2024, August 2025 and August 2026, the last also covering the iOS and Android apps). That is more published audit work than most wallets we score, including MetaMask.

Three gaps keep transparency at 82. The mobile repo is public but has no licence file. We found no verified reproducible build. And the bug bounty is a reporting email on the website, with no published scope or rewards.

Who runs Rabby, and what does it see?

Rabby's terms and app store listings name OPCODE LABS PTE. LTD., a Singapore company, as the operator. We found no enforcement action and no customer-data leak. There is no account or ID check, and the App Store label lists only usage data that is not linked to you. The trade-off for simulation and portfolio views is that your addresses and pending transactions go to DeBank's servers.

Fake Rabby apps have appeared in app stores. Those are impersonation scams outside Rabby's own channels, so they do not count against its record, but they are a real risk if you search the store instead of following the link from rabby.io.

How to stay safe with Rabby

1. Install only from the links on rabby.io. Check the developer name, OPCODE LABS PTE. LTD., on mobile.
2. Read the simulation every time. If the balance change is not what the site promised, cancel.
3. Revoke old approvals in the approvals page, and any left from Rabby Swap in 2022.
4. Write the seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on paper or metal; never type it into a website or a support chat.
5. Keep savings on a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary connected to Rabby, not in the extension itself.

How we scored it

Scam protection (88) is Rabby's strongest factor: simulation and risk checks run on every signature by default. Transparency (82) is close behind thanks to open code and a run of published audits. The security record (77) is the weakest, because the 2022 swap exploit came from Rabby's own contract, even though users were repaid. That puts Rabby level with MetaMask, which has a cleaner record but a more restrictive licence.