Rainbow

Is Rainbow Wallet safe?

Yes, as hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary go. Rainbow keeps your keys on your own phone or computer, its code is open source under GPL-3.0, and it simulates what a transaction will do before you sign it. We found no loss traced to Rainbow's own code since the iOS app launched in 2019. We score it 79/100, a B.

What keeps it from scoring higher is outside review. Rainbow publishes no third-party audit and runs no public bug bounty that we could find, so its open code is open in principle but not visibly tested. And like every software wallet, its keys sit on a device that also browses the web.

How Rainbow stores your keys

When you create a wallet, Rainbow generates a standard seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on your device and stores it in the phone's keychain or in the extension's encrypted storage. You can export it and use it in any Ethereum wallet, and import seeds from MetaMask or elsewhere.

The feature to understand is cloud backup. Rainbow offers to save your wallet to iCloud or Google Drive, and its open code shows the backup is encrypted with AES using a password you choose before it leaves the phone. That protects you against losing a phone, and it means Apple or Google hold only an encrypted file. But anyone who gets into your cloud account can try to guess that password offline, so a short or reused one turns a convenience into a risk. Key security scores 78; our rubric caps software wallets at 84.

For more than spending money, connect a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary. The mobile app works with Ledger over Bluetooth, and the extension with Ledger and Trezor.

What Rainbow shows you before you sign

Both the app and the extension run a simulation of each transaction and signature request through Rainbow's own servers and show the tokens that would leave and arrive. If a site is flagged as malicious, Rainbow shows a warning on the request. Flashbots Protect is built in for Ethereum transactions, keeping them out of the public mempool and away from front-running bots.

This puts Rainbow close to Rabby on scam protection, at 84. The usual limits apply: you can still confirm a flagged request, drainerDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary kits are built to slip past checks, and a phone screen is not a trusted display. We did not find a documented approvals manager like Rabby's, so use Revoke.cash to clear old token approvals.

Open source, but no published audit

The mobile app and the browser extension are on GitHub under GPL-3.0, a full open-source licence. The extension's README describes a Manifest V3 design with a content security policy that blocks connections to unlisted domains, and its build runs under LavaMoat, MetaMask's tool for containing malicious dependencies. Those are serious supply-chain defences.

What we could not find is evidence of outside testing. Rainbow's security page talks about open code and an experienced team but names no audit firm, we found no audit report in its repos, and there is no bug bounty on Immunefi or HackerOne or a published disclosure policy. WalletScrutiny, which checks reproducible builds, covers mainly Bitcoin wallets and has no Rainbow page. Transparency scores 65, the weakest factor.

The Socket exploit and the token

On 16 January 2024 an attacker exploited Socket, the bridging protocol Rainbow used, and drained several million dollars from wallets that had approved Socket's contract, according to Unchained. Rainbow called it "industry-wide" and paused bridging in the app and extension. The bug was in Socket's contract, not Rainbow's code, so it does not lower Rainbow's security record, but users who bridged through Rainbow should check old approvals.

Rainbow announced its RNBW token in September 2025, after a points programme that rewarded wallet activity, and the token began trading in February 2026. We have no view on the token. Its practical effect on safety is more fake airdrop sites and fake support accounts aimed at Rainbow users. Rainbow has also announced perpetual futures through Hyperliquid; money used there sits on Hyperliquid, outside this wallet score.

How to stay safe with Rainbow

1. Install from rainbow.me or the official store listings from Rainbow Studio, Inc.
2. If you use cloud backup, give it a long, unique password, and also write the seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on paper or metal.
3. Read the simulation every time; if the tokens leaving are not what the site promised, cancel.
4. Ignore airdrop or claim links in replies and DMs, and never sign a token approval to "claim" something.
5. Keep savings on a Ledger or Trezor connected to Rainbow, not in the app itself.

How we scored it

Security record (85) and scam protection (84) are Rainbow's strengths: no loss traced to its code in seven years, plus simulation and malicious-site warnings by default. Transparency (65) is the weakest factor, because open code without published audits or a bounty gives little outside assurance. Rainbow scores just below Rabby and MetaMask, which both publish more security review, and level with BlueWallet.