cryptocardtools
EN
Cash-out calculator

Is MetaMask safe?

Verified September 29, 2026software wallet

Short answer

MetaMask scores 76/100 (Good). It is a self-custody software wallet made by Consensys Software Inc. (United States). Its code is partly public, the latest independent audit was by OtterSec in October 2024, and 2 security incidents are on record, 1 with user losses.

How MetaMask scores

Safety score

76/100

Good

Write the recovery phrase on paper or metal, never in a photo or cloud note. Install wallets only from the maker’s own site or the official app store.

How the score works

Code transparency15/25

Some of the code is public, but not all of it is open source.

Independent audits20/20

Latest published audit: OtterSec, October 2024.

Key storage12/20

Keys are kept encrypted on your phone or computer, so malware on that device is the main risk.

Incident record19/25

2 incidents on record, 0 in the last three years, 1 with user losses. Recent incidents and losses weigh more.

Company10/10

Run by Consensys Software Inc., a named company in United States.

MetaMask at a glance

  • Type: software wallet
  • Available on: browser extension, iOS, Android
  • Key storage: Recovery phrase. 12-word Secret Recovery Phrase generated and stored encrypted on the device. Optional social login (Google, Apple or Telegram plus a password) backs up the SRP with Shamir-split key shares in a 2-of-2 setup; hardware wallets (Ledger, Trezor, Keystone, Lattice, AirGap, NGRAVE) can hold keys instead.
  • Networks: EVM chains, Bitcoin and Solana. All EVM networks (preloaded plus custom RPC). Solana and Bitcoin native through multichain accounts (Extension 13.5 / Mobile 7.57+); TRON supported by default. No total network count published.
  • Company: Consensys Software Inc. (United States)
  • Partly open: The full source is public, but under a Consensys licence that restricts commercial use rather than an OSI-approved open-source licence. GitHub
  • App ratings: App Store: 4.7 from 76,310 ratings; Google Play: 4.5 from 487,984 ratings

Has MetaMask been hacked?

  • June 2022 · Vulnerability
    Halborn disclosed CVE-2022-32969 ('Demonic'): browsers' session-restore could save a Secret Recovery Phrase typed into the import field to disk unencrypted. Fixed in MetaMask 10.11.3; no known exploitation; MetaMask paid a $50,000 bounty. Source
  • April 2022 · Vulnerability User funds lost
    MetaMask warned that iOS iCloud app-data backup copies the password-encrypted vault by default after a user lost about $655,000 when an Apple ID phishing attack exposed the backup and a weak password. Source

MetaMask security audits

  • OtterSec, October 2024: LavaMoat Webpack plugin
  • Cure53, April 2024: Key-Tree (key derivation library)
  • Cure53, March 2024: Signing Snap and codebase
  • Least Authority, September 2023: Snaps API
  • Least Authority, September 2023: Snaps extension integration
  • Cure53, February 2023: Key-Tree (key derivation library)
  • Least Authority, July 2022: Extension seed phrase implementation (KeyringController, eth-hd-keyring, eth-simple-keyring)
  • Least Authority, March 2020: LavaMoat plugin system
  • Least Authority, November 2019: Permissions system and CapNode
  • Least Authority, April 2019: Mobile app
  • Cure53, August 2017: Extension penetration test

Crypto cards that work with MetaMask

These cards spend straight from MetaMask or come from the same maker, so your funds stay in self-custody until you pay.

Other wallet safety checks

Frequently asked questions

Is MetaMask safe?
MetaMask scores 76/100 (Good). It is a self-custody software wallet made by Consensys Software Inc. (United States). Its code is partly public, the latest independent audit was by OtterSec in October 2024, and 2 security incidents are on record, 1 with user losses.
Has MetaMask ever been hacked?
2 security incidents involving MetaMask are on record, the latest in June 2022. 1 caused user losses.
Is MetaMask open source?
Some of the code is public, but not all of it is open source. The full source is public, but under a Consensys licence that restricts commercial use rather than an OSI-approved open-source licence.
Is there a crypto card for MetaMask?
Yes. MetaMask Card spends from MetaMask or comes from the same maker.

Sources

  1. MetaMask home · checked September 29, 2026
  2. MetaMask download · checked September 29, 2026
  3. MetaMask Terms of Use (June 2026) · checked September 29, 2026
  4. MetaMask Security · checked September 29, 2026
  5. MetaMask Security Program (audits and bug bounty) · checked September 29, 2026
  6. Least Authority seed phrase audit report · checked September 29, 2026
  7. metamask-extension LICENSE · checked September 29, 2026
  8. What are multichain accounts in MetaMask? · checked September 29, 2026
  9. Navigate TRON in MetaMask · checked September 29, 2026
  10. How does social login with MetaMask work? · checked September 29, 2026
  11. Halborn: Demonic vulnerability disclosure · checked September 29, 2026
  12. BleepingComputer: Hackers steal $655K after picking MetaMask seed from iCloud backup · checked September 29, 2026
  13. MetaMask Card (repo card YAML source) · checked September 29, 2026
  14. App Store listing · checked September 29, 2026
  15. Google Play listing · checked September 29, 2026