Is Rabby Wallet safe?
Short answer
Rabby Wallet scores 73/100 (Good). It is a self-custody software wallet made by OPCODE LABS PTE. LTD. (Singapore). Its code is partly public, the latest independent audit was by SlowMist in August 2026, and 3 security incidents are on record, 1 with user losses.
How Rabby Wallet scores
Safety score
73/100
Good
Write the recovery phrase on paper or metal, never in a photo or cloud note. Install wallets only from the maker’s own site or the official app store.
Code transparency15/25
Some of the code is public, but not all of it is open source.
Independent audits20/20
Latest published audit: SlowMist, August 2026.
Key storage12/20
Keys are kept encrypted on your phone or computer, so malware on that device is the main risk.
Incident record16/25
3 incidents on record, 2 in the last three years, 1 with user losses. Recent incidents and losses weigh more.
Company10/10
Run by OPCODE LABS PTE. LTD., a named company in Singapore.
Rabby Wallet at a glance
- Type: software wallet
- Available on: browser extension, iOS, Android, desktop
- Key storage: Recovery phrase. 12-word seed phrase (or imported private key) held locally; a user password unlocks the extension and encrypts local data. Rabby does not store the phrase or password. Hardware wallets (e.g. Ledger, Trezor, Keystone, OneKey) and Gnosis Safe can be connected instead.
- Networks: EVM chains. EVM-only. Help centre says it supports all EVM-compatible networks, with '80+' natively integrated networks (another help article says 'over 90'); Bitcoin, Solana and Tron are explicitly not supported. Custom EVM networks and testnets can be added. No exact count published.
- Company: OPCODE LABS PTE. LTD. (Singapore)
- Partly open: The extension and desktop apps are MIT-licensed. The mobile app source is public without a top-level licence, so it is source-available rather than open source. GitHub
- App ratings: App Store: 3.5 from 1,283 ratings; Google Play: 4.8 from 7,488 ratings
Has Rabby Wallet been hacked?
- August 2026 · Phishing
Socket researchers reported a Firefox add-on campaign ('Offside Wallet Theft Factory', active since March 2026) in which 13 modified Rabby Wallet builds exfiltrated keyrings before local encryption. The official Rabby extension is not on Firefox; Rabby's help centre says any Firefox 'Rabby' add-on is fake. Source - August 2026 · Vulnerability
Researcher V12 publicly disclosed a silent signature-extraction flaw in the extension: a malicious site could queue a hidden signing request that was approved when the user unlocked the wallet. Rabby said it had fixed it in an update released 11 Aug 2026, that it only triggered with the 10-minute auto-lock setting on a connected malicious site, that mobile was unaffected, and that no exploitation was detected. Source - October 2022 · Breach User funds lost
Rabby Swap router contract (launched Sept 2022) was exploited through an arbitrary external call, draining tokens from users who had approved it; about $200,000 stolen. Rabby told users to revoke all Rabby Swap approvals on all chains. Source
Rabby Wallet security audits
- SlowMist, August 2026: Browser extension
- SlowMist, August 2026: Mobile wallet (Android)
- SlowMist, August 2026: Mobile wallet (iOS)
- Least Authority, September 2025: Browser extension
- Least Authority, September 2025: Mobile application
- SlowMist, August 2025: Browser extension
- SlowMist, August 2025: Mobile wallet (Android)
- SlowMist, August 2025: Mobile wallet (iOS)
- SlowMist, December 2024: Browser extension
- Least Authority, December 2024: Browser extension
- Cure53, October 2024: Mobile wallet pentest and code audit (iOS and Android)
- Least Authority, October 2024: Mobile app (rabby-mobile repo)
- SlowMist, July 2024: Mobile wallet (Android) v0.2.0
- SlowMist, July 2024: Mobile wallet (iOS) v0.2.0
- SlowMist, September 2023: Desktop app
- SlowMist, July 2023: Browser extension (v0.91.0)
- SlowMist, March 2022: Browser extension
- SlowMist, June 2021: Chrome extension white-box penetration test
Crypto cards that work with Rabby Wallet
No card in our database spends directly from Rabby Wallet. These self-custody cards work with a wallet you control:
Other wallet safety checks
Frequently asked questions
Is Rabby Wallet safe?
Rabby Wallet scores 73/100 (Good). It is a self-custody software wallet made by OPCODE LABS PTE. LTD. (Singapore). Its code is partly public, the latest independent audit was by SlowMist in August 2026, and 3 security incidents are on record, 1 with user losses.
Has Rabby Wallet ever been hacked?
3 security incidents involving Rabby Wallet are on record, the latest in August 2026. 1 caused user losses.
Is Rabby Wallet open source?
Some of the code is public, but not all of it is open source. The extension and desktop apps are MIT-licensed. The mobile app source is public without a top-level licence, so it is source-available rather than open source.
Is there a crypto card for Rabby Wallet?
No card in our database spends directly from Rabby Wallet. A self-custody card such as the MetaMask Card can be funded from any wallet you control.
Sources
- Rabby Wallet home (download links, security links) · checked September 29, 2026
- Rabby Terms of Use · checked September 29, 2026
- RabbyHub/Rabby (extension repo, LICENSE, audits folder) · checked September 29, 2026
- RabbyHub/rabby-mobile (mobile repo, audits folder) · checked September 29, 2026
- RabbyHub/RabbyDesktop (desktop repo, LICENSE, SlowMist report) · checked September 29, 2026
- Rabby help: What is Rabby Wallet? · checked September 29, 2026
- Rabby help: Supported networks & tokens · checked September 29, 2026
- Rabby help: How secure is Rabby Wallet? · checked September 29, 2026
- Rabby help: Getting started with Rabby extension · checked September 29, 2026
- Rabby help: How to back up seed phrase or private key · checked September 29, 2026
- Rabby Wallet on X: August 2026 vulnerability statement · checked September 29, 2026
- PANews: Rabby Wallet vulnerability fixed and update released (quotes Rabby's X post) · checked September 29, 2026
- The Hacker News: 40 malicious Firefox extensions pose as Web3 products · checked September 29, 2026
- The Block: Rabby Wallet exploit prompts users to revoke access · checked September 29, 2026
- Halborn: A 'hat trick' of DeFi hacks (Rabby Swap ~$200,000) · checked September 29, 2026
- Rabby Wallet on App Store · checked September 29, 2026
- Rabby Wallet on Google Play · checked September 29, 2026