MetaMask Reseña
Self-custody wallet for Ethereum apps, now with native Solana, Bitcoin and Tron, and a 0.875% swap fee
Link to the company's own site · doesn't affect score
De un vistazo
MetaMask is a self-custodial wallet built by Consensys Software Inc. of Fort Worth, Texas, which announced on 9 September 2026 that it will rename itself MetaMask and move its protocol business into a separate company called Consensys. Joe Lubin is MetaMask's chairman and CEO, and the separation is expected by the end of 2026. Launched in 2016 as a browser extension, MetaMask now runs on Chrome, Firefox, Brave, Edge and Opera and on iOS and Android. It supports any EVM network you add by RPC plus native Solana, Bitcoin and Tron accounts, with Stellar rolling out in 2026, and MetaMask says it has more than 100 million downloads. It charges 0.875% on swaps and bridges and 1% on fiat buys and sells. Its code is public but source-available, with reuse limited by its licences, and its HackerOne bug bounty (up to $50,000 for critical wallet bugs) was not accepting new submissions as of 16 October 2026. On 30 September 2026 MetaMask disclosed a security incident affecting part of its infrastructure and began exiting the Ethereum validators run by MetaMask Staking as a precaution; it says there is no indication that wallets or customer funds were affected.
People who use Ethereum and layer 2 apps and want one wallet that also holds SOL and BTC, with security alerts on by default and Ledger or Trezor support for EVM balances.
You swap often and mind a 0.875% fee (Rabby lists 0.25%), you want SOL or BTC on a hardware wallet inside MetaMask, you need Bitcoin Taproot or legacy addresses or any Cardano support, or you want wallet code you can freely reuse in a commercial product.
Datos rápidos
- Wallet type
- browser extension
- Custody
- self
- Open source
- No
- Built-in swap
- Yes
- NFT support
- Yes
Desglose de puntuación Skrumble
Lee nuestra metodología de puntuación completa.
A favor
- Works with a very wide range of Ethereum apps, and one multichain account also holds Solana and Bitcoin addresses, with native Tron support too
- Security alerts, balance-change previews and free Smart Transactions with MEV protection, all on by default
- Hardware-wallet support for Ledger, Trezor, Lattice and QR wallets such as Keystone and NGRAVE ZERO on EVM accounts
- Audits since 2017 by Cure53, Least Authority, OtterSec and others, and no large exploit of the wallet code in the sources we checked
- Sell to a bank account in the app through Transak, MoonPay, Sardine or Banxa in the US, the UK and parts of Europe
En contra
- 0.875% fee on swaps and bridges and 1% on fiat buys and sells, while Rabby lists 0.25% on swaps
- Source-available code: the extension licence allows only non-commercial reuse, and the mobile code is licensed for inspection only
- Hardware-wallet accounts cover EVM networks only, Bitcoin accounts are Native SegWit only, and Solana accounts can only use Infura's RPC
- HackerOne bug bounty closed to new submissions as of October 2026, and no root cause published yet for the September 2026 infrastructure incident
- Perps, prediction markets and tokenized stocks are blocked in the US and UK, and new US card sign-ups have been paused since June 2026
MetaMask review: the short answer
MetaMask is a safe, self-custodial wallet if you avoid the scams aimed at its users. No source we checked shows a large exploit of the wallet code itself.
The catch is cost. MetaMask takes 0.875% on swaps and bridges and 1% on fiat buys and sells.
If you last looked at MetaMask before 2025, a lot has changed. It is not "EVM-only" any more: it now handles Solana, Bitcoin and Tron natively, with Stellar rolling out in 2026. Its code is public but not open source in the usual sense. We rechecked every fact in this MetaMask review against MetaMask's help center, SEC records, its licences and security research on 16 October 2026.
- Good fit: you use Ethereum apps and layer 2 networks, you want one wallet that also holds SOL and BTC, and you will pair it with a hardware wallet for larger balances.
- Look elsewhere: you swap often and want lower fees, you want truly open-source code, or you need Solana or Bitcoin on a hardware wallet inside MetaMask.
What is MetaMask, and who owns it?
MetaMask is a self-custody wallet made by Consensys Software Inc., based in Fort Worth, Texas. Ethereum co-founder Joe Lubin is MetaMask's chairman and CEO.
The company itself is changing. On 9 September 2026 it announced it would rename itself MetaMask and spin its protocol business into a separate company.
The protocol side (Linea and the Besu and Teku clients) will move to the new company, which keeps the Consensys name; the separation is expected by the end of 2026. MetaMask itself launched in July 2016 as a browser extension, built by Aaron Davis and Dan Finlay. Finlay left the company in April 2026.
The company has a regulatory history worth knowing. In June 2024 the SEC sued Consensys, alleging MetaMask's swaps and staking services made it an unregistered broker. The case was dismissed with prejudice on 27 March 2025, with no finding on the merits. Consensys has reportedly explored a US IPO. No filing or date has been made public.
MetaMask says it has more than 100 million downloads across about 190 countries. That is a company claim, and we found no official monthly-user figure for 2026.
Which blockchains does MetaMask support in 2026?
MetaMask supports any EVM network you can add by RPC, plus native Solana, Bitcoin and Tron accounts, with Stellar rolling out in 2026. Other chains, such as Cosmos, Polkadot, Sui and XRP, are reachable through third-party Snaps.
| Chain | Status | Limits |
|---|---|---|
| Ethereum and EVM networks | Supported since launch; add any network by RPC | Default RPC is Infura, which logs some data (see below) |
| Solana | Native since May 2025 | Not available on hardware wallet accounts; no private-key import |
| Bitcoin | Native since December 2025 | Native SegWit addresses only; no private-key import |
| Tron | Native since January 2026 | Send USDT on Tron and stake TRX |
| Stellar | Rolling out in 2026; may not be enabled for every user yet | 1 XLM activation reserve plus 0.5 XLM per trustline |
| Cosmos, Polkadot, Sui, XRP and others | Through Snaps | Snaps are generally built by third parties, not MetaMask; there is no Cardano support |
Since October 2025, one "multichain account" holds an EVM, a Solana and a Bitcoin address together. Hardware-wallet accounts cover EVM networks only.
Is MetaMask safe?
Yes, for careful users. MetaMask is self-custodial, warns you about risky transactions before you sign, and has a long audit history.
None of the thefts we found has been traced to a flaw in MetaMask's wallet code. Those with a known cause came from phishing, fake extensions or signed approvals. The September 2026 incident hit MetaMask's own infrastructure, and MetaMask says there is no indication that wallets were affected.
How MetaMask holds your keys
MetaMask creates a secret recovery phrase on your device. It cannot recover it for you. An optional social login (Google, Apple or Telegram) stores an encrypted backup of your phrase, with the key split across several key-share holders. MetaMask says no single party except you can rebuild it. That part is reassuring. MetaMask says to guard that password as carefully as the phrase itself, because recovery fails without the right password.
The newer Money Account works differently. It is self-custodial and secured by your phrase, but it has no visible address, you cannot export it to another wallet, and outside DeFi platforms put the deposits to work. Read its terms first.
Is MetaMask open source?
Not in the usual sense. The extension's code is public on GitHub under a custom Consensys licence. You can reuse it freely only for non-commercial purposes, which includes derivative products with up to 10,000 monthly active users. The mobile app's licence only lets you inspect and study the code. "Source-available" is the accurate term.
Audits, bug bounty and security features
| Check | What we found (October 2026) |
|---|---|
| Audits | Cure53 (audits and penetration tests, 2017 to 2024), Least Authority (mobile app 2019, Snaps 2023 and others), Consensys Diligence (delegation framework 2024, mUSD 2025), OtterSec (2024); the latest wallet-code penetration test listed is Cure53, March 2024 |
| Bug bounty | HackerOne since June 2022, up to $50,000 for critical wallet bugs; as of 16 October 2026 the program was not accepting new submissions, and we found no public reason for the pause |
| Transaction checks | Security alerts (with Blockaid among its partners) and balance-change previews, on by default |
| Phishing defences | A public domain blocklist, address-poisoning warnings and protection from the Wallet Guard engine MetaMask acquired in 2024 |
| MEV protection | Smart Transactions, free and on by default on networks including Ethereum, Base, Arbitrum and BNB Chain |
| Optional cover | Transaction Shield, $9.99 a month (extension only), reimburses up to $10,000 a month in mUSD for covered transactions; it excludes a stolen recovery phrase |
One privacy point: under a policy Consensys disclosed in late 2022, MetaMask's default RPC provider, Infura, collects your IP and wallet address when you send transactions. Consensys said it keeps this for a week and never sells it. You can switch to another RPC for EVM networks. Solana accounts can't switch.
The main MetaMask security incidents we found
| Date | What happened | Loss |
|---|---|---|
| April 2022 | A user was phished through their Apple ID; MetaMask then warned that iCloud app-data backups include the encrypted wallet vault | About $650,000 (one user, per press reports) |
| June 2022 | "Demonic" flaw (CVE-2022-32969): browsers' session restore could save a typed recovery phrase to disk; fixed in version 10.11.3 | None quantified |
| May 2025 | A drainer abused MetaMask's legitimate EIP-7702 batching feature to get a victim to sign approvals; security firm GoPlus said it was not a MetaMask vulnerability | Over $146,000 (one user) |
| August 2025 | About 150 fake wallet extensions on Firefox, MetaMask among the brands copied | About $1 million across all brands |
| January 2026 | Fake "MetaMask 2FA" and "mandatory 2026 upgrade" emails leading to phishing pages; around the same time hundreds of EVM wallets were drained, with no confirmed root cause | Over $107,000 across those wallets, by ZachXBT's count |
| 30 September 2026 | MetaMask disclosed a security incident affecting part of its infrastructure and began exiting the Ethereum validators run by MetaMask Staking, including those in Lido, as a precaution | MetaMask says there is no indication that wallets or customer funds were affected; no root cause published yet |
The September 2026 staking incident is the one to watch. MetaMask says it does not hold stakers' withdrawal keys. Lido said the validator exits will likely cost some rewards and that re-entry may take up to about 45 days. A Lido DAO vote (#206), scheduled to close on 17 October 2026, proposes stopping new deposits to MetaMask Staking. An independent researcher reported that a small amount of block rewards was redirected. MetaMask has not confirmed this.
Is MetaMask a cold wallet?
No. MetaMask is a hot wallet: your keys live in a browser or on a phone. For cold storage, connect a hardware wallet. The extension supports Ledger, Trezor and Lattice directly, plus QR wallets such as Keystone, NGRAVE ZERO and OneKey. The mobile app supports Ledger, Keystone and NGRAVE ZERO. Hardware accounts in MetaMask cover EVM networks only. See our Ledger review and Trezor review.
Is MetaMask legit, or a scam?
MetaMask is legit. It launched in 2016, and the SEC dropped its case against MetaMask's maker in 2025.
The scams aimed at MetaMask users are impostors: emails, fake extensions and fake support that try to get your recovery phrase or a signature.
- MetaMask says it will never ask for your recovery phrase and never asks you to "verify" your account. Any such email is phishing.
- There is no MetaMask token. The help center says there are "no plans for a $MASK token", so any MASK airdrop or claim page is fake.
- Download only from metamask.io or the official app stores. MetaMask's download page itself warns about fake apps.
- Read every approval and batch transaction. The 2025 EIP-7702 drain worked because a victim signed a legitimate-looking batch request.
- Treat "support" on social media as fake, and watch for poisoned addresses in your history.
What fees does MetaMask charge?
MetaMask is free to download, and sending or receiving costs only network fees. It charges 0.875% on swaps and bridges, 1% on fiat buys and sells, and a share of staking rewards.
MetaMask publishes all of these in its help center and shows the swap fee in each swap quote.
| Action | MetaMask fee (October 2026) |
|---|---|
| Send or receive | Network fee only; MetaMask sponsors gas on some networks |
| Swap and bridge | 0.875% plus network and DEX or bridge costs |
| Buy or sell crypto | 1% MetaMask fee, included in the provider's quote, plus the provider's own fee (MoonPay: up to 4.5%) |
| Pooled ETH staking | 15% of rewards |
| Validator staking (32 ETH) | 10% of rewards |
| Tokenized stocks (not in the US, UK, Canada, EEA or Switzerland) | 0.875% |
| Perpetual futures | 0.1432% taker and 0.1144% maker at the base Rewards levels, lower at higher levels; $1 Hyperliquid withdrawal fee |
| Prediction markets | 4% per trade, shared by MetaMask and Polymarket, plus a Polymarket taker fee of 0% to 7% |
| Stablecoins into the Money Account | Free from USDC, DAI and some other stablecoins |
| Transaction Shield | $9.99 a month or $99 a year (optional, extension only) |
The swap fee is where costs add up. A $1,000 swap pays $8.75 to MetaMask before network fees and price impact. Rabby lists a 0.25% swap fee, so the same swap there costs $2.50 in wallet fees. Our Rabby review covers it.
How do you withdraw money from MetaMask to a bank?
Use Sell in the MetaMask mobile app or Portfolio, where Transak, MoonPay, Sardine or Banxa pay out to your bank. Or send your crypto to an exchange and withdraw there.
Sell works in the US, the UK and parts of Europe.
- Open Sell, pick your token and region, and choose a provider.
- Verify your identity with the provider and add your bank details on its site.
- Confirm the sale. You pay MetaMask's 1% fee, the provider's fee and gas.
Where Sell is not supported, send tokens to your own account at an exchange such as Coinbase or Kraken, sell, and withdraw. Use the exact network and send a test amount first.
Does MetaMask require KYC?
Not for the wallet. Creating a wallet, swapping, perps and the Money Account need no ID. Buying and selling fiat require verification with the provider, and the MetaMask Card requires verification with its program manager.
Does MetaMask report to the IRS?
Not for wallet activity. MetaMask says it does not generate tax statements, and wallet software that only lets you control your own keys falls outside Form 1099-DA reporting.
That does not make you invisible. Blockchains are public, and the US exchanges and buy or sell providers you use keep identified records.
- Form 1099-DA. Brokers that take possession of your assets report sales from 1 January 2025. The IRS instructions exclude providers of wallet software that only lets you control your own keys, and MetaMask does not issue 1099-DA forms for wallet activity.
- The DeFi broker rule is gone. Congress overturned it, and Public Law 119-5 (10 April 2025) says it has "no force or effect".
- The Form 1040 question. Swaps, sales, card spending and staking rewards mean "Yes". Only holding, buying with dollars or moving between your own wallets (without paying fees in crypto) means "No".
- Staking rewards are income at fair market value when you gain control of them, under Revenue Ruling 2023-14. In June 2026 the US Tax Court reached the same result in Paschall v. Commissioner (T.C. Memo. 2026-46, a non-precedential memorandum opinion about rewards earned through an exchange).
- Tools. MetaMask's Tax Hub, run by Summ, imports your history for free; filing reports cost extra.
Our US crypto tax guide for 2026 covers rates and forms. This is general information, not tax advice.
MetaMask Card, mUSD, perps and predictions: who can use them?
Most of MetaMask's newer financial products are blocked in the US and the UK, and the US card has been closed to new sign-ups since June 2026.
| Product | Availability (October 2026) |
|---|---|
| MetaMask Card | About 45 countries, mostly in Europe and Latin America, plus Canada; new US sign-ups paused since 3 June 2026 and Metal orders since 2 June 2026; MetaMask's card page also shows UK sign-ups as temporarily closed |
| Money Account (mUSD) | Not available in the UK and may be restricted in some US states; variable yield of up to 4% APY, with promotional rates of up to about 6%; not a bank account and not FDIC-insured |
| Perpetual futures (Hyperliquid) | Not in the US, UK, Ontario or Belgium |
| Prediction markets (Polymarket) | Not in the US, UK, Canada, Australia, France, Germany and several other countries |
| Tokenized stocks (Ondo) | Not in the US, UK, Canada, the EEA or Switzerland |
The card has an unusual ownership twist. It is run with Crypto Life and issued by Monavate on the Mastercard network; US cards are issued by Cross River Bank, and UK cards are moving to a new issuer, Immersve. Monavate and Baanx, the company behind Crypto Life, have been owned by rival wallet maker Exodus since May 2026, according to Exodus's SEC filing. UK cardholders need to know one date: UK cards issued before 28 September 2026 stop working on 29 December 2026. mUSD, MetaMask's dollar stablecoin issued by Bridge (Stripe) on M0, had about $31 million in circulation in mid-October 2026, down from more than $65 million a week after launch.
MetaMask vs Rabby, Trust Wallet and Phantom
Pick by what you do most. Rabby is cheaper for swaps, Trust Wallet claims support for more chains, and Phantom is the stronger pick for Solana.
MetaMask, launched in 2016, works with a very wide range of Ethereum apps and now adds native Solana, Bitcoin and Tron. Rabby's browser extension is MIT-licensed, while MetaMask's code is source-available.
- Rabby charges a 0.25% fee on swaps and bridges, its browser extension uses the MIT licence, and it supports EVM networks only (no Bitcoin, Solana or Tron).
- Trust Wallet says it supports more than 100 blockchains and does not publish a swap fee rate.
- Phantom charges 0.85% on most swaps and, unlike MetaMask, lets you hold SOL on a Ledger.
Compare every option on our crypto wallets hub.
Should you use MetaMask?
For most people who use Ethereum apps, yes. MetaMask works with a very wide range of dApps and holds SOL and BTC in the same account.
Its security tooling is mature. And the SEC dropped its case against Consensys over MetaMask in 2025.
Just know what you pay for convenience: 0.875% per swap and 10% to 15% of staking rewards. Treat any email, airdrop or "support" message as a phishing attempt, and keep larger balances on a hardware wallet. If you stake through MetaMask, follow the September 2026 staking incident until MetaMask publishes a root cause. We score wallets on security, chain support, ease of use, pricing and transparency; see how we score wallets.
Sources
- Consensys Software Inc. to become two independent companies, Consensys, 9 September 2026.
- Consensys to split MetaMask into its own firm, CoinDesk, 9 September 2026.
- MetaMask Terms of Use, MetaMask, June 2026.
- Company, Consensys, accessed 16 October 2026.
- MetaMask co-founder Dan Finlay departs, The Block, 23 April 2026.
- SEC charges Consensys over MetaMask services, SEC, 28 June 2024.
- SEC dismisses case against Consensys, SEC, 27 March 2025.
- Consensys delays potential IPO until fall, CoinDesk, 13 May 2026.
- About MetaMask, MetaMask, accessed 16 October 2026.
- Multichain accounts, MetaMask Help Center, accessed 16 October 2026.
- MetaMask adds native Solana support, The Block, 28 May 2025.
- MetaMask adds native Bitcoin support, Unchained, 16 December 2025.
- MetaMask adds Tron, Decrypt, 15 January 2026.
- Stellar in MetaMask, MetaMask Help Center, accessed 16 October 2026.
- Bitcoin in MetaMask, MetaMask Help Center, accessed 16 October 2026.
- Navigating Solana, MetaMask Help Center, accessed 16 October 2026.
- How to use non-EVM networks, MetaMask Help Center, accessed 16 October 2026.
- MetaMask is a self-custodial wallet, MetaMask Help Center, accessed 16 October 2026.
- Social login, MetaMask Help Center, accessed 16 October 2026.
- Money Account, MetaMask Help Center, accessed 16 October 2026.
- MetaMask extension licence, GitHub, accessed 16 October 2026.
- MetaMask mobile licence, GitHub, accessed 16 October 2026.
- MetaMask security program (audits), MetaMask, accessed 16 October 2026.
- MetaMask bug bounty, HackerOne, accessed 16 October 2026.
- Security alerts, MetaMask Help Center, accessed 16 October 2026.
- eth-phishing-detect, GitHub, accessed 16 October 2026.
- Smart Transactions, MetaMask Help Center, accessed 16 October 2026.
- Transaction Shield, MetaMask Help Center, accessed 16 October 2026.
- Consensys updates Infura privacy policy, Decrypt, 6 December 2022.
- MetaMask warns about phishing on Apple devices, Finance Magnates, 18 April 2022.
- Demonic vulnerability disclosure, Halborn, 15 June 2022.
- Understanding EIP-7702 phishing attacks, GoPlus, 3 June 2025.
- Wave of 150 crypto-draining extensions hits Firefox, BleepingComputer, 7 August 2025.
- MetaMask users targeted by fake 2FA emails, Techloy, 5 January 2026.
- User update on the security incident, MetaMask, updates of 30 September and 1 October 2026.
- MetaMask Staking validator exits, Lido governance forum, 30 September to 14 October 2026.
- MetaMask exits Lido validators amid security incident, Decrypt, 1 October 2026.
- Hardware wallet hub, MetaMask Help Center, accessed 16 October 2026.
- What is MetaMask Rewards?, MetaMask Help Center, accessed 16 October 2026.
- Download MetaMask, MetaMask, accessed 16 October 2026.
- Will MetaMask ever ask me to verify my account?, MetaMask Help Center, accessed 16 October 2026.
- Swaps user guide, MetaMask Help Center, accessed 16 October 2026.
- Buy crypto FAQs, MetaMask Help Center, accessed 16 October 2026.
- How pooled staking rewards work, MetaMask Help Center, accessed 16 October 2026.
- Validator staking rewards, MetaMask Help Center, accessed 16 October 2026.
- Tokenized stocks, MetaMask Help Center, accessed 16 October 2026.
- How to trade predictions, MetaMask Help Center, accessed 16 October 2026.
- MoonPay pricing disclosure, MoonPay, accessed 16 October 2026.
- Rabby Wallet listing, ethereum.org, accessed 16 October 2026.
- How to sell crypto for fiat in MetaMask, MetaMask Help Center, accessed 16 October 2026.
- Tax FAQs, MetaMask Help Center, accessed 16 October 2026.
- Digital assets, Internal Revenue Service, reviewed 2 September 2026.
- About Form 1099-DA, Internal Revenue Service, reviewed 27 June 2026.
- Public Law 119-5, US Government Publishing Office, 10 April 2025.
- Revenue Ruling 2023-14, Internal Revenue Bulletin 2023-33, 14 August 2023.
- What is MetaMask Card?, MetaMask Help Center, accessed 16 October 2026.
- Getting started with MetaMask Card, MetaMask Help Center, accessed 16 October 2026.
- UK card migration, MetaMask Help Center, accessed 16 October 2026.
- What is perp trading?, MetaMask Help Center, accessed 16 October 2026.
- What are prediction markets?, MetaMask Help Center, accessed 16 October 2026.
- Stablecoin supply data (mUSD), DefiLlama, accessed 16 October 2026.
- MetaMask's stablecoin issuance surpasses $65 million, ForkLog, 22 September 2025.
- Hundreds of EVM wallets drained, CryptoSlate, 3 January 2026.
- Instructions for Form 1099-DA, Internal Revenue Service, reviewed 30 April 2026.
- Paschall v. Commissioner, T.C. Memo. 2026-46 (US Tax Court opinion, copy on irs.gov), 4 June 2026.
- Exodus acquisition of Monavate and Baanx, SEC 8-K, 5 May 2026.
- MetaMask Money, MetaMask, accessed 16 October 2026.
- How to trade perps, MetaMask Help Center, accessed 16 October 2026.
- CVE-2022-32969, NIST National Vulnerability Database, 29 June 2022.
- Wallet Guard sunset notice, Wallet Guard, accessed 16 October 2026.
- Address poisoning scams, MetaMask Help Center, accessed 16 October 2026.
- Transaction simulations, MetaMask Help Center, accessed 16 October 2026.
- Gas sponsorship, MetaMask Help Center, accessed 17 October 2026.
- MetaMask simplifies multi-blockchain address management, ForkLog, 28 October 2025.
- Mastercard, MetaMask launch self-custody crypto card in US, Cointelegraph, accessed 16 October 2026.
- MetaMask Card FAQ, MetaMask Help Center, accessed 16 October 2026.
- MetaMask Card, MetaMask, accessed 16 October 2026.
- Metal card, MetaMask Help Center, accessed 16 October 2026.
- MetaMask Card: spend crypto anywhere (update of 3 June 2026), MetaMask, accessed 16 October 2026.
- How to participate in Rewards, MetaMask Help Center, accessed 16 October 2026.
- MetaMask to offer a stablecoin with Stripe's Bridge, Fortune, 21 August 2025.
- How to buy crypto in MetaMask, MetaMask Help Center, accessed 16 October 2026.
- How to use Rabby Swap, Rabby Help Center, accessed 16 October 2026.
- Rabby extension licence (MIT), GitHub, accessed 16 October 2026.
- Supported networks and tokens, Rabby Help Center, 11 June 2026.
- Trust Wallet product reference (llms-full.txt), Trust Wallet, updated 19 August 2026.
- Swap crypto in Phantom, Phantom Help Center, accessed 16 October 2026.
- Hardware wallets in Phantom, Phantom Help Center, accessed 16 October 2026.