Rabby Reseña
EVM wallet built by the team behind DeBank, with pre-sign transaction simulation, 70+ built-in networks and a 0.25% swap fee
Link to the company's own site · doesn't affect score
De un vistazo
Rabby is a self-custodial EVM wallet published by OPCODE LABS PTE. LTD. of Singapore and built by the team behind DeBank. As of October 2026 it has more than 70 built-in EVM networks (Rabby's help center says 80+), and you can add other EVM chains as custom networks with limited features. It does not support Solana, Bitcoin or Tron. It runs as a browser extension for Chrome, Brave and Edge (not Firefox), as iOS and Android apps, and as a desktop app for Windows and macOS. Rabby previews the balance changes of a transaction before you sign and charges 0.25% on swaps and bridges, included in the quote. The extension code is MIT-licensed with a brand-use clause, outside firms have audited it every year since 2022 (most recently SlowMist in August 2026 and Least Authority in October 2026), and its bug bounty on Bugrap pays up to 10,000 USDC.
DeFi users on Ethereum and its layer 2s who want a balance-change preview and risk warnings before they sign, hardware wallet support on the extension, and a lower swap fee than MetaMask's listed 0.875%.
You need Solana, Bitcoin, Tron or another non-EVM chain in the same wallet, you browse with Firefox (Rabby has no Firefox version, and any Rabby add-on there is fake), or you are in the US and want perps or prediction markets, which may not be available to you.
Datos rápidos
- Wallet type
- browser extension
- Custody
- self
- Supported chains
- 70+
- Open source
- Yes
- Built-in swap
- Yes
- NFT support
- Yes
Desglose de puntuación Skrumble
Lee nuestra metodología de puntuación completa.
A favor
- Previews the balance changes of each transaction and checks spenders, contract age, price impact, scam tokens and Permit signatures; risky requests stay blocked until you choose to ignore the warnings
- 0.25% fee on swaps and bridges, against MetaMask's listed 0.875%; same-chain stablecoin swaps have carried no Rabby fee since July 2026
- Extension audited every year since 2022, most recently by SlowMist (August 2026) and Least Authority (October 2026), plus a Bugrap bug bounty of up to 10,000 USDC
- Works with 11 hardware wallet types on the extension, including Ledger, Trezor, Keystone, OneKey and GridPlus, and 4 on mobile
- More than 70 built-in EVM networks with automatic network switching, plus other EVM chains as custom networks
En contra
- EVM only: no Solana, Bitcoin or Tron, so multichain users need a second wallet
- Not free to trade: 0.25% on swaps and on every bridge, built into the quote, with exceptions only for some stablecoin and ETH pairs
- No Firefox version, and security firm Socket found at least 20 malicious Rabby-based Firefox add-ons in 2026
- Open audit findings: 4 unresolved medium issues in Least Authority's October 2026 mobile review, and no confirmed fix for Cure53's 3 high findings from 2024
- Perps and prediction markets are region-gated by Rabby and may not be available in the US
Rabby wallet review: the short answer
Rabby is a well-audited, self-custodial browser wallet for Ethereum and EVM networks. It shows you what a transaction will do before you sign.
Outside firms audit it every year. It is not free to trade with, though. Swaps and bridges carry a 0.25% fee.
Some of what you may read about Rabby is wrong. It charges a swap fee. It does not support 140 chains, and there is no Firefox version. We checked every fact in this Rabby wallet review against Rabby's help center, its audit reports, its code on GitHub and security research on 16 October 2026.
- Good fit: you use DeFi on Ethereum and its layer 2s, you want strong warnings before signing, and you are moving from MetaMask for lower swap fees.
- Look elsewhere: you need Solana, Bitcoin or other non-EVM chains, or you use Firefox.
Who owns Rabby wallet?
Rabby is built by the team behind DeBank, the on-chain portfolio tracker. Its publisher is OPCODE LABS PTE. LTD. of Singapore.
That name appears in Rabby's December 2025 terms and on its App Store and Google Play listings. Before that, the publisher was DeBank Global PTE. LTD.
DeBank was co-founded in 2018 by Tang Hongbo. In December 2021 it raised $25 million at a $200 million valuation, in a round led by Sequoia China. We found no user total published by Rabby. Store figures give a sense of scale: the Chrome extension lists about 900,000 users, and the Android app has more than 500,000 downloads.
Which chains and platforms does Rabby support?
Rabby supports EVM networks only, with more than 70 built in. It runs on Chrome, Brave and Edge, on iOS and Android, and as a desktop app for Windows and macOS.
The exact count depends on where you look, because Rabby's help center says "80+" while its live chain list showed 71 on 16 October 2026.
- Networks: Ethereum and major layer 2s such as Arbitrum, Optimism, Base and Linea, plus newer chains including Robinhood Chain, Monad and Arc. You can add other EVM networks by hand, with limited features.
- Not supported: Solana, Bitcoin, Cosmos, Tron and other non-EVM chains.
- Browsers: no Firefox version exists. Rabby says any "Rabby" on Firefox is fake.
- Desktop: Windows and macOS only, with no release since 9 March 2026. It can store imported private keys on your computer.
Rabby added features through 2026, with prediction markets in January, lending in February, a dust converter in April and staking in June, and it also offers perpetual futures through Hyperliquid. Rabby blocks perps and prediction markets in some regions. Hyperliquid's own app terms also exclude US persons, so US users may not get these features.
Is Rabby wallet safe?
Yes, with caveats. Rabby is self-custodial, its extension code is open source, outside firms have audited it every year since 2022, and its pre-sign checks warn you about common scam patterns before you sign.
The only known loss-causing exploit of its own code hit a swap contract in 2022. Since then, every reported loss we found tied to the Rabby name came from fake copies of the app.
How Rabby protects you before you sign
- Transaction simulation. Rabby shows the balance changes a transaction will cause and runs checks on the spender, the contract's age and trust, price impact, scam tokens and Permit signatures. Risky requests stay blocked until you choose to ignore the warnings.
- Site checks on connect. Before you connect to a site, Rabby checks it against its phishing list and public directories, and disables the Connect button if it finds a risk, until you choose to ignore the warnings.
- Exact approvals. Rabby's own swaps and bridges approve only the exact amount, never an unlimited allowance.
- Approval manager. You can see and revoke approvals in bulk, including EIP-7702 delegations.
- Address whitelist. You can limit sends to saved addresses.
- Hardware wallets. The extension supports 11 hardware wallet types, including Ledger, Trezor, Keystone, OneKey and GridPlus; the mobile app supports 4.
Rabby keeps your keys on your device, encrypted with your password, and says it never has access to your funds. One caution from Least Authority's 2026 audit: Rabby protects the password with deliberately light key-stretching settings, as MetaMask does. A thief with a copy of your encrypted wallet file could crack a weak password. Use a long one.
Open source, audits and bug bounty
| Check | What we found (October 2026) |
|---|---|
| Source code | Extension and desktop: MIT licence with a clause on use of the Rabby brand; mobile code public without a licence file; Rabby's back-end data service is closed |
| Extension audits | SlowMist (2022, 2023, 2024, 2025 and August 2026) and Least Authority (December 2024, September 2025 and October 2026) |
| Mobile audits | SlowMist (2024, 2025, 2026), Cure53 (October 2024, with 3 high-severity findings) and Least Authority (2024, 2025, 2026) |
| Latest results | SlowMist's August 2026 extension audit passed with 3 suggestions, 2 still open (one lets a dApp show a different chain from the one signed for; another leaves Gas Account withdrawal credentials in plaintext browser storage). Least Authority's October 2026 reviews, which cover changes since 2025, list 2 medium issues not fully fixed on the extension and 4 unresolved medium issues on mobile |
| Bug bounty | On Bugrap, up to 10,000 USDC for critical bugs |
Cure53's 2024 mobile report verified fixes for four lower-severity findings. It did not verify fixes for its three high findings, and no later source we found confirms them. Least Authority has also flagged weak password protection on mobile since 2024. It is still only partly fixed.
Every Rabby security incident we found
| Date | What happened | Loss |
|---|---|---|
| 11 October 2022 | A flaw in the Rabby Swap contract let an attacker drain tokens from users who had approved it; PeckShield had audited the contract. Rabby told users to revoke their approvals | 114 ETH and 179 BNB, about $190,000 to $200,000. Revoke.cash says users were reimbursed and the contract was never patched; we found no Rabby statement confirming the reimbursement |
| Late 2023 and February 2024 | Fake Rabby apps on Apple's App Store, including "Rabby Wallet & Crypto Solution" in February 2024, later removed by Apple | Over $1 million in the February 2024 case, per Cointelegraph Magazine |
| 2024 | Lazarus-linked BeaverTail malware added the Rabby extension to the wallets it steals data from on infected computers, per Group-IB (September 2024); not a flaw in Rabby | Not quantified |
| August 2025 | The GreedyBear campaign faked Firefox wallet extensions, with Rabby among the brands copied | About $1 million across the whole campaign, not Rabby alone |
| September 2025 | An npm supply-chain attack hit widely used JavaScript packages; Rabby said it did not use the compromised versions | None, per Rabby |
| March to October 2026 | Security firm Socket found at least 20 malicious Rabby-based Firefox add-ons that stole stored keys or recovery phrases; Mozilla pulled 4 more Rabby clones by 5 October 2026 | Not quantified |
| August 2026 | An extension signature flaw, exploitable only with a malicious site connected and auto-lock set to exactly 10 minutes; Rabby says it shipped a fix on 11 August; the mobile app was not affected | No exploitation detected, per Rabby |
Is Rabby wallet legit, or a scam?
Rabby is legit. It is an audited wallet with public source code, built by the team behind DeBank. The scams are impersonations, which Rabby's own help center warns about.
- Rabby has no Firefox extension. Any "Rabby" add-on on Firefox is malicious.
- Rabby never offers support on Telegram, and Discord "admins" who message you are fake. Official help is the chat on Rabby's help center and support@rabby.io.
- Check that the App Store or Google Play publisher is OPCODE LABS PTE. LTD., and get links from rabby.io.
- Ignore spam tokens or NFTs with claim links, and sponsored search ads pointing to lookalike sites.
What fees does Rabby wallet charge?
Rabby is free to install, and sending costs network gas. It charges 0.25% on swaps and bridges, included in the quote.
Some swaps are free. Same-chain swaps between stablecoins have cost nothing since July 2026, and Rabby's help center also lists ETH to ETH staking token swaps on Ethereum mainnet as free.
| Action | Fee (October 2026) |
|---|---|
| Send | Network gas |
| Swap | 0.25%, included in the quote (since July 2024); 0% for same-chain stablecoin pairs, and for ETH to ETH staking token pairs on Ethereum mainnet |
| Bridge | 0.25%, included in the quote, plus network gas |
| Gas Account | No extra Rabby service fee; the charge includes the gas and a transfer fee; Apple Pay or Google Pay top-ups cannot be withdrawn |
| Perpetual futures | Hyperliquid's fees plus a Rabby fee of 0.04%; Rabby advertised a promotional 0.02% in June 2026 |
On a $1,000 swap, Rabby's fee is $2.50. MetaMask's listed 0.875% fee would be $8.75. Phantom's 0.85% on most swaps would be $8.50.
Rabby vs MetaMask
Rabby started as a fork of MetaMask. It is the better choice for EVM-only users who want cheaper swaps and Rabby's pre-sign risk checks.
MetaMask wins if you also want Solana or Bitcoin in the same wallet.
| Rabby | MetaMask | |
|---|---|---|
| Swap fee | 0.25% | 0.875% |
| Chains | EVM only | EVM plus native Solana, Bitcoin and Tron; Stellar rolling out in 2026 |
| Licence | MIT (extension) | Custom source-available licence |
| Pre-sign checks | Transaction simulation and risk checks before you sign (built-in networks) | Security alerts and balance previews |
See our MetaMask review for the full comparison.
Can you cash out with Rabby, and can the IRS see it?
To cash out, send your tokens to an exchange account such as Coinbase or Kraken, sell and withdraw to your bank.
Rabby's mobile app has a buy feature through outside providers. We could not confirm which providers it uses, or any sell-to-bank option.
Rabby needs no account, email or ID. We found no sign it files tax forms. That does not hide your activity. Blockchains are public, and US exchanges file Form 1099-DA on your sales from 2025.
- Very likely not a reporting broker. IRS rules do not require Form 1099-DA reporting by decentralized or non-custodial brokers, so we infer Rabby does not issue the form; Rabby has not said so itself. A 2024 rule aimed at DeFi front ends was overturned by Congress in April 2025.
- Swaps are taxable. The Form 1040 question needs a "Yes" for swaps, sales and staking rewards.
- Staking rewards are income when you gain control of them, under Revenue Ruling 2023-14.
Rabby's privacy policy says it collects your IP address, device data and usage logs. It is private, not anonymous. Our US crypto tax guide for 2026 has more. This is general information, not tax advice.
Should you use Rabby?
If you live on Ethereum and its layer 2s, yes. Rabby gives you strong pre-sign protection, regular independent audits, open extension code and swap fees well below MetaMask's.
Pair it with a hardware wallet for larger balances, use a strong password, and install it only from rabby.io or the official stores. If you need Solana or Bitcoin, run Rabby next to a multichain wallet such as Phantom or Trust Wallet. We score wallets on security, chain support, ease of use, pricing and transparency; see how we score wallets, or compare every option on our crypto wallets hub.
Sources
- Rabby Terms of Use, OPCODE LABS PTE. LTD., 9 December 2025.
- Rabby Privacy Policy, OPCODE LABS PTE. LTD., 9 December 2025.
- What is Rabby Wallet?, Rabby Help Center, 19 March 2026.
- How secure is Rabby Wallet?, Rabby Help Center, 21 March 2026.
- Supported networks and tokens, Rabby Help Center, 11 June 2026.
- Rabby chain list (API), Rabby, accessed 16 October 2026.
- Getting started with the Rabby extension, Rabby Help Center, 24 August 2026.
- Rabby Wallet on the Chrome Web Store, Google, accessed 16 October 2026.
- Rabby Wallet on Google Play, Google, accessed 16 October 2026.
- Rabby Desktop latest release, Rabby, accessed 16 October 2026.
- Rabby extension changelogs, GitHub, accessed 16 October 2026.
- Rabby extension source code, GitHub, accessed 16 October 2026.
- Rabby mobile source code, GitHub, accessed 16 October 2026.
- Rabby extension audit reports, GitHub, accessed 16 October 2026.
- Rabby mobile audit reports, GitHub, accessed 16 October 2026.
- Rabby Wallet bug bounty, Bugrap, accessed 16 October 2026.
- Understanding Rabby's transaction simulation, Rabby Help Center, 20 March 2026.
- How to connect Rabby to a dApp, Rabby Help Center, 3 July 2026.
- How to revoke approvals, Rabby Help Center, accessed 16 October 2026.
- How to use Rabby Swap, Rabby Help Center, 20 March 2026.
- Best practices for staying safe in Web3, Rabby Help Center, 21 March 2026.
- How to contact Rabby Wallet support, Rabby Help Center, 25 March 2026.
- Firefox crypto wallet theft campaign, Socket, 19 August 2026.
- Mozilla pulls 16 malicious Firefox crypto add-ons, PiunikaWeb, 8 October 2026.
- Wave of 150 crypto-draining extensions hits Firefox, BleepingComputer, 7 August 2025.
- Rabby security update on the extension flaw, Rabby on X, 20 August 2026.
- 0% swap fee token pairs, Rabby Help Center, 21 July 2026.
- How to use Rabby Bridge, Rabby Help Center, 20 March 2026.
- What is GasAccount?, Rabby Help Center, 2 June 2026.
- Understanding Rabby Perps fees, Rabby Help Center, 5 June 2026.
- MetaMask Swaps user guide, MetaMask Help Center, accessed 16 October 2026.
- Swap crypto in Phantom, Phantom Help Center, accessed 16 October 2026.
- Digital assets, Internal Revenue Service, reviewed 2 September 2026.
- Instructions for Form 1099-DA, Internal Revenue Service, reviewed 30 April 2026.
- Public Law 119-5, US Government Publishing Office, 10 April 2025.
- Revenue Ruling 2023-14, Internal Revenue Service, 2023.
- Rabby Swap exploit, Revoke.cash, accessed 16 October 2026.
- The fake Rabby app scam, Cointelegraph Magazine, 16 October 2024.
- GreedyBear scam on an industrial scale, Cointelegraph, 8 August 2025.
- Sequoia China leads $25M round for DeBank, Cointelegraph, December 2021.
- Lazarus group's Python scripts (BeaverTail), Group-IB, 4 September 2024.
- Rabby statement on the npm supply-chain attack, Rabby on X, 9 September 2025.
- Rabby Swap exploited a month after launch, Web3 Is Going Great, 11 October 2022.
- Rabby wallet exploit prompts users to revoke access, The Block, 11 October 2022.
- Rabby advice to revoke Rabby Swap approvals, Rabby on X, 11 October 2022.
- Fake crypto app on the App Store, 9to5Mac, 19 February 2024.
- Rabby extension signature flaw explained, TechFlow, 20 August 2026.
- Rabby Wallet unveils IOTA EVM integration and 0.25% swap fee, Crypto Economy, 5 July 2024.
- Supported hardware wallets, Rabby Help Center, 19 March 2026.
- Rabby Wallet on the App Store, Apple, accessed 16 October 2026.
- Hyperliquid Interface Terms, Hyperliquid, 15 June 2026.
- Rabby extension interface messages (regional limits on Perps and Prediction), GitHub, accessed 16 October 2026.
- MetaMask extension licence, GitHub, accessed 16 October 2026.
- MetaMask rolls out Bitcoin support, The Block, 15 December 2025.
- MetaMask adds Tron, Decrypt, 15 January 2026.
- Stellar in MetaMask, MetaMask Help Center, accessed 16 October 2026.
- MetaMask security alerts, MetaMask Help Center, accessed 16 October 2026.
- MetaMask transaction simulations, MetaMask Help Center, accessed 16 October 2026.