MetaMask
MetaMask is the most widely used browser-based crypto wallet — a Chrome/Firefox/Brave extension (and mobile app) that lets you hold ETH and ERC-20 tokens, connect to DeFi protocols, and sign blockchain transactions without trusting a central exchange. It is non-custodial: your seed phrase stays on your device, not on MetaMask's servers.
What MetaMask Is and How It Works
MetaMask is a software wallet developed by ConsenSys. It runs as a browser extension in Chrome, Firefox, Brave, and Edge, and as a native mobile app on iOS and Android. When you install it, MetaMask generates a 12-word seed phrase that derives all your private keys locally — nothing is transmitted to MetaMask's servers. The extension injects a Web3 provider (window.ethereum) into every web page you visit, enabling decentralized applications to request transaction signatures directly through the wallet interface.
MetaMask is Ethereum-native but not Ethereum-exclusive. It natively supports any EVM-compatible chain: BNB Chain (BSC), Polygon, Avalanche, Arbitrum, Optimism, Base, Fantom, and dozens of others. You add networks manually via Settings → Networks, or by visiting a DeFi protocol that prompts you to add the network automatically. All your balances and transaction history on those networks are controlled by the same seed phrase.
Common Use Cases
MetaMask is the entry point to most of the DeFi ecosystem. You need it to interact with DEXs (Uniswap, Curve, SushiSwap), lending protocols (Aave, Compound), NFT marketplaces (OpenSea, Blur), and yield farming platforms. It also functions as an identity layer: many Web3 applications use "Connect Wallet" via MetaMask as a login mechanism, replacing username and password with a cryptographic signature.
Because MetaMask is non-custodial, there is no "forgot password" process tied to any server. If you lose your seed phrase and forget your device password, access is permanently lost. This is both its strength — no third party can freeze your funds — and its primary risk.
Security Risks Specific to MetaMask
MetaMask's browser integration creates an attack surface that cold storage does not have. The most common threats:
- Phishing prompts. Fake websites mimick the MetaMask extension popup, asking you to "verify" or "sync" your wallet by entering your seed phrase. These sites are indistinguishable from the real UI in screenshots. The real MetaMask extension never pops up on a website asking for your seed phrase — it only appears when you restore on a new install.
- Drainer attacks via malicious approvals. A phishing site presents a transaction that looks routine — "mint", "claim", "bridge" — but actually calls setApprovalForAll or approve() granting an attacker's smart contract unlimited access to your tokens. MetaMask shows a confirmation dialog, but the function name and permitted address are often obscured or in small text. One click drains everything approved in that transaction.
- Malicious browser extensions. Extensions with broad permissions can read MetaMask's DOM, intercept clipboard content (your seed phrase if you ever copy-paste it), or inject scripts into pages that modify transaction parameters before you confirm.
- Clipboard hijacking. If you copy a wallet address to paste into MetaMask, malware can silently replace it with the attacker's address in your clipboard. Always verify the first and last 4 characters of the destination address after pasting.
- Fake MetaMask extensions. The Chrome Web Store has repeatedly hosted counterfeit MetaMask extensions that harvest seed phrases on creation. Always install from metamask.io — never search for it directly in the extension store.
How to Secure MetaMask
The most significant security upgrade you can make is pairing MetaMask with a hardware wallet (Ledger or Trezor). Under this setup, MetaMask manages network connections and shows you transactions, but the private key never leaves the hardware device. Every transaction requires physical confirmation on the device — meaning a phishing site cannot drain your wallet even if you click a malicious approval prompt, because you must press a button on the hardware wallet to authorize it.
Maintain two separate MetaMask profiles: one "hot wallet" for routine DeFi interactions with a small working balance, and a separate hardware-backed wallet for long-term holdings. Never import your hardware wallet seed phrase into MetaMask software — use MetaMask's "Connect Hardware Wallet" feature instead.
Additional steps: keep your browser extensions to a minimum, review token approvals regularly on Revoke.cash or Etherscan's Token Approval Checker, and set transaction simulation on (MetaMask has a built-in simulation feature that previews token changes before you confirm).
What to Do If MetaMask Is Compromised
If you suspect your MetaMask seed phrase is exposed or your wallet has been drained, act immediately. Create a new wallet on a clean, offline device — one that has never been connected to the internet during key generation. Write down the new seed phrase on paper and transfer all remaining funds to the new wallet immediately. Do not use the compromised device or browser profile for any wallet activity until it has been fully scanned and cleaned.
If tokens have already left your wallet, record the outgoing transaction hash (TxID) and the destination address from your MetaMask transaction history. Contact a blockchain forensics firm as early as possible — within the first few hours, funds may still be traceable to an exchange where a freeze can be requested.
Frequently Asked Questions
Is MetaMask safe?
MetaMask itself is reputable and open-source. The risks come from how you use it: phishing sites that mimic MetaMask prompts, malicious dApps that request dangerous transaction approvals, browser extensions that intercept wallet data, and seed phrase theft through social engineering.
What should I do if MetaMask asks for my seed phrase?
Never enter your seed phrase into any website or pop-up — even one that looks like MetaMask. The only legitimate use is restoring a wallet inside the official MetaMask extension on a clean device. Any other request is a scam.
Can MetaMask be hacked without knowing my seed phrase?
Yes — through malicious token approvals (drainers). A phishing site can prompt you to sign a transaction granting an attacker's contract unlimited access to your tokens. The MetaMask extension will show a signing prompt, but the transaction details may be obfuscated or ignored by the user.
How do I restore MetaMask on a new device?
Install MetaMask on the new device, choose 'Import an existing wallet', and enter your 12-word seed phrase. This restores all accounts derived from that seed phrase across all networks.
Does MetaMask support chains other than Ethereum?
Yes. MetaMask natively supports any EVM-compatible chain: BNB Chain, Polygon, Avalanche, Arbitrum, Optimism, Base, and many others. You add them manually via Settings → Networks or by visiting a chain's native bridge, which prompts you to add the network automatically.