{
 "source": "https://rabbyewm.at/rabby-security-history/",
 "license": "CC BY 4.0",
 "entries": [
  {
   "date": "2026-10-23",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Extension v0.94.13 released (scam-token removal, improved bridge progress display).",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2026-10-09",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "Least Authority final audit report on the Rabby Wallet extension.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2026-10-05",
   "wallet": "Fake Firefox add-ons",
   "wallet_slug": "",
   "type": "scam",
   "loss_usd": "Not disclosed",
   "summary": "Mozilla removed 16 malicious Firefox extensions, four of them Rabby clones ('Raabby WaIIet') that stole seed phrases and private keys.",
   "source": "cyberinsider.com"
  },
  {
   "date": "2026-08-27",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Volume-based swap and bridge fee discounts added to the extension: 0.12% for a single trade of $100,000–$1M, 0% from $1M (in-app discount tips followed on 11 September 2026).",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2026-08-24",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "SlowMist audit of the Rabby browser extension.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2026-08-11",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "vulnerability",
   "loss_usd": "None reported",
   "summary": "Rabby fixed a 'silent signature' bug disclosed by researcher V12: a connected malicious site could obtain a signature unseen, but only if auto-lock was set to 10 minutes. No exploitation was reported.",
   "source": "TechFlow"
  },
  {
   "date": "2026-08-07",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "fix",
   "loss_usd": "",
   "summary": "Fix shipped in v0.94.2: a pending dapp signing request could survive wallet lock and be approved when the user unlocked.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2026-08-03",
   "wallet": "Fake Firefox add-ons",
   "wallet_slug": "",
   "type": "scam",
   "loss_usd": "Not disclosed",
   "summary": "Researchers documented a months-long Firefox add-on campaign (March–August 2026) in which modified Rabby builds with names like 'RABB-Wallet' stole wallet data.",
   "source": "socket.dev"
  },
  {
   "date": "2026-07-17",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Stablecoin-to-stablecoin swaps become fee-free.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2025-12-12",
   "wallet": "Desktop",
   "wallet_slug": "",
   "type": "other",
   "loss_usd": "",
   "summary": "Rabby announced that the Rabby Desktop backend would shut down on 31 December 2025 and asked desktop users to move to the browser extension; a new desktop version was described as planned.",
   "source": "KuCoin News (quoting Rabby on X)"
  },
  {
   "date": "2025-09-09",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "other",
   "loss_usd": "",
   "summary": "Rabby said it was not affected by the September 2025 npm supply-chain attack on popular JavaScript packages.",
   "source": "iq.wiki"
  },
  {
   "date": "2025-09-06",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Rabby Perps (perpetual futures via Hyperliquid) launches on extension and mobile.",
   "source": "iq.wiki"
  },
  {
   "date": "2025-09-02",
   "wallet": "Mobile",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "Least Authority final audit of the mobile app, with one medium issue (key-derivation parameters) unresolved at the audited version.",
   "source": "leastauthority.com"
  },
  {
   "date": "2025-09-02",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "Least Authority second final audit of the Rabby extension.",
   "source": "leastauthority.com"
  },
  {
   "date": "2025-08-21",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "SlowMist audit of the Rabby browser extension.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2025-07",
   "wallet": "Fake Firefox add-ons",
   "wallet_slug": "",
   "type": "scam",
   "loss_usd": "",
   "summary": "Security researchers reported 150+ counterfeit wallet extensions on Firefox Add-ons impersonating MetaMask, TronLink, Rabby and others, with about $1M stolen across all of them.",
   "source": "ryder.id"
  },
  {
   "date": "2024-12-17",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "SlowMist audit of the Rabby browser extension.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2024-12-12",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "Least Authority final audit report on the Rabby Wallet extension.",
   "source": "leastauthority.com"
  },
  {
   "date": "2024-10-18",
   "wallet": "Mobile",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "Least Authority audit of the Rabby mobile app.",
   "source": "leastauthority.com"
  },
  {
   "date": "2024-09-09",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Gas Account launches: pay gas on supported chains from a USDC/USDT balance.",
   "source": "altcoinbuzz.io"
  },
  {
   "date": "2024-08-20",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Built-in cross-chain bridge launches, powered by LI.FI.",
   "source": "li.fi"
  },
  {
   "date": "2024-07-05",
   "wallet": "All apps",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "0.25% fee introduced on in-wallet swaps across extension, desktop and mobile.",
   "source": "crypto-economy.com"
  },
  {
   "date": "2024-02-16",
   "wallet": "Fake iOS app",
   "wallet_slug": "",
   "type": "fake-app",
   "loss_usd": "Individual losses reported up to ~$100,000",
   "summary": "A fake 'Rabby Wallet' iOS app from an unrelated developer was approved on the App Store before the real app and drained users who imported seed phrases. Rabby warned users and the app was removed.",
   "source": "forklog.com"
  },
  {
   "date": "2024-01-23",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Rabby Points programme launches.",
   "source": "thedefiant.io"
  },
  {
   "date": "2023-07-20",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "SlowMist security audit of Rabby Wallet.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2022-10-11",
   "wallet": "Rabby Swap",
   "wallet_slug": "",
   "type": "hack",
   "loss_usd": "~$190,000–$200,000 (about 114 ETH and 179 BNB)",
   "summary": "The Rabby Swap router contract was exploited: it executed arbitrary calls without checking them, letting the attacker take tokens users had approved to it. Rabby urged users to revoke approvals to the old contract; we could not confirm whether victims were reimbursed.",
   "source": "theblock.co"
  },
  {
   "date": "2022-09-14",
   "wallet": "Rabby Swap",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "Rabby Swap, the built-in token swap, launches.",
   "source": "cryptoactu.com"
  },
  {
   "date": "2022-03-18",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "SlowMist security audit of the Rabby browser extension.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2021-07-28",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "DeBank publicly announces Rabby, a browser-extension wallet with automatic chain switching and readable signing requests.",
   "source": "thedefiant.io"
  },
  {
   "date": "2021-06-23",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "audit",
   "loss_usd": "",
   "summary": "Penetration test report on the Rabby Chrome extension published in the project's audits folder.",
   "source": "github.com/RabbyHub/Rabby"
  },
  {
   "date": "2021-06-18",
   "wallet": "Extension",
   "wallet_slug": "",
   "type": "release",
   "loss_usd": "",
   "summary": "First tagged release of the Rabby browser extension (v0.3).",
   "source": "github.com/RabbyHub/Rabby"
  }
 ]
}