Fake Rabby wallets: how the scams work and how to spot them
Fake Rabby wallets are look-alike websites, extensions and apps that steal your seed phrase or private key. The real Rabby comes only from rabby.io and the official Chrome Web Store, App Store and Google Play listings, and it never asks for your seed phrase. If you installed a fake, move your funds to a new wallet with a new seed phrase immediately.
Why Rabby is so heavily faked
Rabby is popular with DeFi users who hold meaningful amounts, which makes them attractive targets. When we researched search results in October 2026, most top results for queries such as "rabby wallet download", "rabby wallet review" and "is rabby wallet safe" were scam or spam pages, not real content. Search engines are not filtering them well, so you cannot rely on the first result being genuine.
Common fake Rabby patterns
| Pattern | What it looks like | What it does |
|---|---|---|
| Pages on free hosting | Addresses on onrender.com, vercel.app, pages.dev, wasmer.app, itch.io, Google Sites or blog platforms with "rabby" in the name | Copies Rabby's look and sends you to a fake download or a seed-phrase form |
| Course-platform pages | Teachable "course" pages named after Rabby, Rabby support or Rabby extension | Fake guides with links to malicious downloads or fake support |
| Hacked sites and documents | Pages on hacked government, school or council websites, and PDFs on file-sharing or archive sites | Ranks in search and redirects to scam pages |
| Fake help desks | "Rabby support" or "Rabby CDN" help-desk sites, live chats, Telegram or Discord DMs | Asks you to "validate" or "sync" your wallet by entering your seed phrase |
| Fake Firefox add-ons | Rabby-like names with odd spelling or non-Latin letters, for example "Rby-WALLEТ" (with a Cyrillic Т), "RABB-Wallet Web3 & EVM" or "Rabbit For Desktop" | Modified Rabby code that sends your keys to the attacker |
| Fake mobile apps | Store apps with Rabby in the name from a different developer | Imports your seed phrase and empties your wallets |
| Fake airdrop claims | "Claim your Rabby token" or "Rabby points airdrop" pages | A drainer approval or seed-phrase form. No Rabby token has been confirmed |
| Look-alike store links | Odd Chrome Web Store addresses, such as several "detail" parts in one link, or an extension ID that differs from the real one | Leads to a copycat extension |
Documented cases
Fake iOS app, February 2024
Before Rabby's real iOS app was released, an App Store app called "Rabby Wallet & Crypto Solution" from a developer named "Solution Development" stayed live for several days. Rabby warned on 16 February 2024 that "a FAKE iOS app has resurfaced" and that its own iOS app was still under review (ForkLog, 19 February 2024). Victims reported that the app imported their seed phrase and their wallets were emptied; one user claimed losses above 100,000 US dollars, which ForkLog could not verify. Rabby had already warned about impostors in October and December 2023.
Firefox "Offside" campaign, March to August 2026
Researchers at Socket found 77 linked Firefox add-ons, 40 of them confirmed malicious, impersonating Rabby, OKX, TronLink and other wallets (The Hacker News, 20 August 2026). Thirteen were modified Rabby builds that copied the wallet's key data before it was encrypted and sent it to attacker servers, then let the wallet keep working normally so victims noticed nothing. Some add-ons first appeared as harmless sports-score or utility tools and were later turned into wallet stealers. Rabby has no official Firefox add-on, so any Rabby-branded Firefox add-on should be treated as fake.
"Raabby WaIIet" clones, October 2026
In early October 2026 researchers reported 16 more malicious Firefox add-ons, four of them Rabby clones named "Raabby WaIIet" (with capital I letters in place of l) that sent seed phrases and private keys to the attackers. Mozilla had removed them by 5 October 2026 (CyberInsider, October 2026). Earlier, in 2025, Koi Security reported more than 150 counterfeit wallet add-ons on Firefox, including Rabby copies (as summarised by Ryder, 2026).
Look-alike domains
Phishing domains reported for Rabby include rabbby.io, rabbyw.com, rabby.pw and addresses that put "rabby" in front of an unrelated domain. Do not visit them. The only official website is rabby.io.
More events are collected in the Rabby security history.
How to spot a fake Rabby
- Address. The official website is
rabby.io. Type it yourself or use a bookmark. Do not trust a search ad or a link in a message. - Extension ID. The real Chrome Web Store ID is
acmacodkjbdgmoleebolmdjonilkdbch. Paste any link or ID into the Rabby extension verifier. - App Store ID. The real iOS app is
id6474381673, named "Rabby Wallet - Crypto & EVM". - Android package. The real Google Play app has the package name
com.debank.rabbymobile. - Developer. As of October 2026 both official mobile listings name OPCODE LABS PTE. LTD. as the developer (the iOS copyright line reads DeBank Global PTE. LTD.). In 2024 Rabby named the developers as DeBank, so older guides may show that name. Any other developer name is a red flag.
- Browser. Rabby is for Chrome-based browsers. A Rabby add-on for Firefox is fake.
- Seed phrase requests. The real Rabby asks for your seed phrase only when you choose to import a wallet inside the app. A website, form, chat or "support agent" asking for it is always a scam.
- Urgency. "Your wallet will be suspended", "verify now" and "claim before it expires" are pressure tactics.
What to do if you installed a fake Rabby
Assume that every seed phrase and private key you typed into it is in the attacker's hands. Act quickly; drainers often move funds within minutes, but some wait.
- Disconnect and remove. Uninstall the fake extension or app. If you also suspect malware on your computer, use a different, clean device for the next steps.
- Install the real Rabby from the official store using the identifiers in our safe download guide.
- Create a brand-new wallet with a new seed phrase. Do not import the old seed phrase; it is compromised. Write the new phrase on paper.
- Move everything you can from the old addresses to the new ones, starting with the most valuable assets. If the old address has no gas, you may need to send a small amount first; attackers sometimes run bots that grab incoming gas immediately.
- Revoke approvals on the old addresses where possible, and check for DeFi positions, staked tokens and NFTs that need to be moved too. See revoke approvals in Rabby.
- Change passwords for exchanges and email accounts if you used them on the same device, and turn on two-factor authentication.
- Report the fake listing to the store (Chrome Web Store, Mozilla Add-ons, App Store or Google Play) and the fake site to your browser's phishing report form.
- Ignore "recovery" offers. People who DM you promising to recover stolen crypto for a fee are running a second scam.
Related tricks that target Rabby users
Address poisoning
Attackers send tiny or zero-value transfers from addresses that start and end with the same characters as one you use, hoping you copy the wrong one from your history later. Always copy addresses from a saved contact or the source, and compare the whole address. The EVM address checker highlights differences.
Drainer approvals
Instead of stealing your seed phrase, some fake dapps ask you to sign an approval or permit that lets them move your tokens later. Rabby's preview and risk warnings help here, but only if you read them. Decode a suspicious request with the approval explainer.
Fake "Rabby points" and airdrop pages
Rabby's points programme is real; a Rabby token is not confirmed. Pages that ask you to connect a wallet to "claim" Rabby tokens or "convert points" are drainers. See Rabby points and airdrop facts.
Fake support
Scammers watch public forums, X replies, Discord and Telegram for people asking about Rabby problems, then message them pretending to be support. Real Rabby support never DMs you first, never asks for your seed phrase or private key, and never asks you to "connect your wallet to a validation site". If something is broken, our Rabby troubleshooting guide covers the common fixes without anyone needing your keys.
Frequently asked questions
Is there a Rabby Wallet for Firefox?
No official one. In 2026 researchers found at least 17 Rabby clones among malicious Firefox add-ons that stole wallet keys. Any Rabby-branded Firefox add-on should be treated as fake.
How do I know my Rabby extension is real?
Open your browser's extensions page, turn on Developer mode and compare the Rabby ID with acmacodkjbdgmoleebolmdjonilkdbch, or paste it into our verifier tool.
Is there a Rabby token airdrop?
As of October 2026 no Rabby token or airdrop has been confirmed. Sites asking you to connect your wallet or enter a seed phrase to claim one are scams.
I typed my seed phrase into a site. Can I just change my Rabby password?
No. The password only protects the wallet on your device. Anyone with your seed phrase can rebuild your wallet anywhere. Create a new wallet with a new seed phrase and move your funds.
Can stolen crypto be recovered?
Usually not. Transactions on Ethereum and other EVM chains cannot be reversed. Report the theft to the police and the exchange that may receive the funds, and ignore anyone offering paid recovery.