Is Rabby Wallet safe?

The short answer

The real Rabby Wallet, installed from the official stores, is a solid choice for everyday EVM use, and its pre-sign checks make it safer than many wallets in practice. "Safe" depends more on how you use it than on the wallet: a fake download, a seed phrase typed into a website or an unlimited approval to a drainer contract will empty any wallet. For large amounts, pair Rabby with a hardware wallet.

How Rabby protects your keys

• Self-custody. Your seed phrase and private keys are generated on your device and stored encrypted with your password. Rabby's servers do not hold them.
• Local password. The password only unlocks the wallet on that device. It is not an account password and cannot recover your funds elsewhere. If you forget it, you restore from the seed phrase (see forgot Rabby password).
• Hardware-wallet option. With a Ledger, Trezor, Keystone or similar device, keys never touch your computer or phone; Rabby only prepares transactions for the device to sign. See hardware wallets in Rabby.
• Pre-sign checks. Rabby simulates each transaction and shows expected balance changes, and it flags risky approvals, unfamiliar recipients and suspicious contracts. See transaction simulation.

Open source

The extension's source code is public on GitHub under the MIT licence, and the mobile app's code is public in a separate repository (without a licence file, according to CryptoSlate, October 2026). Public code lets researchers check how keys are stored. It does not by itself prove that the build in the store matches the code, which is why audits and a long track record matter too.

Audits

Rabby keeps its audit reports in the audits folder of its GitHub repository, and Least Authority publishes its reports on its own site.

Sources: Least Authority audit pages; Rabby's GitHub audit folder; CryptoSlate review (updated 24 October 2026). We have not summarised the 2026 reports' findings because we could not read them in full. An audit is a review of code at one point in time, not a guarantee. Unresolved findings mean the auditors saw room for improvement that Rabby had not yet adopted when the report was published; it does not mean funds were at risk from a known exploit.

The October 2022 Rabby Swap exploit

Rabby Swap launched on 14 September 2022. On 11 October 2022 an attacker exploited a flaw in the swap contract that let them move tokens from users who had approved it, on several chains (The Block, 11 October 2022). Reported losses were about 114 ETH and 179 BNB, roughly 200,000 US dollars at the time (Web3 Is Going Great; CryptoSlate). The contract had been audited by PeckShield, which missed the flaw.

Rabby told everyone who had used Swap to revoke all approvals on all chains and said wallets that had never used Swap were not affected. Private keys were not affected. Some later reviews say victims were reimbursed, but we could not find Rabby's original statement on this. The old contract cannot be paused, so any approval still pointing to it remains risky. The lesson applies to every wallet: an approval to a contract stays open until you revoke it. Check yours with the approval explainer and revoke old approvals. More events are listed in the Rabby security history.

Silent-signature bug, August 2026

In August 2026 security researcher V12 disclosed a flaw in the extension: a malicious site you had already connected to could obtain a signature without you seeing it, but only if your auto-lock was set to 10 minutes. Rabby's code fix made sure a pending signature request could no longer be approved just by unlocking the wallet. The fixed extension was released on 11 August 2026; the mobile app was not affected and no exploitation was reported (TechFlow, 20 August 2026; Rabby GitHub). Keep Rabby updated.

In September 2025, during a widespread attack on popular JavaScript packages, Rabby said its wallet was not affected because it pins its dependencies (Rabby on X, 9 September 2025, as summarised by IQ.wiki).

The bigger risk: fake Rabby wallets

Impersonation causes far more Rabby-related losses than bugs do:

• Fake App Store app (February 2024). An app called "Rabby Wallet & Crypto Solution" from a developer called "Solution Development" stole seed phrases before Rabby's real iOS app was released. Rabby warned users on 16 February 2024 (ForkLog).
• Fake Firefox add-ons (2025 and 2026). Socket researchers found 13 modified Rabby builds among 40 malicious Firefox add-ons that sent wallet data to attackers (The Hacker News, 20 August 2026), and four more Rabby clones in October 2026. Rabby has no official Firefox add-on.
• Fake websites. Search results for Rabby are full of look-alike download pages on free hosting, course platforms and hacked sites.

Details and recovery steps: fake Rabby wallet scams.

Red flags in the signing window

Rabby's pop-up gives you the information; you still have to read it. Stop and reject if you see any of these:

• Tokens leaving that you did not expect, for example a "free mint" or "claim" that shows your ETH or stablecoins going out.
• An approval or permit for a token you were not trading, especially for an unlimited amount or to a spender Rabby marks as new or risky.
• A "set approval for all" request for an NFT collection on a site you do not know. It hands over every NFT in that collection.
• An off-chain signature (permit) you do not understand. Signing a message can authorise a transfer without any gas being spent at that moment.
• A first-time recipient for an address you thought you had used before. This is the classic sign of address poisoning; compare the full address with the address checker.
• A site that is not the one you meant to visit. Check the domain shown in the request.

Honest limits

• It is a hot wallet. Keys live on an internet-connected device. Malware on your computer or phone, or a malicious browser extension, can still steal them.
• Browser risk. Every other extension you install can read and change web pages, and some can be taken over by attackers. Keep few extensions.
• Warnings can be ignored. Rabby lets you sign past its warnings, and blind signing is still possible for unusual transactions.
• Simulation has limits. It shows what would happen now; it cannot predict what an approved contract will do later, and it may not run on every custom network.
• Weak passwords weaken local encryption. Use a long, unique password.

How to use Rabby safely

1. Install only from the official stores. Type rabby.io yourself or use a bookmark, and check the extension ID acmacodkjbdgmoleebolmdjonilkdbch with the verifier.
2. Write your seed phrase on paper or metal and keep it offline. See seed phrase backup.
3. Never type your seed phrase into a website, chat or form. Rabby and DeBank never ask for it, and real support never DMs you first.
4. Read the balance-change preview on every signature. Stop if it shows tokens leaving that you did not expect.
5. Avoid unlimited approvals and revoke old ones regularly.
6. Use a hardware wallet for savings and keep only spending money in a hot account.
7. Keep your browser and Rabby updated, and remove extensions you do not need.

Frequently asked questions