Rabby Wallet security and release history
As of 25 October 2026, this timeline lists 31 dated events in Rabby Wallet's history: security incidents, audits, fixes, scam campaigns and major releases, including 2 exploits or disclosed vulnerabilities. No break of Rabby's key storage has been reported; the main dangers to Rabby users have been fake Rabby sites and extensions, phishing and malicious approvals.
Quick facts
- What were the most serious incidents?
- Rabby Swap (2022-10, ~$190,000–$200,000); Fake iOS app (2024-02, ~$100,000)
- What is the latest entry?
- 2026-10-23: Extension v0.94.13 released (scam-token removal, improved bridge progress display).
- What is the main lesson?
- Most losses of Rabby users start outside the wallet: fake Rabby sites and extensions, phishing and malicious approvals. Install Rabby only from rabby.io or the verified store listing, never type your seed phrase into a website, and read the simulation before you sign.
Timeline
| Date | Product | Type | Reported loss | What happened | Source |
|---|---|---|---|---|---|
| 2026-10-23 | Extension | release | — | Extension v0.94.13 released (scam-token removal, improved bridge progress display). | github.com |
| 2026-10-09 | Extension | audit | — | Least Authority final audit report on the Rabby Wallet extension. | github.com |
| 2026-10-05 | Fake Firefox add-ons | scam campaign | — | Mozilla removed 16 malicious Firefox extensions, four of them Rabby clones ('Raabby WaIIet') that stole seed phrases and private keys. | cyberinsider.com |
| 2026-08-27 | All apps | release | — | Volume-based swap and bridge fee discounts added to the extension: 0.12% for a single trade of $100,000–$1M, 0% from $1M (in-app discount tips followed on 11 September 2026). | github.com |
| 2026-08-24 | Extension | audit | — | SlowMist audit of the Rabby browser extension. | github.com |
| 2026-08-11 | Extension | vulnerability | — | Rabby fixed a 'silent signature' bug disclosed by researcher V12: a connected malicious site could obtain a signature unseen, but only if auto-lock was set to 10 minutes. No exploitation was reported. | TechFlow |
| 2026-08-07 | Extension | fix | — | Fix shipped in v0.94.2: a pending dapp signing request could survive wallet lock and be approved when the user unlocked. | github.com |
| 2026-08-03 | Fake Firefox add-ons | scam campaign | — | Researchers documented a months-long Firefox add-on campaign (March–August 2026) in which modified Rabby builds with names like 'RABB-Wallet' stole wallet data. | socket.dev |
| 2026-07-17 | All apps | release | — | Stablecoin-to-stablecoin swaps become fee-free. | github.com |
| 2025-12-12 | Desktop | other | — | Rabby announced that the Rabby Desktop backend would shut down on 31 December 2025 and asked desktop users to move to the browser extension; a new desktop version was described as planned. | KuCoin News (quoting Rabby on X) |
| 2025-09-09 | All apps | other | — | Rabby said it was not affected by the September 2025 npm supply-chain attack on popular JavaScript packages. | iq.wiki |
| 2025-09-06 | All apps | release | — | Rabby Perps (perpetual futures via Hyperliquid) launches on extension and mobile. | iq.wiki |
| 2025-09-02 | Mobile | audit | — | Least Authority final audit of the mobile app, with one medium issue (key-derivation parameters) unresolved at the audited version. | leastauthority.com |
| 2025-09-02 | Extension | audit | — | Least Authority second final audit of the Rabby extension. | leastauthority.com |
| 2025-08-21 | Extension | audit | — | SlowMist audit of the Rabby browser extension. | github.com |
| 2025-07 | Fake Firefox add-ons | scam campaign | — | Security researchers reported 150+ counterfeit wallet extensions on Firefox Add-ons impersonating MetaMask, TronLink, Rabby and others, with about $1M stolen across all of them. | ryder.id |
| 2024-12-17 | Extension | audit | — | SlowMist audit of the Rabby browser extension. | github.com |
| 2024-12-12 | Extension | audit | — | Least Authority final audit report on the Rabby Wallet extension. | leastauthority.com |
| 2024-10-18 | Mobile | audit | — | Least Authority audit of the Rabby mobile app. | leastauthority.com |
| 2024-09-09 | All apps | release | — | Gas Account launches: pay gas on supported chains from a USDC/USDT balance. | altcoinbuzz.io |
| 2024-08-20 | All apps | release | — | Built-in cross-chain bridge launches, powered by LI.FI. | li.fi |
| 2024-07-05 | All apps | release | — | 0.25% fee introduced on in-wallet swaps across extension, desktop and mobile. | crypto-economy.com |
| 2024-02-16 | Fake iOS app | fake app | ~$100,000 | A fake 'Rabby Wallet' iOS app from an unrelated developer was approved on the App Store before the real app and drained users who imported seed phrases. Rabby warned users and the app was removed. | forklog.com |
| 2024-01-23 | Extension | release | — | Rabby Points programme launches. | thedefiant.io |
| 2023-07-20 | Extension | audit | — | SlowMist security audit of Rabby Wallet. | github.com |
| 2022-10-11 | Rabby Swap | hack | ~$190,000–$200,000 | The Rabby Swap router contract was exploited: it executed arbitrary calls without checking them, letting the attacker take tokens users had approved to it. Rabby urged users to revoke approvals to the old contract; we could not confirm whether victims were reimbursed. | theblock.co |
| 2022-09-14 | Rabby Swap | release | — | Rabby Swap, the built-in token swap, launches. | cryptoactu.com |
| 2022-03-18 | Extension | audit | — | SlowMist security audit of the Rabby browser extension. | github.com |
| 2021-07-28 | Extension | release | — | DeBank publicly announces Rabby, a browser-extension wallet with automatic chain switching and readable signing requests. | thedefiant.io |
| 2021-06-23 | Extension | audit | — | Penetration test report on the Rabby Chrome extension published in the project's audits folder. | github.com |
| 2021-06-18 | Extension | release | — | First tagged release of the Rabby browser extension (v0.3). | github.com |
How to protect yourself
Install Rabby only from rabby.io, typed in yourself, or from the store listing it links to, and check the extension ID with our verification tool; never type your seed phrase into a website or give it to "support"; read Rabby's pre-sign simulation and warnings before every signature; revoke approvals you no longer need; and keep large amounts behind a hardware wallet. See fake Rabby scams and is Rabby safe?
Methodology and citation
Entries come from Rabby's own announcements and release notes, audit reports, security researchers and reputable news coverage; each row names its source. Loss figures are as reported at the time. Journalists and researchers may cite this page; please link to it. The data is free to download on our press page. Corrections are welcome.