Short answer: yes. Rabby is one of the safer EVM wallets you can use in 2026. It's open-source and audited, and it simulates every transaction before you sign so you can see what will happen. Nobody has breached its key storage. Its one theft, in 2022, hit a separate Swap contract, not the wallet, and an extension bug found in August 2026 was patched with no known victims. Your biggest risks are the usual ones: losing your own access, installing a fake copy of Rabby, or approving something malicious.
This review covers how Rabby protects you, its security record, where the real risks sit, and what to do if you're locked out.
We recover crypto wallets for a living, so we see where people lose money in practice.
What is Rabby?
Rabby is a non-custodial, EVM-focused wallet from DeBank, the DeFi portfolio company. It launched in 2021 and runs as a browser extension, a desktop app, and a mobile app. It works only with Ethereum and EVM networks: more than 80 are built in, and you can add others yourself. Bitcoin, Solana and Tron addresses won't work in it. Active DeFi users make up most of its audience, and many of them describe it as "MetaMask, but safer to sign with."
How Rabby protects your crypto
Open-source code. Rabby publishes its code on GitHub under an MIT license, so anyone can inspect how it handles your keys. Closed-source wallets ask you to take that on trust.
Keys encrypted on your device. Rabby uses the same keyring design as MetaMask. Your password encrypts your keys and recovery phrase, and Rabby stores the result in your browser's local storage. DeBank never sees them, can't recover your wallet, and can't reset your password.
Transaction simulation. Before you sign anything, Rabby simulates the transaction and shows you the result: which balances change, what approvals you're granting, and whether the contract or destination carries a risk flag. It warns you about malicious approvals, contracts linked to past exploits, and transfers to suspicious addresses. Most people who lose crypto do it by signing something they didn't understand, so this feature protects you every day you use the wallet.
Audits and hardware support. Firms including Least Authority and SlowMist have audited Rabby, and it works with Ledger, Trezor, OneKey, and Keystone hardware wallets.
Has Rabby ever been hacked?
Nobody has breached Rabby's key storage or infrastructure. It has had one real theft, and one serious bug that was fixed before anyone used it. Both are worth understanding.
The 2022 Rabby Swap exploit. In October 2022, about a month after Rabby launched its Swap feature (a trading contract, separate from the wallet's key management), attackers exploited a flaw in that contract. They drained roughly $190,000 from users who had granted token approvals to it. Rabby told users to revoke their Swap approvals on every chain and shipped a fix.
The exploit went through a smart contract and its token approvals. It didn't touch anyone's seed phrase, private keys, or encrypted vault. In DeFi, the approvals you grant to contracts carry their own risk, apart from how well your wallet guards your keys.
The August 2026 extension bug. A security researcher found a flaw in the Rabby browser extension that could let a malicious website pull signatures from the wallet without the user noticing. It only worked in a narrow case: you had to be connected to the malicious site and have set Rabby's auto-lock timer to exactly 10 minutes. Rabby shipped a fix on August 11, 2026, before the issue became public, and says it has found no sign that anyone exploited it. The mobile app wasn't affected. If you use the extension, make sure it's up to date.
Separately, in 2023 the security firm ZenGo published "Red Pill" research. It showed that malicious contracts could fool the transaction simulators in several wallets, Rabby among them, by behaving differently during simulation. The affected vendors patched the issue after disclosure, and no thefts were tied to it.
Your biggest risk is losing your own access
Most people who lose crypto with Rabby do it one of two ways. They lose their own access, usually by forgetting the password to a wallet whose recovery phrase they never backed up. Or they approve a malicious transaction despite the warnings.
Rabby also causes one specific mix-up. It lets you add a "watch-only" address to track a wallet you don't hold the keys to. If you added your funds as watch-only, Rabby won't let you send from them. You haven't been hacked or locked out; the account is view-only.
If you've forgotten the password to a Rabby wallet that's still installed, you may have a way back. Crypto Asset Recovery uses secure, offline password cracking to recover access to encrypted Rabby vaults. You only pay if we succeed.
For a recovery phrase problem, read our Rabby recovery phrase guide. For a forgotten password, see how to recover a lost Rabby password.
Rabby scams to watch for
- Fake extensions. This is the big one for Rabby users. Since at least March 2026, a campaign has published fake Rabby extensions on Firefox's add-on store under look-alike names such as "RABB-Wallet." Security firm Socket found 13 of them. They run Rabby's real code with one change: the moment you create or import a wallet, they send your keys to the attackers, before Rabby encrypts them. Mozilla has pulled the listings it found, but copies keep coming back. Install Rabby only from the links on rabby.io, and if you ever entered a recovery phrase into a copy you're unsure of, move your funds to a new wallet.
- Fake download sites. Impostors also clone Rabby's website. The official site is rabby.io.
- Seed-phrase phishing. Fake sites and fake "support" agents ask for your recovery phrase. Rabby will never ask for it.
- Malicious approvals and drainers. Rabby's simulation flags many of these, but only if you read the warnings instead of clicking through them.
- Fake airdrop and points campaigns. Rabby has run a genuine Points program, and copycats imitate it to phish users.
If someone has already stolen your crypto, password recovery can't bring it back, because the funds have left your control. Crypto Asset Recovery handles password and recovery-phrase recovery, and we can't trace or recover stolen funds. If you've been robbed, save the transaction hashes, wallet addresses and screenshots of every conversation, and report the theft to the FBI's Internet Crime Complaint Center at ic3.gov, or to your local police outside the US. Our free scam checker covers Ethereum only: if the funds went to an Ethereum address, it can look up that address or the transaction hash in public scam reports and show its recent transfers. It isn't a full trace. Don't trust anyone who guarantees they can get stolen crypto back.
Best practices to stay safe on Rabby
- Back up your recovery phrase offline. Never photograph it or type it into a website.
- Install Rabby only through the links on rabby.io, and check the publisher before you click install.
- Keep the extension updated.
- Read the transaction simulation before you sign. It only protects you if you look at it.
- Use a hardware wallet for large balances.
- Revoke old token approvals every so often.
Verdict: Is Rabby safe?
Yes, and it's one of the more security-minded choices for EVM users. Rabby is open-source and audited, and its transaction simulation catches the blind-signing mistakes that drain most wallets. The 2022 Swap exploit came through contract approvals, not keys, and the 2026 extension bug was fixed before anyone used it. What remains is the risk every self-custody wallet carries, plus one Rabby has more of than most: fake copies of the extension. Install it from rabby.io, guard your recovery phrase, and watch what you sign.
Already lost access or been scammed?
If you're locked out of a Rabby wallet you still control, we may be able to help. Crypto Asset Recovery recovers forgotten passwords on encrypted Rabby wallets using secure, offline techniques. If your funds were stolen, we can't trace or recover them. Report the theft at ic3.gov, and don't trust anyone who guarantees they can get it back.
- Forgotten password? See how to recover a lost Rabby password.
- Lost or partial recovery phrase? See the Rabby recovery phrase guide.
- Not sure where to start? Read how to find old passwords.
You only pay if we succeed. Completely risk-free.
Why Choose Crypto Asset Recovery to Recover Your Rabby Wallet?
- Secure, offline recovery. The cracking runs on air-gapped, offline machines, so your keys are never exposed online.
- Thousands of wallets recovered across MetaMask, Trust Wallet, Blockchain.com, and more.
- Success-based pricing. You only pay if we get you back in.
- Talk to a real person. Reach out any time, and you can get on a Zoom with our founders, the father-and-son team Chris and Charles.
- Featured in BBC, Forbes, Vice, The Block, and Business Insider.
Frequently asked questions
Is Rabby Wallet legit? Yes. Rabby is a genuine non-custodial wallet that DeBank released in 2021. Its code is open-source on GitHub, outside firms have audited it, and DeFi users rate it highly.
Can Rabby Wallet be hacked? Nobody has breached Rabby's key storage. In 2022, attackers exploited its separate Swap contract and drained about $190,000 from users who had approved that contract, but no seed phrases or private keys were compromised. In August 2026, Rabby patched an extension bug that could leak signatures in a narrow set of conditions; no one is known to have exploited it. Your own wallet can still be emptied if you install a fake copy of Rabby, reveal your recovery phrase, or sign a malicious transaction.
Is Rabby safer than MetaMask? Rabby shares MetaMask's keyring foundation and adds transaction simulation and risk scanning before you sign, which many users see as a safety upgrade. Either wallet is only as safe as your recovery-phrase habits.
Is Rabby safe for storing a lot of crypto? It can be, especially paired with a hardware wallet, which Rabby supports. Back up your recovery phrase offline, because self-custody has no reset button.
I forgot my Rabby password. Can it be recovered? If you have your recovery phrase, re-import it to reset the password. If you've lost the phrase but Rabby is still installed, Crypto Asset Recovery may be able to recover the password offline.
