MetaMask Wallet Review: Safety, Swap Fees, Hardware Wallets and Scams

Verdict: MetaMask is the most widely used self-custody wallet for Ethereum and other EVM networks, run by Consensys Software Inc. (doing business as MetaMask) from Fort Worth, Texas. It comes as a browser extension for Chrome, Firefox, Brave, Edge and Opera and as an iOS and Android app, lists 700+ networks and supports Ledger, Trezor and QR hardware wallets. Its swaps carry a 0.875% service fee, and phishing, fake apps and malicious token approvals are the main risks to manage.

This review covers who runs MetaMask, what it supports in 2026, how its Secret Recovery Phrase and social-login options work, what swaps and other features cost, hardware wallet pairing, token approvals, safe setup, and the scams that target MetaMask users, including the fox-logo confusion behind searches like “trust wallet metafox”. Facts come from MetaMask’s own website, help centre and GitHub, checked in November 2026. For a head-to-head with other wallets, see our MetaMask vs Trust Wallet vs Phantom comparison.

Who runs MetaMask and is it legit?

MetaMask is a legitimate wallet made by Consensys Software Inc., which its terms of use (last updated June 2026) describe as “doing business as MetaMask” and as legally separate from Consensys Incorporated. The company lists an address in Fort Worth, Texas. MetaMask says it has 100M+ downloads, is available in 190 countries and offers human support in 134 languages.

The official website is now metamask.com: when we checked in November 2026, metamask.io redirected there, while help articles sit on support.metamask.io and the swaps documentation on metamask.github.io. Those are the addresses to trust. Any other domain using the MetaMask name or fox logo, including sponsored search ads, should be treated as a possible phishing site until proven otherwise.

What does MetaMask support in 2026?

MetaMask runs as a browser extension for Chrome, Firefox, Brave, Edge and Opera and as a mobile app on iOS and Android. Its homepage lists 700+ supported networks, Bitcoin and Solana among tradable assets alongside Ethereum and EVM chains such as Arbitrum, Base, BNB Smart Chain, Optimism and Polygon, and swaps across 100,000+ assets. The extension’s GitHub repository is public.

Beyond holding and sending tokens, the app has grown into a broader product. As of November 2026 MetaMask’s homepage advertises a MetaMask Card with 1% back on purchases where Mastercard is accepted, a Money Account with a variable, non-guaranteed yield on stablecoins, tokenised stocks powered by Ondo Global Markets, and leveraged perpetual futures powered by Hyperliquid. Leverage and yield products carry their own risks and availability limits by country, and nothing here is a recommendation to use them. The core wallet, which most readers need, is free to install.

How does the MetaMask Secret Recovery Phrase work?

When you create a MetaMask wallet you get a 12-word Secret Recovery Phrase (SRP), the master key to every account in that wallet. Whoever holds it controls the funds. Your password only unlocks MetaMask on one device. MetaMask cannot restore a lost SRP for you, and it states that it will never ask you for your phrase or private keys.

MetaMask’s help centre lists the rules plainly: write the SRP down and store it offline, check every word and its order, never keep it in a cloud file or email, and never give it to anyone, including people claiming to be MetaMask Support. Our guide on how to store a seed phrase covers paper, metal and multi-location storage.

What about signing in with Google, Apple or Telegram?

MetaMask also offers wallets tied to a Google, Apple or Telegram login. In that case you need both the login and your MetaMask password, and MetaMask warns that losing the password means losing the wallet unless you have also backed up the SRP. If you use social login, still write down the SRP so you are not dependent on one account provider.

What does MetaMask charge for swaps and transactions?

MetaMask Swaps builds each quote from DEX aggregators, market makers and decentralised exchanges and automatically includes a 0.875% service fee. On top of that you pay the network’s gas fee, which goes to the blockchain’s validators and changes with demand. Optional extras, such as Transaction Shield at $9.99 a month, are separately priced.

On an illustrative $1,000 swap, the 0.875% service fee alone is $8.75 before gas. That is convenient, but you can often pay less by trading on an exchange or a DEX directly, so compare the “you receive” amount. Our exchange fee comparison shows typical centralised exchange costs, and our Ethereum guide explains how gas pricing works.

Is MetaMask safe to use?

MetaMask is a well-established hot wallet: it is self-custodial, MetaMask cannot restore your phrase, and every transaction needs your approval. The risks come from what you approve. Malicious token approvals, signature phishing, fake MetaMask apps and extensions, clipboard hijacking and address poisoning cause most losses, so read each request before you sign and use a hardware wallet for larger balances.

MetaMask’s “Protect yourself” section names the main attack types:

• Signature phishing: attackers obtain an off-chain signature and later use it to steal your assets, so treat any signature request from an unfamiliar site with suspicion.
• Address poisoning: scammers send tiny transactions from look-alike addresses, hoping you copy the wrong one from your history.
• Clipboard hijacking: malware swaps a copied address for the attacker’s address, so check the first and last characters after pasting.
• Sweeper bots: once a key is compromised, automated scripts drain any funds sent to it. The only fix is a new wallet with a new SRP.
• Spoofing: fraudsters impersonate MetaMask to get your SRP or password. MetaMask says it will never ask you to verify or submit personal ID by email or direct message.

Third-party code can fail too. On 14 December 2023 attackers published malicious versions of Ledger’s Connect Kit library, used by many Ethereum dapps, which tricked users into signing draining transactions. Ledger’s incident report recommends Clear Signing so you can read what you approve on a hardware wallet screen.

What are token approvals and how do you revoke them?

A token approval is permission for a dapp to move a specific token from your wallet, needed for swaps, deposits and transfers. Many legitimate exchanges request very large approvals to save gas, but MetaMask warns that unlimited approvals are also how malicious sites steal funds. Set a custom spending cap when approving, and review and revoke unwanted approvals in MetaMask Portfolio’s spending caps view.

MetaMask notes that a spending cap is not limited by your balance, so an approval for “unlimited” stays dangerous even if your wallet holds little today: any tokens you receive later are exposed. Check approvals regularly, especially after using a new or unfamiliar dapp, and revoke those you no longer need. Each revocation is an on-chain transaction and costs gas.

Can you use MetaMask with a hardware wallet?

Yes. The MetaMask extension connects directly by USB to Ledger, Trezor and Lattice devices, and by QR code to air-gapped wallets including Keystone, NGRAVE ZERO, OneKey, AirGap Vault, Arculus, CoolWallet, D’Cent, imToken and Keycard Shell. MetaMask Mobile supports Keystone, Ledger and NGRAVE ZERO. The keys stay on the device, which must approve every transaction.

Pairing a hardware wallet does not stop you approving a malicious transaction: it only ensures nothing is signed without your physical confirmation. Read the details on the device screen, not just in the browser. For device choices, see our Ledger Nano X review, our Trezor review and the Ledger vs Trezor vs Coldcard comparison.

How do you install and set up MetaMask safely?

Start from metamask.com/download, which links to the official extension in your browser’s web store and to the official mobile app listings. Create a new wallet, write the 12-word Secret Recovery Phrase on paper, set a strong password, then send a small test amount. MetaMask warns that cloned apps exist that are programmed to record your recovery phrase.

1. Download only via metamask.com/download. Do not install from search ads, links in messages or third-party app sites. MetaMask suggests checking that the store listing has 50K+ ratings or 10M+ downloads.
2. Create the wallet and write the SRP down offline, in order. If you choose social login, back up the SRP as well.
3. Set a strong password for the device.
4. Add networks carefully. MetaMask warns about the risks of connecting to unknown networks: use well-known networks or official chain documentation.
5. Test, then fund. Send a small amount first, following our guide to moving crypto from an exchange to a wallet.

What does “trust wallet metafox” mean, and is it a real wallet?

The search mixes two separate products. MetaMask’s logo is a fox (MetaMask’s own GitHub hosts an animated-fox version of its logo), so people often call it “the fox wallet”. Trust Wallet is a different wallet from a different company, with its own site at trustwallet.com and support for 100+ blockchains. Neither official homepage lists a product called “MetaFox”.

That kind of confusion is what fake apps exploit: a listing that combines one wallet’s name with another’s logo, or uses a near-miss name, is a classic clone. Install MetaMask only from metamask.com/download and Trust Wallet only from trustwallet.com, check the developer on the store listing, and never enter a recovery phrase into an app you are not sure about. If you already hold coins in a wallet you cannot verify, move them to a fresh wallet created in the genuine app.

How does MetaMask compare with Trust Wallet and Exodus?

MetaMask is the default choice for Ethereum-based apps and has the widest hardware wallet support of the three, with a 0.875% swap fee. Trust Wallet is a mobile-first multi-chain wallet covering 100+ blockchains. Exodus is a polished desktop and mobile wallet for 50+ networks whose browser extension ended on 1 October 2026. All three are self-custody: losing the recovery phrase means losing the funds.

Our Exodus review covers that wallet in depth, and Exodus lists MetaMask as a compatible wallet for former users of its extension on EVM networks. Crypto assets are volatile, and this review is not financial advice.