Table of Contents
MetaMask is the most widely used self-custodial wallet in crypto, with over 100 million users worldwide. It connects your browser or mobile device to Ethereum, Polygon, BNB Chain, Arbitrum, Avalanche, Base, Optimism, and other EVM-compatible networks. As of 2025, MetaMask also supports Solana and Bitcoin natively.
MetaMask is a hot wallet, meaning your private keys live on an internet-connected device. That makes it convenient. It also makes it vulnerable if you do not follow security protocols. Most MetaMask drains happen because of user-side mistakes: exposed seed phrases, phishing sites, malicious token approvals, and signature scams.
This guide covers installation, seed phrase security, network setup, token management, transaction basics, and the specific attack vectors that empty wallets. These are not theoretical risks. They happen every day. The blockchain shows thousands of wallet drains weekly, and the pattern is nearly identical: a user signs something they should not have signed, or stores their seed phrase somewhere they should not have stored it.
Prerequisites
You need a desktop browser (Chrome, Firefox, Brave, or Edge) or a mobile device (iOS or Android). You need a secure place to write down a 12-word phrase offline. You need the ability to verify URLs character by character. If you plan to hold more than a few hundred dollars in crypto long-term, you should also plan to connect MetaMask to a hardware wallet like Ledger or Trezor. MetaMask is an access wallet, not a vault.
Step 1: Download MetaMask from the Correct Source
Go to metamask.io and download the extension or app from the official site. Do not search "MetaMask" in your browser's extension store without cross-referencing the official site first. Fake MetaMask extensions exist, and some have tens of thousands of downloads before they are removed.
The legitimate MetaMask browser extension has over 10 million users and thousands of reviews. If you see a low review count or a recent publication date, you are looking at a fake. If you download a counterfeit extension, it will steal your seed phrase the moment you enter it.
On mobile, download MetaMask only from the official Apple App Store or Google Play Store. Verify the developer is listed as MetaMask by ConsenSys. Check the number of downloads and the review history. A legitimate app will have millions of downloads and a long history.
Step 2: Generate Your Seed Phrase and Treat It Like Cash
When you create a new wallet, MetaMask will generate a 12-word Secret Recovery Phrase (SRP). This phrase is your wallet. Anyone with the full phrase can recover your wallet on any device, at any time, without needing your password. If someone gets your seed phrase, they own your assets.
Write the phrase down on paper in the correct order. Do not type it into a notes app. Do not take a photo of it. Do not save it in a password manager. Do not store it in cloud storage. Camera roll backups, cloud syncs, and password manager breaches are common seed phrase leak vectors.
Store the paper in a secure physical location that only you can access. Some users split the phrase across two locations. Others use a fireproof safe. The key is offline storage in a place you will not forget.
If you lose your seed phrase and lose access to your device, your wallet is gone. MetaMask cannot recover it for you. This is self-custody. You are the only backup.
Step 3: Set a Strong Password (But Know What It Does)
MetaMask will prompt you to create a password. This password unlocks MetaMask on your current device only. It does not encrypt your seed phrase in a way that makes it portable. If someone has your seed phrase, your password is irrelevant. They can recover the wallet on their own device without it.
The password protects local access. It stops someone from opening MetaMask on your laptop while you are away from your desk. It does not protect your wallet if your seed phrase leaks.
Set a strong password anyway. Use a unique string you do not reuse elsewhere. If your device is compromised by malware, a strong password buys you time, but it is not a substitute for seed phrase security.
Step 4: Verify Your Seed Phrase Backup
MetaMask will ask you to confirm your seed phrase by selecting words in the correct order. This step exists because users frequently write down the wrong words or write them in the wrong sequence. If your backup is incorrect, you will discover this when you try to recover your wallet and fail.
Take this step seriously. Verify every word. Confirm the order. Test your backup by recovering the wallet on a second device or in a fresh MetaMask instance before you send significant funds to it.
Step 5: Add Networks Beyond Ethereum Mainnet
By default, MetaMask connects to Ethereum mainnet. To interact with other networks, you need to add them manually or approve a network switch request from a dapp.
If you are using MetaMask version 11 or later, the network selector includes popular networks like Polygon, Arbitrum, Optimism, and BNB Chain. You can add them with a few clicks. If you are on an older version, update MetaMask. Version 12.x includes a native bridge aggregator and improved cross-chain tooling.
When adding a custom network, verify the RPC URL and chain ID from the official documentation for that blockchain. A malicious RPC endpoint can show you false balances or trick you into signing transactions on a different chain than you intended. If a dapp prompts you to add a network, cross-reference the details with the network's official site before approving.
Step 6: Add Tokens Manually or Through Detection
MetaMask detects popular ERC-20 tokens automatically on Ethereum and some other chains. For tokens that do not appear, you can add them manually by entering the contract address.
Always verify the contract address from the project's official site or a trusted source like CoinGecko or CoinMarketCap. Scammers create fake tokens with names identical to legitimate projects. If you add the wrong contract address, the token will appear in your wallet, but it will be worthless or malicious.
A common scam: a fake token appears in your wallet without you adding it. You did not buy it. It just showed up. The token often has a name like "Reward" or "Airdrop." When you try to sell it or interact with it, the malicious contract drains your wallet. Do not interact with tokens you did not intentionally add or receive from a verified source.
Step 7: Understand What You Are Signing Before You Sign It
Every transaction and signature request in MetaMask is a potential attack surface. The most common way users lose funds is by signing something they do not understand.
Token Approvals
When you interact with a decentralized exchange or DeFi protocol, it will ask for permission to spend a specific token on your behalf. This is a token approval. The approval can be limited to a specific amount, or it can be unlimited.
Unlimited approvals are common because they save gas on repeat transactions. But if the contract is malicious or if the dapp is compromised later, an unlimited approval gives the attacker permission to drain all of that token from your wallet.
If you approve an unlimited spend and later suspect the contract is malicious, you can revoke the approval before the attacker uses it. Go to a tool like revoke.cash, connect your wallet, locate the approval, and send a transaction to revoke it. This only works if you act before the attacker drains your wallet.
Signature Phishing and Permit2 Scams
Some scams do not require an on-chain transaction. They ask you to sign a message off-chain using a standard like EIP-712 or Permit2. The signature gives the attacker permission to move your assets later.
Because the signature is not recorded on-chain, you cannot see it in a block explorer. The attacker can wait days or weeks before using the permission, making it hard to trace the attack back to the malicious site you interacted with.
If a dapp asks you to sign a message that includes terms like "permit," "delegate," or "approval," read it carefully. Legitimate uses exist, but phishing sites also use these prompts to steal assets without triggering an on-chain transaction you would notice immediately.
MetaMask added Blockaid-powered transaction security alerts in 2024 and 2025 to warn users about risky signatures and contracts. If you see a warning, stop. Do not proceed unless you are certain the request is legitimate.
Step 8: Verify URLs Before Connecting Your Wallet
Phishing sites are the most reliable attack vector in crypto. A fake site looks identical to the real one. The URL differs by one character. You connect your wallet, sign a malicious approval, and your funds are gone.
Always verify the full URL before connecting MetaMask. Check for misspellings, extra characters, or domain extensions that do not match the official site. Bookmark the real URLs for dapps you use frequently.
In October 2023, MetaMask partnered with Blockaid to integrate privacy-preserving security alerts. MetaMask staff review contributions from ChainPatrol, the Security Alliance (SEAL), and over 100 community members providing threat intelligence. Malicious sites now show a warning within minutes of detection. Tens of thousands of new threats are blocked weekly.
But the blocklist is not perfect. New phishing sites appear faster than they can be flagged. Your first line of defense is manual URL verification.
Step 9: Send a Test Transaction Before Large Transfers
Blockchain transactions are irreversible. If you send funds to the wrong address or the wrong network, MetaMask cannot retrieve them. Neither can anyone else.
Before sending a large amount, send a small test transaction. Confirm that it arrives at the correct destination. Check the transaction status in an independent block explorer like Etherscan, BscScan, or PolygonScan. Verify that the receiving address matches the one you intended.
This habit costs you a few cents in gas. It has saved users millions of dollars in misrouted funds.
Step 10: Audit and Revoke Old Token Approvals
Every token approval you grant remains active until you revoke it. If you used a DeFi protocol six months ago and gave it unlimited approval to spend your USDC, that approval still exists today. If the protocol is hacked or if the developers go rogue, the attacker can drain your USDC using the old approval.
Go to revoke.cash or a similar tool and review your active approvals. Revoke any that you no longer use. Make this a regular habit, especially if you interact with new or experimental protocols.
Step 11: Connect a Hardware Wallet for High-Value Accounts
MetaMask integrates with Ledger and Trezor hardware wallets. When you connect a hardware wallet, your private keys never touch your computer or phone. Every transaction requires physical confirmation on the hardware device.
This setup protects you from malware, phishing, and most other attack vectors. Even if your computer is fully compromised, an attacker cannot sign transactions without physical access to your hardware wallet.
If you hold more than a few hundred dollars in crypto, connect MetaMask to a hardware wallet. If you hold more than a few thousand, consider using MetaMask only for small amounts and dapp interactions, and keep your main holdings in cold storage that never connects to the internet.
For more on setting up cold storage, see How To Set Up A Ledger Hardware Wallet.
Step 12: Understand MetaMask's Fee Structure
MetaMask charges a 0.875% service fee on swaps, which is added to the underlying pool fees (typically 0.05% to 0.3%). For a $1,000 swap, you pay $8.75 to MetaMask. If you perform the same trade directly on Uniswap or 1inch, you often pay less.
For U.S. dollar purchases using a credit card, debit card, Apple Pay, or Google Pay through Transak, MetaMask charges a 5.5% fee plus approximately $1 per order. These are high fees. If you plan to buy crypto regularly, use a dedicated exchange with lower fees and transfer the funds to MetaMask afterward.
MetaMask also takes a 15% cut on staking rewards if you stake ETH through the wallet's built-in providers. Direct staking or using a dedicated staking platform will give you better yields.
The convenience of staying inside MetaMask has a cost. For small trades and occasional use, the fee may be acceptable. For frequent trading or large positions, the markup adds up quickly.
Common Failure Modes and How They Happen
Seed Phrase Exposure
The most common way users lose their entire wallet is by exposing their seed phrase. This happens through cloud backups of notes apps, screenshots saved to camera rolls, password managers that get breached, and phishing sites that impersonate MetaMask's login or "2FA verification" process.
A sophisticated phishing campaign in 2024 targeted MetaMask users by mimicking a two-factor authentication flow. The fake site displayed a countdown timer and an "authenticity check" screen. The final step asked for the seed phrase. Users who entered it lost everything.
If your seed phrase is exposed, the only safe response is to move your remaining assets to a new wallet immediately and treat the old wallet as compromised. There is no way to "change" your seed phrase. The wallet is burned.
Fake MetaMask Extensions and Apps
Fake MetaMask extensions appear in browser stores regularly. Some stay live for weeks before they are removed. Users download them, enter their seed phrase, and the malware sends it to the attacker.
Cross-reference the official MetaMask site before installing. Check the developer name, the number of reviews, and the publication date. If anything looks off, do not install it.
Malicious Token Airdrops
A token you did not request appears in your wallet. It has a name like "Reward" or "Claim Your Prize." When you try to sell it or interact with the contract, it drains your wallet.
Do not interact with tokens you did not intentionally add. Do not try to sell them. Ignore them. If you want to hide them, MetaMask allows you to hide tokens from your view without interacting with the contract.
Unlimited Approvals on Compromised Contracts
You used a new DeFi protocol and granted it unlimited approval to spend your stablecoins. The protocol gets hacked. The attacker uses your old approval to drain your funds.
This risk is why you should revoke unused approvals regularly and why you should avoid granting unlimited approvals to contracts you do not fully trust.
What to Do Next
Send a small amount of ETH or a stablecoin to your new MetaMask wallet. Practice sending it to another address you control. Check the transaction in a block explorer. Confirm that you can see the transaction details, the gas fee, and the final balance.
Add a second network like Polygon or Arbitrum. Bridge a small amount of funds and confirm that the balance appears correctly. Interact with a simple dapp like Uniswap and practice approving a token swap. Revoke the approval afterward using revoke.cash.
If you plan to hold significant funds, connect a hardware wallet and test the full transaction flow with the hardware device before moving large amounts.
Bookmark the official MetaMask site, the block explorers you use, and the dapps you interact with regularly. Verify URLs every time. Make this a habit.
For guidance on managing crypto addresses safely, see What Is a Crypto Address and How to Use It Safely.
The Takeaway
MetaMask is secure if you follow the protocol. The wallet software itself is not the weak point. The weak point is user behavior: exposed seed phrases, phishing sites, malicious approvals, and signatures users do not understand.
Your seed phrase is your wallet. Store it offline. Verify URLs before connecting. Read every transaction and signature request. Revoke unused approvals. Use a hardware wallet for anything you cannot afford to lose.
The blockchain is transparent. Every drain, every scam, every exploit leaves a trace. The wallets that survive are the ones operated by users who verify first and sign second. MetaMask gives you the tools. Using them correctly is your responsibility.
For additional resources on security best practices, seed phrase management, and detecting malicious approvals, visit the official MetaMask security guide.
Frequently Asked Questions
What is the Secret Recovery Phrase and why does it matter?
The Secret Recovery Phrase (SRP) is a 12-word phrase generated when you create a MetaMask wallet. Anyone with the full phrase can recover your wallet on any device without your password. If your SRP is exposed, an attacker can drain your wallet completely. Store it offline on paper in a secure location. Never save it digitally, take a photo, or store it in cloud services. Camera roll backups and cloud syncs are common leak vectors that result in total wallet loss.
How do I know if I am on the real MetaMask site or app?
Download MetaMask only from metamask.io or verified app stores (Apple App Store, Google Play). The legitimate browser extension has over 10 million users and thousands of reviews. If you see low review counts or a recent publication date, it is fake. Always cross-reference the official MetaMask site before installing. Verify the developer name matches MetaMask by ConsenSys. One character difference in a URL is enough for a phishing site to steal your seed phrase.
What is a token approval and how can it drain my wallet?
A token approval grants a smart contract permission to spend a specific token on your behalf. Approvals can be limited or unlimited. Unlimited approvals save gas on repeat transactions but give the contract permanent access to that token. If the contract is malicious or gets hacked later, the attacker can drain all of that token from your wallet using the old approval. You can revoke approvals at revoke.cash before an attacker uses them, but only if you act quickly.
Should I use a hardware wallet with MetaMask?
Yes, if you hold more than a few hundred dollars in crypto. MetaMask integrates with Ledger and Trezor hardware wallets. When connected, your private keys never touch your computer or phone. Every transaction requires physical confirmation on the hardware device. This protects you from malware, phishing, and most attack vectors. Even if your computer is fully compromised, an attacker cannot sign transactions without physical access to your hardware wallet. For high-value holdings, use cold storage that never connects online.
How do I avoid phishing sites when using MetaMask?
Always verify the full URL before connecting your wallet. Check for misspellings, extra characters, or incorrect domain extensions. Bookmark official URLs for dapps you use regularly. MetaMask includes Blockaid-powered security alerts that warn about known phishing sites within minutes of detection, but new sites appear faster than they can be flagged. Manual URL verification is your first line of defense. One wrong character in a URL can result in total wallet loss through malicious approvals or signature requests.
