Web3 – Cyber Scrilla

MetaMask is one of the most popular wallets for storing crypto, NFTs, and other digital assets. With more than 30 million monthly active users, its reputation as the go-to crypto wallet continues to grow. But, is MetaMask safe? I've been using MetaMask for years now without any safety concerns. But that doesn't mean this self-custody wallet is completely safe. Below you'll learn what makes MetaMask safe, the risks of using it, and a potentially better alternative. Is MetaMask Wallet Safe? MetaMask is safe for buying and selling digital assets. It's a self-custody wallet that’s secured by a private key, password, and biometric authentication. But, it’s prone to hacks since it’s always connected to the internet. Hence, it's a poor option for storing any valuable assets long-term. What makes MetaMask safe In general, MetaMask has many features that make it safe to use. MetaMask’s main safety features include: 12-word private key Your 12-word phrase is the key to accessing and controlling your MetaMask wallet and the assets within. Without this key, it’s nearly impossible to gain access to your account. MetaMask randomly generates a seed phrase for you when you create a new wallet. Since it's a self-custody wallet, you own this key. Password Your MetaMask password is the second layer of defense to keep unwanted folks out. If you forget your password, you can reset it by entering your private key. If your private key is already entered and someone knows your password then they can access your account. Biometric authentication Biometric facial recognition is MetaMask’s third line of defense. This feature is only available on the mobile app and should be enabled. It’s important to note that if you enable facial recognition it overrides the need for a password to be entered. The main concern regarding MetaMask and other similar crypto wallets is that it’s a software (hot) wallet. This simply means that it is always connected to the internet. Whether you are using the MetaMask chrome extension or the app, all of your wallet’s private info remains on either your computer or mobile device, which is connected to the web. This makes it more susceptible to scams and phishing attacks. Privacy and Anonymity MetaMask doesn't require you to submit any personal information to create a wallet. Instead, you maintain complete control over your private key and your assets. Additionally, MetaMask doesn't store user data—at least not if you don't want it to. You control what MetaMask is allowed to store. When you first set up your wallet, you'll be asked to share certain data to help MetaMask improve its product. Of course, you don't have to agree to this. Moreover, there are additional data points the wallet may use to provide you with the best user experience such as automatically importing NFTs into your wallet. These preferences can be changed in the settings. Can MetaMask Be Hacked? Common MetaMask hacks A MetaMask wallet can be hacked if the user allows it. For a MetaMask wallet to be hacked you would have to sign a malicious transaction using your wallet which would grant the hacker access or you would have to give out your private key. Both of these “hacks” are user errors that can be avoided. Below are the most common MetaMask hacks. Phishing links Phishing links are the number one way MetaMask users are hacked. Hackers will create a malicious website in hopes that you will connect your web3 wallet to it. Generally, there is an incentive to get you to click on a link and connect your wallet to the site. These incentives can be free crypto or NFTs and even fake websites that imitate popular NFT projects and marketplaces. In fact, there have been times when Google listed fake Opensea websites at the top of the search rankings. Then without realizing it’s a fake site, users go to the site, connect their wallets, and then lose all of their digital assets. How does this happen? It’s simple. Upon connecting your wallet to the site you are prompted to approve the connection (this is a normal request). However, this specific request is actually asking for your approval to access your wallet. Once you sign the transaction, the hacker gains access and sends all of your assets to their own wallet. Keylogging attack Keylogging is another type of attack that can be used to gain access to your MetaMask wallet in a number of ways. Although a keylogging attack isn’t as common as a phishing attack, they still happen. Essentially, a scammer will install keylogger software on your device in an attempt to record your keystrokes. By recording your strokes, a hacker could learn your MetaMask password or even your private phrase. Of course with this info, they can gain access to your account. Moreover, if a keylogger isn’t successful in recording your private phrase or password, the hacker could still get access to files on your device where you might have your private wallet info stored. That’s why it’s crucial to never store your wallet’s private info anywhere online, including your computer, mobile device, or cloud server. Dusting attack A dusting attack is where a scammer sends numerous amount of digital assets (crypto or NFTs) to multiple wallet addresses in hopes the user will somehow interact with the asset. The asset itself generally isn’t dangerous, however, its aim is to lead you to a link that is malicious. Oftentimes, scammers will send an NFT to your MetaMask wallet that has a bid on it. But, when you go to accept the bid, it doesn’t work. Instead, a message appears prompting you to take action by visiting a website for the solution. Upon visiting this website, you are hacked. In an attempt to prevent users from falling for this scam, MetaMask doesn't display any tokens that you didn’t manually add to your wallet yourself. However, these tokens are still there, and in the case of NFTs, you will see them displayed on your profile when you visit an NFT marketplace. Fake MetaMask representatives Another common scam involves fake MetaMask customer service and support representatives reaching out to you via social media comments, DMs, and emails in an attempt to connect with you. Although this can be random at times, it often occurs when you use “trigger words” on social media. These trigger words then prompt bots to spam the comments section and your DM with fake reps who claim they can help you. You’d be surprised how many people fall for this scam. That said, real people are behind these bots and they put in the effort to get on a video call with you. Once you’re chatting, they request that you screen share your computer and sign into your wallet so that they can better assist you. From there, they have all the info they need to access your account and steal your digital assets. Notably, these fake representatives don’t only appear as MetaMask reps, they will also pretend to work for other popular web3-related brands like Coinbase, Ledger, and Opensea among others. Is MetaMask Mobile Secure? MetaMask Mobile is as safe as the Chrome extension. It's secured by your recovery phrase, password, plus biometric authentication. However, it remains vulnerable to hacks and phishing attacks. The main downside to MetaMask Mobile is that if you lose your device someone could potentially gain access. The better question to ask is which browser is safest to use with MetaMask. Many people who use MetaMask Mobile often browse sites using MetaMask’s browser. This is not the safest option, especially when it comes to detecting malicious sites. Overall, Google Chrome is one of the best web browsers to detect phishing sites and other potentially malicious websites. So, rather than searching directly on MetaMask’s browser, utilize Google Chrome and then connect your wallet after verifying that the site you’re visiting is safe. Is It Safe to Store Crypto in MetaMask? It's not safe to store cryptocurrency in your MetaMask wallet. Since it's constantly connected to the internet, MetaMask is susceptible to various scams and hacks. That means your crypto can be compromised via vulnerabilities on your device or an unencrypted internet connection. You might be okay storing a reasonable amount of crypto on MetaMask, but by no means should you consider it a secure long-term storage solution. The only time you should fund your MetaMask wallet with cryptocurrency is if you're planning to make a purchase. And depending on what you purchase, maybe it's an NFT, you should instantly transfer your purchase along with any remaining crypto to a hardware wallet for safekeeping. Is MetaMask Safer than Coinbase Wallet? MetaMask is just as safe as Coinbase Wallet. These wallets have similar safety features including an active bug bounty program, a randomly generated 12-word seed phrase, biometric authentication, and are compatible with Ledger hardware wallets. The main advantage that MetaMask has over Coinbase Wallet is its age. MetaMask has been around since 2016, whereas Coinbase Wallet (not the exchange) was founded in 2018. Hence, MetaMask has had more time to discover potential flaws in its security system. That said, both wallets have an active bug bounty that allows developers to submit any issues they might find in the software, for a nice reward. This incentive helps keep both wallets safe. Wallet Safety FeaturesMetaMaskCoinbaseYear founded20162018Active bug bounty programYesYesSelf-custody (you own your keys)YesYesSoftware wallet (hot wallet)YesYesTwo-factor authenticationNoNoBiometric authenticationYesYesAuto-lock timerYesYesRandomly generated 12-word seed phraseYesYesCompatible with Ledger wallets (cold wallets)YesYesMetaMask vs Coinbase Wallet safety features What’s Better Than MetaMask? Me holding my Ledger hardware wallet The best alternative to MetaMask is a hardware wallet like Ledger. Hardware wallets are physical devices that store your private info offline which makes it nearly impossible to hack. Whereas MetaMask is constantly online making it an easy target. A hardware wallet is the most secure storage solution. It’s important to note that if you decide to use a hardware wallet to store your assets, you must keep it offline to ensure it remains as secure as possible. The common misconception is that if you use a hardware wallet like Ledger you’re completely resistant to hacks. That’s just not true. Your hardware wallet can be hacked similarly to your software wallet. If you connect a hardware wallet to a malicious website and you approve a transaction that enables a hacker to gain access, you’re going to get hacked. The better option is to use your hardware wallet as a storage solution for your digital assets. Hence, you can use your MetaMask wallet to make purchases and trades, but use a hardware wallet to store your assets. That way, if your MetaMask wallet is hacked, you don’t have anything stored on it. How to Keep Your MetaMask Wallet Safe 10 ways to keep your MetaMask wallet safe Even though MetaMask might not be the safest crypto wallet, we understand that it remains one of the most widely-used wallets. So, if you do decide to use MetaMask just make sure you know how to keep your wallet safe. I won't go into too much detail about how to keep your MetaMask wallet safe as this topic deserves its own article. However, I'll gladly give a brief breakdown of some common safety tips you can implement today. Only download MetaMask from the official site. Store your seed phrase in a secure location. Create a secure password you have used before. Enable biometric authentication on the MetaMask app. Enable the auto-lock timer. Don't store your assets on MetaMask. Never click on links you don't trust. Always disconnect your wallet from websites. Avoid using public wifi. Use a VPN. Again, I've linked the complete breakdown with actionable steps to secure your wallet above. If you want all of my greatest tips, make sure to check it out. MetaMask Safety Key Takeaways MetaMask is safe to use for transactions but is not recommended as a long-term storage solution for digital assets. Phishing links are the most common way MetaMask wallets are hacked. Below are some ways that MetaMask protects its users. Seed phrase Password Biometric authentication Auto-Lock Timer Do you have assets like crypto or NFTs that you value? If so, make sure you know how to securely store your digital assets to ensure they remain safe.