MetaMask

MetaMask is the default doorway to Ethereum for most people: a wallet that lives in your browser and phone, stores your keys locally, and lets websites ask it to sign transactions. It is how you connect to a decentralized exchange, mint an NFT or use a lending app.

The one thing that matters when installing it is the source. Get the extension only from the official metamask.io site or your browser's official add-on store, and confirm the publisher is Consensys. Fake “MetaMask” extensions and lookalike sites exist specifically to capture recovery phrases, and the extension you install is the extension that will hold your money.

MetaMask itself has a clean record: as a non-custodial wallet it holds no user funds centrally, and its code has not been breached to drain users at the wallet level. The keys live on your device, encrypted by your password. That design moves the risk from the company to you, and nearly every real MetaMask loss traces to that boundary rather than to a flaw in MetaMask.

The recurring dangers are: phishing sites and fake support that trick you into typing your 12-word recovery phrase (never do this — no legitimate service asks for it); malicious token-approval or blind-signing requests that you approve without reading; and, historically, cloud-backup exposure — in 2022 some users whose devices backed the encrypted MetaMask vault up to iCloud with a weak password were phished and drained. The defences are ordinary and effective: keep the recovery phrase offline, read what you are signing, and revoke approvals you no longer use.