Rabby

Rabby is a self-custody Web3 wallet for Ethereum and EVM-compatible chains, built and maintained by the DeBank team and launched in 2021. It runs as a browser extension for Chrome, Brave, Edge and Firefox and as desktop and mobile apps, and it is fully open-source under the permissive MIT license, so its code can be inspected by anyone.

Its defining feature is what happens before you sign. Rabby simulates each transaction and shows a plain-language preview of the outcome — the exact balance changes, the token approvals you are granting, and any risk flags it detects on the contract or address — and it switches to the right network automatically. That pre-sign preview is aimed squarely at the way most wallet losses happen: people approving a transaction they could not actually read.

Rabby is non-custodial, so your private keys are generated and stored locally and DeBank cannot move or recover your funds. Its design leans into safety: the pre-sign transaction simulation, contract and address risk scanning, and built-in approval management exist specifically to help you avoid the phishing and blind-signing traps that account for most wallet drains. Being open-source means the code is public and open to outside review. As always, the recovery phrase is yours to protect — no one at Rabby can ask for it or reset it.

The wallet's key storage has not been breached to drain users. The one real incident sits in a feature: about a month after Rabby's Swap launched in 2022, its swap contract accepted an arbitrary target and calldata without validation, letting an attacker pull tokens from wallets that had approved that contract. Roughly $200,000 was taken; Rabby reimbursed affected users, and anyone who had used the old Swap was urged to revoke the approval. A separate, ongoing hazard is fake 'Rabby' apps and sites built to steal recovery phrases — install only from rabby.io or official stores. The Swap incident is recorded below.