MetaMask (Consensys)

The browser extension is what most people mean by MetaMask, and it is the version attackers copy most. The genuine Chrome Web Store listing is published by Consensys Software Inc.; on 21 September 2026 it showed version 13.49.0, about 12 million users and the store's note that the publisher has no history of violations (listing). MetaMask's own advice is to start at metamask.io/download and follow the store link from there (MetaMask Help Center).

1. 01Type metamask.io yourself and open the download page; do not click a sponsored search result.
2. 02On the store page, confirm the publisher and the user count before adding it.
3. 03Create a new wallet and write the 12-word Secret Recovery Phrase on paper. The extension shows it once, inside its own window, during setup.
4. 04Pin the extension icon so you can tell when a pop-up is really MetaMask. The real one only opens when you start an action on a site.
5. 05Remove browser extensions you do not use. A wallet is only as safe as the other code running in the same browser.

The last step is not paranoia. On 30 August 2026 BleepingComputer reported 19 Chrome Web Store extensions, some of them ordinary utilities bought from their original authors and later updated with malware, that loaded remote code and targeted MetaMask, Ledger, Trezor and several exchanges (BleepingComputer). None of them was MetaMask. They did not need to be.

MetaMask is a self-custodial wallet: keys are generated and encrypted on your device, and the company cannot move your funds or reset your phrase. It launched in 2016 as a browser extension for Ethereum and has been developed by Consensys, the Ethereum software company Joseph Lubin founded. For most of its life it handled only Ethereum and EVM chains. Native Solana arrived in extension v12.18 in May 2025 (The Block) and Bitcoin followed in December 2025 (The Block).

On 9 September 2026 Consensys announced it would split in two by the end of 2026. The existing company, Consensys Software Inc., rebrands as MetaMask under Lubin as chairman and CEO and keeps the consumer business. A new company keeps the Consensys name, run by Mike Kriak as CEO, and takes Linea, the Besu and Teku Ethereum clients and the institutional work (The Block).

The wallet also changed character. MetaMask's own 2025 recap lists a stablecoin, a card, a points programme, perpetual futures, prediction markets and Transaction Shield, a monthly subscription covering up to $10,000 a month in transaction losses plus priority support (MetaMask). The browser key-manager is now the front door to a consumer finance app.

No incident on record shows MetaMask's key storage being broken at scale. The money lost around MetaMask has gone through the user: a phrase typed into a phishing site, a malicious approval signed, a backup stored somewhere an attacker could reach. Two episodes show where the product itself contributed.

• April 2022, iCloud backups. An iPhone user lost about $655,000 after a fake Apple support call; the encrypted MetaMask vault had been backed up to iCloud by default, and the attacker got into iCloud. MetaMask then told Apple users to exclude the app from iCloud backup (BleepingComputer).
• June 2022, "Demonic" (CVE-2022-32969). Halborn found that browsers could save the recovery phrase typed into the extension's import field to disk in plain text. MetaMask fixed it in extension 10.11.3; Phantom, Brave and xDefi had the same flaw (Halborn).

The licence matters for anyone who counts "open source" as a safety property. The code is public on GitHub, but since August 2020 it has been under a custom Consensys licence, not MIT: free for personal and non-commercial use, with forks above 10,000 monthly users needing permission (LICENSE). Anyone can still read and audit it; nobody can freely ship a commercial fork of it.

The scams aimed at MetaMask users follow a few scripts. MetaMask says it will never hand out tokens, NFTs or airdrops, never contact you first, never handle support cases on social media, and never ask for the Secret Recovery Phrase outside the setup screen (MetaMask Help Center). The "MetaMask" emails about account verification, KYC deadlines or wallet suspensions fail that test. A self-custodial wallet has no account to suspend.

The 2024 SEC lawsuit against Consensys was about MetaMask's swap and staking services being unregistered broker activity, not about custody. The SEC dropped it in February 2025 without fines or conditions.

MetaMask makes money from the wallet in three places, all disclosed in its help center: a 0.875% fee on in-wallet swaps, the same 0.875% on bridges, and 0.875% when a staked position is withdrawn through Swaps (MetaMask Help Center). Network gas is extra. On a $10,000 swap that is $87.50 before gas and route spread, which is why heavy traders route through an aggregator or a DEX front end and use MetaMask only to sign.

The MetaMask Card is a Mastercard that spends from the self-custodial wallet, in Virtual and Metal tiers per MetaMask's 2025 recap; swapping into the spending token inside the card flow carries the same 0.875%. mUSD is MetaMask's dollar stablecoin, pitched as the balance that powers card payments, rewards cashback and yield. After the split both stay with the MetaMask company, alongside the "Money Account" savings product The Block reported at 4% APY (The Block).

The card and mUSD are not self-custody in the way the wallet is. A card needs an issuer and KYC, and a stablecoin is a claim on whoever holds its reserves. Using them adds counterparties; the wallet itself does not.

Not yet. On 19 September 2025 Joseph Lubin told The Block that "the MASK token is coming" and could arrive "sooner than you would expect" (The Block). A year later there is no MASK: CoinGecko's search for MetaMask returns only mUSD, and the September 2026 split announcement did not mention a token date.

What exists is MetaMask Rewards, a points programme for swapping, trading, spending and referrals. Season 1 ran from 28 October 2025 to 23 January 2026 and paid out in LINEA tokens. Most people expect MASK eligibility to lean on the same activity, but MetaMask has not said so.

Any site offering to "claim" or "check eligibility" for a MASK airdrop today is a drainer. Before a launch MetaMask will announce it on metamask.io and inside the wallet, not in a direct message.