Is MetaMask safe? What its terms and incident record say
Is MetaMask safe?
MetaMask's terms place the keys with you and disclaim access to them. The terms disclose that another party in the stack can act on an address. No primary-source incident is recorded, which is not proof of none. Its terms name no gambling rule. Liability is capped at fees paid over twelve months, or 25,000 US dollars if none.
Documents last checked Reviewed by CryptoGuardz Register Desk, editorial desk
Disclosure: CryptoGuardz has no commercial relationship with MetaMask and earns nothing if you install it. Every statement below is read from a document MetaMask publishes or from a public record, and each carries the date it was read. Corrections go to the corrections page.
MetaMask review: the documents
This is a review of the documents MetaMask publishes, not a test of the product: no transaction was signed and no code audit was read. The contracting party named is Consensys Software Inc.; on jurisdiction the record says: Not stated as a jurisdiction of incorporation. The custody position comes from the MetaMask Terms of Use, including Appendix 1 Additional Offerings, read 2026-09-22. The record quotes 14 clauses across 7 topics, and 8 sub-service clauses where the app hands a swap, purchase or staking to another party. MetaMask's terms place the keys with you and disclaim access to them. No cloud or hosted backup is offered; recovery depends on the copy you keep. 3 clauses let the provider suspend or withdraw access to the app; the keys stay yours, the interface does not. Liability is capped at fees paid over twelve months, or 25,000 US dollars if none. Its terms name no gambling rule.
Has MetaMask been hacked?
No primary-source incident was found for MetaMask in this collection: no company disclosure, no public vulnerability register entry and no regulator action. That is not proof that none happened. It is the absence of a search result, and a forum post or a press report is not recorded here until a primary source confirms it.
MetaMask support and scams
The official domain in the record is metamask.io. Type the domain yourself rather than following a link to it.
Real support never asks for a seed phrase. The recovery phrase restores the whole wallet on any device, so whoever is given it can move everything it controls, and no support agent needs it to answer a question. What MetaMask stores, by the record: Nothing is stored by MetaMask. The terms state MetaMask will not store a backup of and will not be able to discover or recover the private key or secret recovery phrase, and warn that storing the phrase in cloud storage or on a personal device increases the risk of compromise.
Support links reached from ads or direct messages are the commonest drain. A search ad, a reply to a public complaint or a direct message offers help, the link opens a page that looks like metamask.io, and the page asks you to “validate” or “sync” the wallet by entering the phrase. Once it is typed in, the wallet is emptied and nothing in the terms gives a way back.
If money has already gone, the next message offering to get it back is the commonest second loss. The FBI, the FTC, the CFTC and the UK FCA warnings about it are quoted on crypto scam recovery: what is real.
MetaMask fees and limits
One clause in the record set a fee or a limit on what you can do through the app. They are quoted as written. Network fees paid to the chain are not part of the record.
We reserve the right to change, suspend, remove, disable, or impose access restrictions or limits on the use of any Third Party Service at any time without notice.metamask.io
What we could not verify
The gaps in this record, as the record states them. A point listed here was looked for and not confirmed; it is neither a finding for MetaMask nor against it.
- Whether MetaMask now offers a social-login or seedless wallet, and if so whether any party holds key material for it. The terms of use contain no such clause and no primary MetaMask source describing one was retrieved in this pass. Recorded as not tested rather than as absent.
- The names of the fiat on-ramp providers. The metamask.io/buy-crypto page refers to trusted global providers and industry-leading providers without naming any of them, and the privacy notice refers only to third-party providers. No named on-ramp counterparty could be sourced from a MetaMask primary document.
- Consensys Software Inc.'s jurisdiction of incorporation. Not stated in the terms of use or the privacy notice, and not tested against a company register.
- Documented incidents. No primary-source MetaMask or Consensys incident disclosure was located in this pass. Absence of a record here is absence of a search result, not evidence of no incident.
- The identity of the third-party infrastructure and strategy services behind Money Account. Unnamed in the terms.