MetaMask separated its corporate identity from Consensys, the firm behind the wallet.

Overview Debates Related claims Topics Sources

Starknet wallets handle zero-knowledge proof generation and shielded balance data during Shadow Account operations without requiring developers to access users' viewing keys.

Two Safe wallets affected by the FlashLoopAdapter exploit belonged to a single owner, and both wallets disabled the vulnerable FlashLoopAdapter module immediately following the October 1, 2026 attack

MetaMask stated that it has identified no immediate threat to MetaMask wallets or customer funds as a result of its infrastructure security incident disclosed on September 30, 2026

MetaMask and Lido emphasized that their staking arrangement is non-custodial and that MetaMask does not manage or hold withdrawal keys for client stake.

MetaMask disclosed on September 30, 2026, that it is responding to an ongoing security incident affecting part of its infrastructure.

MetaMask is proactively exiting its operated Ethereum validators within the Lido liquid staking protocol as a precautionary measure to protect client assets.

Multisig wallets should require manual owner approval for all module-executed transactions

Custom Safe modules introduce unacceptable security risks to multisig wallets

DeFi users bear primary responsibility for the security of third-party wallet integrations

Safe modules can execute wallet transactions without requiring standard owner signatures, meaning a bug in an enabled module such as FlashLoopAdapter can grant attackers a direct route to wallet assets

Following the October 1, 2026 FlashLoopAdapter exploit, the owner of the two affected Safe wallets disabled the FlashLoopAdapter module to prevent further financial losses

The October 1, 2026 FlashLoopAdapter exploit drained two Safe wallets belonging to a single owner, resulting in an estimated net loss of 114.09 ETH, valued between $305,000 and $310,000

DeFi users bear the primary responsibility for vetting third-party wallet integrations

DeFi users should avoid enabling third-party automation modules on multisig wallets

Elastic Security Labs identified a single Ethereum wallet used to deploy and update KREMLIN's malicious contracts, which was associated with 82 USDT transfers totaling approximately 20,778.97 USDT received and 19,016.96 USDT sent between June 19, 2025, and August 24, 2026.

The transaction timing of the KREMLIN-linked Ethereum wallet aligned with working hours in the UTC-3 time zone used by São Paulo, suggesting Brazil as a plausible operator location.

MetaMask utilizes artificial intelligence, through its security partner Blockaid, to detect personalized scams, phishing, and malicious transaction flows in real time.

MetaMask announced new wallet protection features on September 14, 2026, introducing warnings for lookalike addresses, investment and romance scams, and first-time recipients.

MetaMask is integrating a route to priority customer support within its scam warning interface to assist users who are uncertain about proceeding with a transaction.

The MetaMask 'Added Protection' feature automatically reverts transactions that differ from their previews, launching first on the MetaMask browser extension before expanding to mobile platforms.