Software wallet · only you hold the keys

MetaMask review: an Ethereum wallet that now holds bitcoin too

MetaMask is a free self-custody wallet for your browser and phone, built by Consensys in the United States. It covers Ethereum and other EVM networks plus Solana, bitcoin and Tron, but it cannot hold XRP, Cardano or dogecoin.

Go to metamask.io Buying first? Compare platforms

By PlatformCrypto.eu editorial team · checked on 13 October 2026

MetaMask at a glance

Our verdict

Pros

One 0x address across Ethereum and every major EVM network, with separate Solana, bitcoin and Tron accounts.
Works with Ledger and Trezor devices for EVM accounts.
Kraken and Bitvavo both name it as a wallet that can sign an address-ownership message.
Scam warnings for sites and signature requests are switched on by default.

Cons

No native XRP, Cardano, dogecoin or litecoin.
Adds its own 0.875% on swaps and 1% on in-app purchases.
The code is public on GitHub, but the app is not released under an open-source licence.
An infrastructure security incident from 30 September 2026 is still under investigation.

Type and price

Software wallet

Browser extension
App

Free app

Our coins

11 of our 21 coins

Coins with their own page on this site. Greyed out and struck through: MetaMask cannot hold it itself. Checked on 13 October 2026.

Security

Only you hold the keys
Partly open source

More than 100 million downloadsaccording to MetaMask, as seen on 13 October 2026

What MetaMask is, and who makes it

MetaMask began as a browser add-on for Ethereum and has grown into a multichain wallet for Chrome, Firefox, Brave, Edge, Opera, iOS and Android. It is run by Consensys Software Inc., based in Fort Worth, Texas. The company quotes more than 100 million downloads across Google Play, the App Store and the Chrome Web Store; that counts installs, not active users.

Your keys are generated and encrypted on your own device. The terms of use say MetaMask stores no backup of your private key and cannot recover it. Because no company holds your crypto, MetaMask sits outside MiCA, the EU crypto-asset regulation. That tells you who is responsible, not how good the software is.

Supported networks and coins

MetaMask lists 19 networks it supports itself, among them Ethereum, Base, Arbitrum, OP, Polygon, BNB Chain, Avalanche and HyperEVM. Non-EVM support arrived in stages: Solana in 2025, bitcoin on 15 December 2025 and Tron on 15 January 2026. Each account now bundles an EVM address, a Solana address and a bitcoin address.

Of the coins with their own page on this site, MetaMask can hold these without outside help: bitcoin, ether, solana, BNB, TRX, AVAX, HYPE on HyperEVM, and the Ethereum tokens SHIB, LINK, PEPE and UNI. The rest, from XRP and Cardano to Stellar and Hedera, are either missing or reachable only through Snaps written by third parties.

MetaMask fees: swaps, buying and gas

Installing MetaMask costs nothing. What you pay depends on what you do:

Action	Paid to MetaMask	Also payable
Sending or receiving	Nothing	Network fee (gas)
Swap via the Swap button	0.875%	Gas and the rate of the liquidity source
Buy via the Buy button	1% of the euro amount	The provider's own fees

In-app purchases are carried out by a separate firm such as MoonPay or Transak. That firm checks your identity, takes your payment and sets its own price; MetaMask only collects the quotes, and which providers appear depends on your country. Our comparer looks at a different route: buying on MiCA-licensed exchanges and then withdrawing to your own wallet. How we compare explains the method.

How secure is MetaMask?

Setting up a wallet gives you a 12-word Secret Recovery Phrase that restores every account in it. Your password only unlocks MetaMask on a device where it is already installed. Instead of writing down the phrase, you can sign up with Google, Apple or Telegram; MetaMask then splits the phrase into encrypted pieces stored online, and you need both that login and your MetaMask password.

Security alerts are on by default. They screen websites, signature requests and transactions using MetaMask's own analysis and partners such as Blockaid, label them "Warning" or "Malicious", and leave the final decision to you.

The open question at the time of writing is the incident disclosed on 30 September 2026. MetaMask said part of its infrastructure was affected and pulled validators from its non-custodial staking service as a precaution; on 1 October it reported no indication that wallets or customer funds had been affected. The investigation was continuing on 13 October 2026.

Withdrawing from a European exchange to MetaMask

Under the EU's travel rule, an exchange sending more than €1,000 to a self-hosted address must check that the address is yours. One accepted method is a signed message, which MetaMask can produce. Bitvavo mentions MetaMask for this, either connected directly or through WalletConnect. Kraken runs the check through Reown, the new name of WalletConnect, for EVM wallets. Bitcoin and Solana addresses can be verified there only in Kraken's web version, not in its mobile app.

For ether, check which network the exchange offers. Your 0x address is identical on Ethereum, Base and Arbitrum, so ether withdrawn over a layer 2 still reaches you, but it sits on that network until you switch MetaMask to it or bridge it. Platforms also report the total you move to self-hosted wallets to the tax authority in your country of residence under DAC8; the address itself is not part of that report.

Practical risks to watch

Cloned apps. MetaMask itself warns about fake versions in the App Store and Google Play that record your phrase. Install from the links on metamask.io.
Approvals. A drainer usually asks you to approve token spending, sometimes without a limit. Check the amount before you confirm, and revoke old approvals you no longer need.
Fake support. MetaMask never contacts users first and has no phone line. Anyone asking for your 12 words is attempting theft.
Hardware pairing. Ledger and Trezor devices can sign for MetaMask's EVM accounts, so the keys stay off your computer. See our Ledger review and Trezor review, or compare all five wallets on crypto wallets.

In four steps

Moving crypto to MetaMask

Buy on a licensed platform
Our comparison shows where your amount buys the most crypto. We only list platforms with a MiCA licence.
Copy your receive address
In MetaMask, pick the coin and Receive, then copy the address. After pasting, check all of it: look-alike addresses often differ only in the middle.
Match the network
When you withdraw, choose a network your wallet uses for that coin; the wrong one can cost you the coins. A memo or tag is rarely needed when the address is your own.
Send a small amount first
Once it arrives, send the rest. Above €1,000, and on some platforms sooner, EU rules mean you prove the wallet is yours, for example by signing a message.

Questions about MetaMask

Is MetaMask regulated under MiCA?

No. Recital 83 of the MiCA Regulation keeps providers of non-custodial wallet software outside its scope, because they never hold your assets. The firms that sell you crypto through the Buy button are different: in the EU they need their own authorisation, which you can look up in ESMA's register.

Can you store XRP in MetaMask?

Not with MetaMask on its own. XRP appears only in a list of Snaps, which MetaMask describes as plug-ins built by other developers. Cardano and dogecoin have no route at all, so holders of those coins need a different wallet.

Does MetaMask support bitcoin?

Yes. Since the launch on 15 December 2025, every MetaMask account has its own bitcoin address alongside its Ethereum one. For now only native SegWit addresses starting with bc1q are used, with Taproot listed as coming later.

Is MetaMask open source?

Partly. Anyone can read the extension and mobile code on GitHub, but Consensys publishes it under its own terms: the extension may only be reused non-commercially, and the mobile code not without permission. Many of the underlying libraries, such as the keyring controller, carry the MIT licence.

What was the MetaMask security incident in September 2026?

On 30 September 2026 MetaMask said it was responding to an incident in part of its infrastructure and began exiting validators run by its staking service, including those in Lido. Its update of 1 October said there was no sign that wallets or customer funds had been touched. The cause had not been published by 13 October.

What happens if I lose my Secret Recovery Phrase?

While MetaMask is still unlocked on one of your devices, you can reveal the phrase again or move your funds to a fresh wallet. Once that device is gone too, nobody can restore access: Consensys keeps no copy of your keys and states plainly that lost funds cannot be recovered.