Rabby Wallet Review

Rabby is a single self-custody wallet for Ethereum and EVM-compatible networks, built and maintained since 2021 by the team behind the DeBank portfolio platform. It ships as a browser extension for Chrome, Brave, and Edge, a desktop app for Windows and macOS, and native iOS and Android apps. There are no confusing product variants or renames to untangle. One wallet, one seed phrase, every platform.

The DeBank lineage shows in the product. Rabby reads like a tool made by people who track DeFi positions for a living, with the wallet surfacing your holdings and open positions across chains the moment you connect. That heritage helps and limits the product in equal measure, and this review accounts for both.

Rabby is non-custodial in the strict sense. Keys are generated and stored on your device, protected by a local password on each install, and the company cannot move or freeze your funds. No account signup and no KYC are required.

Two things separate Rabby from most hot wallets, and they are exactly the two things a wallet review should weight heaviest.
The first is transparency. Rabby is fully open source under the MIT license, with public GitHub repositories covering the extension, mobile, and desktop apps. Anyone can read the code that generates keys and signs transactions. That puts it a clear step ahead of MetaMask, whose code has been source-available under a proprietary license since 2020 and does not qualify as open source. On top of the public code sit repeated third-party audits: Least Authority reviewed the mobile app in October 2024 and the extension in December 2024, re-reviewed the extension in September 2025, and SlowMist audited the extension in August 2025, surfacing three findings, all at the lowest “Suggestion” severity. One Least Authority medium-severity finding remains open, which the auditors assessed as low real-world risk. Disclosing an open finding instead of burying it is the behavior you want from a wallet vendor.

The second is what happens before you sign. Rabby simulates every transaction and shows you the exact balance changes it will cause before you approve it, so a swap that would drain your account reveals itself in the preview instead of on the block explorer afterward. The engine labels known scam transactions, flags risky token approvals, scores the credibility of the site requesting the signature, and supports address whitelisting and a watch-only mode for monitoring an address without loading its keys. For a hot wallet, this is the best signing-transparency package in the category, and it addresses the way most self-custody users actually lose money, which is signing something malicious rather than losing a seed phrase.

The structural limit is unchanged by any of it. Rabby is a hot wallet running in a browser and on phones, with the attack surface that implies. For long-term storage, pair it with hardware, which Rabby makes easy across many device brands.

The 2022 Rabby Swap Exploit

In October 2022, an attacker exploited a flaw in the Rabby Swap smart contract and drained roughly $200,000, taking 114 ETH and 179 BNB from users who had granted the contract token approvals. The contract had passed a PeckShield audit before the exploit, a useful reminder that one audit is a checkpoint and never a guarantee.

Scope is the load-bearing detail. The flaw lived in a peripheral swap contract, and the wallet itself was untouched. Seed phrases and private keys were never at risk, and the record since has been clean, backed by the Least Authority and SlowMist audit cycle described above. A contained contract exploit and a key-custody breach are different events, and this one belongs in the first category. It dents the track record without undermining the custody model.

Rabby covers more than 100 EVM-compatible chains, including Ethereum, BNB Chain, Arbitrum, Base, Optimism, Polygon, Avalanche, zkSync, Linea, Gnosis, Fantom, and Cronos. Chain handling is its quiet UX win. The wallet detects which network a dApp wants and switches automatically, so the manual network-adding ritual that MetaMask users know by heart mostly disappears.

The boundary is just as firm. Rabby is EVM-only by design, with no native Bitcoin, Solana, XRP, TRON, or Sui support. This is the single biggest reason it scores below MetaMask, which now reaches beyond EVM. If your portfolio lives entirely on EVM chains, the limitation costs you nothing. If you hold BTC or SOL, you need a second wallet.

Rabby is built for people who transact often. The interface surfaces approvals, positions, gas detail, and simulation results in one view, and frequent DeFi users tend to read that density as information they were missing elsewhere. A first-time holder who wants to buy some ETH and check the balance monthly will find it a lot of dashboard for the job. That split defines who the wallet is for more than any single feature.

Recovery is seed phrase or imported private key, with a local password on each install that unlocks the app but recovers nothing. There is no cloud login, no social recovery, and no MPC scheme. Purists will read that as a feature, since every added recovery path is also an added attack path, but it means your seed phrase discipline is the whole ballgame. Write it down offline, or better, keep keys on a paired hardware device and let Rabby serve as the interface.

Rabby pairs with more hardware brands than most software wallets do, including Ledger, Trezor, BitBox02, Keystone, GridPlus, OneKey, and imKey, connecting over USB, Bluetooth, or QR codes, the last of which keeps air-gapped devices air-gapped.

The built-in swap and bridge route through aggregated DEX liquidity at a 0.25% fee, well under the 0.875% MetaMask charges for the equivalent, with no separate withdrawal fee beyond network gas. For anyone who swaps regularly, that gap compounds into real money.

There is no one-tap staking product. Rabby instead surfaces the staking and lending positions you already hold across DeFi protocols in its portfolio view, which fits its power-user identity, though users who want native delegated staking will need to go to the protocol directly. There is also no fiat on-ramp of any kind. You fund Rabby by sending EVM assets in from an exchange or another wallet, which keeps card-purchase markups out of the product entirely but adds a step for newcomers.

The app is free on every platform with no device or subscription attached, and free is accurate here. Ongoing costs are network gas, the 0.25% swap and bridge fee, and nothing else, since there is no on-ramp to add markup. Among hot wallets with built-in swaps, that fee structure is one of the cheapest available.