To claim a crypto airdrop safely with MetaMask, use only links from the project’s official channels, check MetaMask security alerts before connecting, and read every approval or signature request before you confirm. A legitimate airdrop never needs your Secret Recovery Phrase (SRP).

An airdrop is a free token distribution, usually sent to wallet addresses by a project, and scammers copy the format constantly. Fake claim pages, phishing links, and malicious token approvals are the most common ways MetaMask users lose funds through airdrops.

Before You Start

• Never share your SRP or private keys with anyone or any website.

• Get claim links only from the project’s official website or verified accounts, not DMs, replies, or ads.

• No legitimate airdrop guarantees returns or asks you to send funds first.

How Do I Verify an Airdrop Is Legitimate?

Confirm the announcement on the project’s official website and verified social accounts. Watch for impersonator accounts and lookalike domains, and type the URL or use a bookmark instead of clicking a link.

MetaMask Security Alerts, powered by Blockaid, can flag malicious sites before you connect. If you see a “Malicious” warning, don’t connect your wallet or sign anything. No warning doesn’t mean a site is safe.

What Should I Check on the MetaMask Confirmation Screen?

1. Dapp URL and contract address: Use “Verify contract details” to see which contract is asking for access.

2. Token approvals: Check which token, which contract, and how much. Consider setting a custom spending cap instead of approving unlimited.

3. setApprovalForAll requests: You shouldn’t need to sign one to receive an airdrop or NFT.

4. Signatures: Some signature requests, like permit signatures, can grant spending permission without sending a transaction. If you don’t understand it, cancel.

5. Transaction simulation: MetaMask previews balance changes before you sign. If it shows you losing assets when you expected to receive them, cancel.

What Should I Do If a Token I Didn’t Ask For Shows Up in My Wallet?

Don’t swap, sell, or “claim” it. Scam tokens often won’t swap and instead redirect you to a site asking for your SRP.

Verify the contract address through the project’s official channels and a block explorer like Etherscan. If you can’t verify it, leave it alone.

MetaMask guidance is that the risk comes from interacting with it, not from it sitting in your wallet.

What If I Already Approved Something Suspicious?

Revoke the approval quickly at revoke.cash, where you can review all existing approvals. If your wallet is already drained there’s little that can be done, so speed matters.

These protections add a layer of security but don’t catch every scam, so always read the details before you approve.

Dive Deeper

• Token safety practices

• What is a token approval?

Have you ever come across a suspicious airdrop while using MetaMask? What signs helped you identify it?

can swap tokens in metamask all day but the moment I want BTC every guide turns into bridge + wbtc + second wallet. I want actual BTC on bitcoin network sent to an address I already have. godex and simpleswap just want the receive address, is that really enough or do I still end up on the wrong network and burn it? ETH to BTC, few hundred.

Got stablecoins sitting in MetaMask and thinking about earning yield? Before choosing whichever option shows the highest percentage, here’s how to compare what you’re actually getting.

1. Understand which option you’re using

There are different ways to access earning opportunities with MetaMask:

• Lending through MetaMask: MetaMask offers access to Aave lending pools. On Mobile, open a supported stablecoin and look for Earn. Review the deposit details and estimated network fee before confirming.

• Connecting to a DeFi app: You can use MetaMask to connect to a lending platform directly. Check the official website, supported network and specific market. Being able to connect MetaMask doesn’t mean a platform is endorsed or safe.

• Money Account, where available: This earns variable yield on deposited mUSD. It’s a separate experience from simply holding mUSD in your regular wallet, and currently isn’t available in the UK or sanctioned countries.

2. Compare more than the advertised rate

Before depositing, check:

With Aave lending, rates change with borrowing demand. The percentage you see today isn’t a promise for the whole year.

3. Check whether the fees eat the difference

Here’s a hypothetical example:

You have 500 USDC. One option offers 5% APY, while another offers 7% APY.

If both rates stayed unchanged for a full year, that’s approximately $25 versus $35, before costs and assuming USDC stays at $1.

If moving to the second option costs an extra $12 in total, the higher rate wouldn’t cover that difference over the year.

Check the whole journey: approvals, deposits, swaps or bridges, and withdrawing back to the token and network you want.

4. Know where your deposited tokens go

When lending through Aave, you deposit into a smart contract and receive aTokens representing your supplied assets and accrued interest. You aren’t simply earning interest on untouched USDC sitting in your wallet.

Before approving a deposit in MetaMask, check the network, token, amount and any spending permission being requested.

5. Check the exit before entering

Find the withdrawal instructions before depositing. Aave withdrawals depend on available pool liquidity; borrowing against your deposit can also limit what you can withdraw.

Stablecoin yield still carries risks, including smart-contract exploits, withdrawal delays and the stablecoin losing its peg. Using MetaMask doesn’t remove those risks.

When you compare stablecoin earning options in MetaMask, what matters most to you: the rate, lower fees or being able to withdraw easily?

References:

https://support.metamask.io/trade/earn/lending/how-to-lend
https://support.metamask.io/trade/earn/lending/lending-rewards/
https://support.metamask.io/trade/earn/lending/lending-risks/

EDIT:
The issue described has been solved, apparently it was a wide outage of third party log ins. After posting this i waited some more in the bot queue, just to open a ticket??
Whhyy would you have a queue just to prompt the user to give the ticket a name, its stupid.

I've been trying to resolve this through MetaMask Support, but their AI chatbot has been incredibly unhelpful, so I'm turning to Reddit for help.

I have "Log in with Google" set up for my MetaMask account. However, since yesterday, every login attempt has resulted in a repeated "Login failed" error.

I've tried logging in both through the mobile app and the browser extension, but neither works.

I don't believe this is a Google-related issue, as I can log into other services (including Reddit) without any problems.

I also want to raise some concerns about the state of MetaMask Support.

I've provided all the requested information to their AI chatbot, only to be redirected to another AI chatbot, where I had to provide everything all over again.

After that, I was put into what seems to be an endless waiting queue.

Yesterday, I spent over an hour trying to get in touch with an actual support representative. Today, I've already been waiting for another 30 minutes, with no end in sight. The support email adress also is an AI bot.

This is extremely frustrating, especially considering that I have funds in the wallet that I currently cannot access.

Has anyone experienced a similar issue with login recently? Is there anything I can do to regain access, or a way to actually reach a human support representative?

I wanna know if MetaMask still working on Canada ? Because i tried to sign up doesn’t work if is not which app recommend?
Thanks 🙏🏽

Gm the MM community, I'm a long time user of MM and this is the 1st time I encountered a problem. I have some USDT (Tron Network) sent by my company every month, and for some reason I didn't appear on my Mobile MetaMask, even though the transactions already successfully made on TronScan?

Please help me, Thanks in advance!

Not necessarily. An attacker doesn't need to crack your encryption or steal your private key—they can exploit the compromised environment around your wallet.

We spend a lot of time discussing Web3 security, focusing on private-key encryption, seed-phrase storage, hardware wallets, multisig setups, and smart contract audits. However, one fundamental question deserves far more attention: What happens when the wallet itself is safe, but the device running it is not?

Consider this scenario: You have a MetaMask wallet with a strong password, a safely stored recovery phrase, and zero suspicious token approvals. Yet, your computer is infected with malware. That single infection can easily be exploited to drain your wallet.

Common host-level attacks

• Clipboard hijacking: Replacing a copied recipient address with an attacker's address just before you paste it.

• Keylogging: Capturing sensitive credentials or your seed phrase as you type them.

• Malicious extensions: Intercepting browser activity or interfering directly with wallet interactions.

• Transaction manipulation: Altering transaction payload details (e.g., recipient or amount) on-screen before you approve.

• Remote access trojans: Gaining full control of your machine to execute unauthorized actions directly.

Typical entry points for compromise

• Phishing links leading to drive-by downloads or malicious sites.

• Infected email attachments or suspicious files shared via Telegram and Discord.

• Fake wallet apps, fraudulent browser extensions, or trojanized software updates.

• Pirated software and torrented files.

• Fake airdrops, fake verification pop-ups, or compromised physical USB drives.

Does a hardware wallet fix this?

It significantly reduces the attack surface, but it doesn't eliminate it.

While hardware wallets isolate private keys and sign transactions offline, a compromised computer can still alter the transaction details sent to the device. If the user blindly approves the modified payload on the screen without cross-checking the hardware wallet's physical display, the attack succeeds.

Rethinking Web3 Security Architecture

Wallet security is too often simplified into just "protecting the private key." Instead, we should evaluate security across three distinct layers:

1. Key Security: Can an attacker extract or clone your private key?

2. Device & Environment Security: Can an attacker control the device or browser hosting your wallet?

3. Transaction Security: Can an attacker trick you into signing something you didn't intend to?

Protecting one layer does not guarantee the safety of the others.

What Are Your Thoughts?

What security mechanisms or architectural changes could effectively prevent malicious transactions even when the host device is compromised?

References:

Clipboard hacking explained

How to recognize the real MetaMask extension

Hi all, as you can see from the image above, MetaMask flags my app 20questions.lol as malicious when you try to connect.

Quick context on what it is: it’s a crypto game where an AI picks a secret word and players pay to ask yes/no questions, and the first person to guess the word wins the whole pot. I use blockchain specifically for transparency, so the secret word is committed on-chain as a hash before the round starts and nobody (including me) can change it. The contract is live and verified on Base: 0xf0925993D00F5E2c5C7c5053eD67309a0a9beF8c

What the app actually asks your wallet to do:

1. Connect

2. Approve USDC for the 2 USDC buy-in plus up to 10 questions (so you don’t have to approve every question)

3. Sign each question, which the server then submits on-chain so players don’t pay gas

My guess is the approval plus signatures plus a brand new domain looks a lot like a wallet drainer pattern to the automated scanners, which I get, but it’s not one. Funds only move when you actually ask a question, and the approval can be lowered or revoked anytime.

I’ve already reported it as a false positive to Blockaid. Has anyone gone through this? How long did it take, and is there anything else I should be doing? I’ve had the app live for about 2 weeks now and nobody will want to use it in this state.

Also open to feedback if there’s something in my flow I should change so it stops looking suspicious.

I'm sorry for asking like noob

Do i also need to remember metamask password "IF" I generated wallet with Google login?

is Google social login in android/ios app

same as, only when using chrome brower extension "with" Google social login?

and can i have seed phrase even i generate wallet with Google social login?

i'm just worring about dependency.

I swapped some eth to tron yesterday on the extension and after saying confirmed, the funds havent shown in the metamask extension for over 16+ hours now. I also swapped some tether over and am experiencing the same thing.

My balances shown in the metamask extension are outdated and are basically what was shown before I initiated the transfer. The transfers both show as completed on tronscan and my balances are accurate on there. The wallet has been activated and used before on the tron network, but metamask had big delay issues in the past for me as well.

App is up to date, tried disabling re-enabling, no vpn, no adblock, extension looks up to date. This is on chrome

Anybody know a fix?

I’ve tried everything. After I uninstalled the app bc I recieved funds and they weren’t showing in the app so I uninstalled. Installed it back tried logging in and get hit with this error message.

Want to buy or sell at a specific price? Here's a quick guide using Metamask's new Limit order feature

Available on Metamask Mobile v8.18.0+, On Ethereum, Base, BNB & Robinhood chain

1. At the bottom there is a button that says "Trade" Click this

2. After clicking Trade, go to "Swap" and then click "Limit"

3. Choose what you're paying (from) and receiving (to), both must be on the same network

4. Enter your amount. In the video above I chose 0.1 Eth.

5. Set your target price, I did 10%

6. Choose an expiry (I did 7 days) and also review price tolerance (I changed mine to 4.5%)

7. Tap create order, review and confirm. If you have the available balance your orders will execute and fill.

Things to know:

• Minimums: $100 on Ethereum; $10 on the other supported networks.

• Tokens stay in your wallet until execution.

• Hitting your target doesn’t guarantee a fill: a suitable quote must be available within your tolerance.

• Find orders under Limit → Open orders. To change one, cancel and recreate it.

Have you tried limit orders yet? Or do you prefer swapping manually?

So I have USDT on tron network. How do I swap it to USDC so I can use it to pay my bills and rent,I need to access this money quick

Hey guys, since today early morning i can't login to my wallet app, i have wallet that i usually login via google but today it keeps showing me login failed and try again button but nothing happens when i click on it

MetaMask Money Account lets you earn up to ~6% variable APY* on mUSD without connecting to DeFi apps or managing lending positions yourself.

Supported stablecoins convert to mUSD inside MetaMask, and yield accrues daily to your balance, with no lockups, withdrawal penalties, or account fees.

How the yield works

1. Convert to mUSD: USDC, DAI, aUSDC, and aDAI convert with no swap or network fees. Other tokens work too, but standard fees apply.

2. Automated strategies: Your mUSD is deployed through trusted third-party DeFi platforms in the background.

3. Daily accrual: Earnings show in your balance automatically, with nothing to claim or reinvest.

How to get started

1. Open the Money tab in MetaMask.

2. Tap Add, then Convert crypto, and choose a supported stablecoin.

3. Enter the amount and confirm the conversion.

Good to know

• Self-custodial: Money Account is self-custodial. MetaMask can’t access, freeze, or move your balance, and it’s secured by your SRP.

• Variable APY: APY is variable and changes with market conditions.

• No automatic yield on regular mUSD: Just holding mUSD in a regular account doesn’t earn yield.

• Availability: It’s available on MetaMask Mobile v8.0+ and Extension v13.51+, in most regions (not the UK or US-sanctioned countries).

Full guide: MetaMask Money Account

Would you rather manage your own DeFi positions, or have yield built into your wallet?

Today i received a notification saying 0.01 ETH deposited to my wallet only to find there's nothing no transaction or anything, is metamask that desperate to let people use their app?

With limit orders now available on MetaMask Mobile, the distinction worth checking is the price condition versus an executable quote. MetaMask's guide says both the condition and a real quote within your price tolerance must be satisfied.

Hypothetical example: you want to sell 1 ETH when ETH reaches 3,000 USDC. A chart briefly showing that price doesn't establish that a quote for your order size is available within your tolerance. The order can remain open and eventually expire. Those numbers are an illustration, not current prices or a trade recommendation.

If an order hasn't filled, here's a checklist based on the official guide:

1. Read the condition in words. The token selected in the price box determines whether you're setting a buy or a sell condition; check the token and whether it says at or above/below.

2. Check price tolerance. The documented default is 3%. It covers slippage, price impact and the network fee deducted from your tokens. That default isn't a promise of execution, or a recommendation to increase it until a trade fills.

3. Check the source-token balance. Tokens remain in your wallet while the order is open. Spending or moving them can cause auto-cancellation for insufficient funds when execution is attempted.

4. Check status and expiry under Open orders. You can't edit an open order; changing the price, amount or expiry requires cancelling and creating another.

Also, gasless doesn't mean fee-free: the swap's network fee comes from the tokens you're selling. A first-order smart-account upgrade can have a separate gas cost shown in the confirmation screen.

Source: https://support.metamask.io/trade/swap/limit-orders/

Would a visible “price reached, no quote within tolerance” status help distinguish an unfilled order from a failed transaction?

Live on MetaMask Mobile across Ethereum, Base, BNB Chain, & Robinhood Chain.

This is an update with what I found since my previous thread was deleted after I edited this in.
To clarify, my wallet is still there, but clicking on the extension does nothing, it won't show the pop up. I can force it to show up by using inspect "pop-up"

For technical details:

Metamask ver: 13.55.0

I'm on opera gx:

Update stream:Early Access

Core:139.0.6053.42

System:Windows 11 64-bit

Chromium version:155.0.8059.85

When inspecting metamask, I see two errors that appear continuously:

1- with an red x icon
Error: Failed to get subscriptions (url:https://subscription.api.cx.metamask.io/v1/subscriptions) Caused by: e: Execution prevented because the circuit breaker is open
2- with an orange warning icon:
service-worker.js:15407 LavaMoat - property "Headers" of globalThis is inaccessible under scuttling mode. To learn more visit https://github.com/LavaMoat/LavaMoat/issues/2127.

I’ve been waiting for over an hour

A useful way to read a wallet prompt is to ask what it changes after you confirm. Here is a worked example for a standard externally owned account in MetaMask Extension using ERC-20 USDC with Aave V3 on Ethereum mainnet. Native ETH, smart accounts and other protocols can have different flows.

Connecting the site: this lets the site see the selected public account and request actions. Connection alone is not a token-spending allowance. Disconnecting later does not erase an allowance already recorded on-chain.

Approving a spending cap: this gives a particular spender permission to move that particular token, up to the allowance. Check the network, token contract, spender and amount. An approval confirmation is not proof that a supply transaction succeeded. Aave also supports signature-based approval flows for supported tokens, so counting pop-ups or assuming that every flow requires two paid transactions is unreliable. Read the requested permission even if there is no gas fee.

Supplying: the supply transaction transfers the underlying tokens to the lending pool. Check the transaction receipt and the supply balance for the correct account and market. Closing MetaMask, disconnecting the site or revoking a remaining wallet allowance does not withdraw that deposit.

Collateral status: check the actual collateral setting in Aave after supplying. Having a supplied asset available as collateral does not itself create a loan. If there is an outstanding borrow, removing collateral or withdrawing can be restricted by the position's health. Withdrawal also depends on available pool liquidity. The collateral toggle is not a general-purpose way to revoke a contract's access to tokens in your wallet.

For a hypothetical 100-USDC supply, keep separate records of the allowance still available to the spender, the amount actually supplied, and whether the position backs any debt. These answer different questions; a green confirmation for one step cannot establish all of them.

Sources: MetaMask's distinction between disconnecting and revoking, plus Aave's supply, collateral and withdrawal guides:

https://support.metamask.io/zh-cn/more-web3/learn/how-to-revoke-smart-contract-allowances-token-approvals/

https://aave.com/help/supplying/supply-tokens

https://aave.com/help/supplying/toggle-collateral-status

https://aave.com/help/supplying/withdraw-tokens

What would make MetaMask's confirmation screen clearer when you need to distinguish a spending permission from an actual deposit?

Seeing Binance’s hot wallets compromised and the reports of tampered Ledger devices sold through resellers has made me think more about wallet security.

They’re different types of incidents, but they raise the same question: what extra protections would you want in MetaMask?

Clearer signing warnings? Easier tracking and revoking of token approvals? Optional spending limits?

What would actually give you more confidence using the wallet?

When I enter the recovery phrase thing, and see all crypto is down to 0 does it mean my wallet got hacked? How can I find anything that has some cash on it? Is there like a "Show All Highest Token Value" button or something?

Whats very giving me the chills is that 2 Crypto's are listed on "Low balance tokens" but it's 0,00. I have a feel someone took it all. Please help here, thanks!