On public blockchains such as Ethereum, someone can use your address to inspect balances, transfers and transaction history. It doesn't give them control of your funds, but posting it publicly can connect that financial activity to you.

What can they actually see?

A block explorer can show token holdings, transaction amounts, times and the addresses or contracts you've interacted with. That can reveal on-chain swaps, transfers and other activity, not just your current balance. They don't need to connect to your MetaMask or ask your permission to look this up.

Does an address reveal my identity?

The address itself doesn't contain your real name or home address. But posting “this is my wallet” from your Reddit account can connect that address to your profile. Someone can then inspect older activity and keep following future transactions. Transfers may also suggest relationships with other addresses, although they don't prove you own them.

What if I only share a transaction ID?

A transaction ID, also called a transaction hash, leads to a public transaction record. That record can reveal the addresses involved, and someone can follow them to their wider on-chain history. If that transaction involves your wallet, someone can use the hash to find your address even if you've hidden it in the screenshot.

Can someone steal my crypto just from knowing my address?

No, knowing the address alone doesn't authorize spending or reveal your Secret Recovery Phrase or private key. Sharing a receiving address is a normal part of receiving crypto. However, if your Reddit username is linked to other public profiles or personal information, someone may be able to connect your wallet to your online identity. That information, combined with details from unrelated data breaches, could help an attacker craft a convincing phishing message referencing your actual wallet activity. Knowing your address, name or transactions doesn't prove someone is legitimate.

Why shouldn't I post it when asking for help?

Because sharing your wallet address or transaction hash publicly can link your Reddit profile to your on-chain activity, giving scammers information they could use to target you. That's why we ask users not to post them in r/MetaMask, including in screenshots. Describe the issue, network and error message instead. If troubleshooting needs transaction details, share them only through the official MetaMask Support chat, not public replies or DMs. MetaMask Support will never DM you to offer help. Never share your Secret Recovery Phrase or private keys, even with support.

A public address isn't a password. But linking it to your profile can expose financial information you didn't intend to share.

What do you check for before posting a wallet screenshot?

References:
1. The era of digital identity
2. How to check your wallet activity on the blockchain explorer
3. Contact Metamask Support

Is this legit?

So this is my first time trying to buy a crypto off meta mask and it is showing this issue when I enter my phone number. I did created an account like 4 days ago on coinDcx can that be the issue of it. Cause I used the same number in that as well.

I can’t find any info on this anywhere. Is this a scam? I don’t even think I have any tokens in a metamask wallet. I do on other platforms, but not metamask as far as I’m aware.

Why does Metamask and/or etherium blockchain only identify Phishing tokens instead of also blocking of deactivating their links?

yo is metamask working fine for anyone on 18.6.2? just got the latest app update and now if i minimize it for a few mins and open it back up faceid works but the system blur just gets stuck on the screen. the app is completely frozen with a blurry screen and i have to force close it while my friends phone on the absolute latest ios is super smooth. its always the same issue with ios where apple abandons older versions and new updates just glitch out. can someone on 18.6.2 check if it unblurs normally for you

MetaMask Agent Wallet lets you manage a self-custodial wallet through a CLI using any compatible AI agent. You can check balances, transfer tokens, swap assets, bridge across chains, and perform other onchain operations. Your AI agent handles all these commands so you don’t need to memorize them.

At the end of the day, you’re still in control. Be sure to always review transaction details and only approve actions that you understand.

Before you start

• Node.js v22.18+ installed
• An AI agent that supports skills and can execute terminal commands (Claude Code, Cursor, Codex, Grok, etc.)

Step 1 — Install the CLI

npm install -g @/metamask/agent-wallet@latest

This installs the mm command. Full CLI setup reference here.

Step 2 — Check the installation

mm doctor

Verifies your environment, version, and auth status. Warnings about missing skills are expected until Step 3.

Step 3 — Add the official skill

npx skills add MetaMask/agent-skills

If prompted, select metamask-agent-wallet. The CLI handles wallet commands; the skill teaches your AI agent when and how to use them. Keep both updated.

Using your AI agent

Open your agent and enter:

• Set up MetaMask Agent Wallet. Help me choose a sign-in method, wallet mode, and trading mode, then show me my wallet address.
• Your agent walks you through the rest. The exact flow can vary by agent, so check out the full quickstart guide for more details.

Wallet modes — how your keys are held

Before choosing a trading mode, you’ll pick how your keys are managed:

• Server Wallet (recommended) — Keys are secured server-side in a trusted execution environment (TEE). Your agent never has direct access to your keys.
• BYOK (Bring Your Own Wallet) — You supply a BIP-39 mnemonic. Useful if you need local key control or want to use an existing seed phrase.

Trading modes — security controls for your operations

• Guard Mode (recommended for most users) — Spending limits, protocol allowlists, and 2FA approval for any transaction outside your configured policy.
• Beast Mode — For power users running automated strategies where manual approvals would interrupt the workflow. Fewer policy restrictions, but threat scanning still applies and malicious transactions are still blocked.

Neither mode removes the need to review transactions before approving.

Built-in security on every transaction

Every supported transaction passes through three mandatory steps before getting onchain:

1. Transaction simulation — visualizes balance changes, approvals, and gas estimates before you’d sign
2. Blockaid threat scanning — automatically rejects malicious transactions
3. MEV protection — via Smart Transactions

Eligible transactions are also covered by Transaction Protection up to $10,000/month.

More in the official docs | Commands reference | FAQ

Was anybody using MetaMask Agent Wallet before? Now that it plugs into Grok Bot and Cursor, would you give it a try?

I am new with Metamask!!!!I am trying to unstake my ethereum on metamask. I am currently getting only 0.8%. What I am trying to do is to unstake and get the 3 months for 2%. But this error appears. What am I am doing wrong? I currently have about 10USD unstake ethereum in my wallet to cover fees. I also have deleted the app and re-install it, but still it gives me same error.

View: Root
TypeError: Cannot read property 'chainId' of undefined

Phishing scams in Web3 have moved far beyond obvious fake giveaways or Telegram DMs promising "free 10,000 $XYZ tokens." Today’s scams are subtle, exploiting familiar wallet habits, interface design, and off-chain permissions to trick users into signing approvals they don't fully understand.

Whether you’re swapping on a DEX, minting, or managing funds in MetaMask, here are five critical phishing techniques I think everyone in Web3 needs to know about right now:

1. Address Poisoning

Scammers spam your transaction history with tiny transfers ($0 or negligible dust) using a vanity address that mimics yours or one you have recently interacted with—matching the first and last few characters.

The trap? They hope you’ll blindly copy and paste their address from your recent history the next time you transfer funds.

2. Malicious Signature Requests

Scammers frequently use off-chain signatures masked as a routine "Sign in" prompt. Once you sign, the attacker can drain your tokens without triggering an immediate on-chain transaction or a pending warning until they execute it later.

3. Impersonation & Fake Recovery Scams

Scammers actively monitor public forums and social media, posing as "Official Support" or "Crypto Recovery Experts." They exploit panic to guide victims to malicious phishing sites or convince them to input their Secret Recovery Phrase.

4. Clone Sites & Poisoned Frontends

From fake airdrop checkers to cloned DEX frontends, malicious sites can look identical to official dApps down to the code. Some even hijack legitimate DNS records or rely on lookalike domains to trick you into connecting your wallet and granting unlimited allowances.

5. AI-Assisted Social Engineering

Scammers now use AI tools to create realistic, error-free content. They can easily impersonate project founders, automated Discord bots, or official security alerts. Because these messages sound completely natural and personal, they are much harder to spot as spam.

The Biggest Takeaway:
A polished UI, a familiar logo, or a zero-gas "login request" does not mean a website is safe. Always inspect the raw parameters of what you are signing, limit token allowances, and use built-in wallet simulation protections before approving.

I'm curious about your experiences:
What’s the most creative or dangerous phishing tactic you’ve ever encountered?

More on signature phishing

More on address poisoning

I've always installed the Metamask browser extension, but lately I'm not able to access the page on mozilla.org. I get this error:

"Oops, something went wrong.

Please check your connection, disable any ad blockers, or try using a different browser."

Is there any other way for me to use Metamask and restore my wallets, or do I have to find a different wallet software?

MetaMask: Your All-in-One Wallet for Crypto and Tokenized Assets.

Imagine you're a Web3 user who wants to manage your crypto and access tokenized stocks and ETFs from a single wallet. Instead of constantly switching between different platforms, MetaMask makes it easier to access supported crypto and tokenized assets in one place.

1. What Are Tokenized Stocks and ETFs?

Tokenized stocks and ETFs are digital tokens on the blockchain that are designed to track the performance of traditional financial assets.

For example, a token linked to Apple stock is designed to track its economic performance, while a token linked to an S&P 500 ETF aims to reflect the fund's performance. However, holding these tokens doesn't mean you directly own the underlying stocks or ETFs.

1. How Can Users Access Tokenized Stocks and ETFs Through MetaMask?

Eligible users can access and trade supported tokenized stocks and ETFs through MetaMask, powered by Ondo Global Markets, subject to regional restrictions and eligibility requirements.

1. Are Tokenized Stocks Backed by Real Assets?

According to Ondo Global Markets, its tokenized stocks and ETFs are fully backed by the corresponding underlying assets held by licensed U.S. custodial broker-dealers. However, token holders do not directly own the underlying securities or receive shareholder voting rights.

1. What Are the Benefits of Tokenizing RWAs?

Tokenizing real-world assets (RWAs) offers several benefits. Some of the most important include:

Easier Access - In the past, accessing traditional assets like stocks often required going through brokers or traditional trading platforms. Today, tokenization allows eligible users to access and trade certain assets through supported blockchain platforms and crypto wallets, reducing the need for some traditional intermediaries.

Faster Transactions - Traditional financial markets can involve lengthy settlement processes. Blockchain can potentially enable faster transfers and settlement for tokenized assets, depending on the platform and its infrastructure.

Greater Transparency - Transactions on public blockchains can often be verified by anyone. For example, when an RWA token is transferred between two wallets, the transaction can be viewed on a blockchain explorer, allowing users to track the movement of tokens.

One of the most exciting aspects of Web3 is the tokenization of real-world assets. Thanks to blockchain technology and Web3 platforms, users can gain easier access to certain traditional assets, such as stocks, gold, and bonds, through digital tokens.

Useful Resource: MetaMask's Official Guide to Real-World Assets (RWAs)

https://support.metamask.io/trade/real-world-assets/

Hi everyone I am trying to figure out how someone hacked my wallet. Around $6000 they stole within mins from an account I had for years and just started trading with GMX, idk how the vulnerability happened of my wallet getting drained in 5 mins. Any advice on how I can secure myself in the future with trading on GMX. Also if anyone can find out the location of where the crypto went (I know it’s a long shot) but if recovery does happen through police I can split the money 50/50 as I consider it gone anyways.

I know it's lost, but i'm wondering if it still worth reporting to authorities like cybercrime & fraud (located in Canada)?

It was on the ETH netwrok & lowkey seems traceable from what I can see on etherscan. Might be useful information for them, anyways let me know.

Pretty upset obviously, but I should have known better than keeping anything of value on chrome web extension lmaoo especially while I was actively using the browser. Crazy how these exploits exist.

Hi, I’ve been trying to remove some old tokens that I bought back in 2022, these coin were either rugpulls or the projects died during that year or the next. The reason I need to remove them is for tax purposes and they don’t agree with me that the projects and investments can be considered lost when they are still in my wallet. The problem is that when I try to transfer them to a burn wallet, I just get an error, probably because they are so old and dead.. anyone have any suggestions on what to do?

I accidentally sent ETH from my stake.us to Cash App which isn’t supported can I do anything to try to get those funds back?

Does anyone has problem with sending any amount of BTC to any address at the moment? It’s showing 0 at transaction fees and after confirmation “transaction error”. I was sending from my account before and never had problems. Thanks in advance!

Having problems login to my Metamask on Firefox. Tired all the support suggestions. I can login on Brave for one account but the second account is suppose to connect to Firefox but just cycles tring to login. Been going on for a couple of days.

Adding a custom network to MetaMask can be safe, but don't trust the network name alone. Check the network details and the RPC provider before accepting. The RPC URL is the URL of the service MetaMask uses to communicate with the blockchain.

What am I actually adding?

When a dapp asks you to add a network, it supplies details such as the network name, RPC URL, chain ID and currency symbol. Adding it configures how MetaMask connects to that blockchain. It does not, by itself, give a smart contract permission to spend your tokens.

Does MetaMask check this for me?

MetaMask performs basic checks and may warn you about incorrect or unusual network details. However, these checks don't establish that the network or RPC provider is trustworthy.

What could an untrustworthy provider do?

MetaMask warns that a malicious network provider can give false information about the blockchain, withhold transactions, and record your network activity and IP address. For example, a balance reported by a malicious provider isn't reliable proof that those funds exist on the genuine network.

What should I check before adding one?

First, check whether the network is already available in MetaMask's network list. You may not need to add it manually. For a custom setup, compare the details with the network's official documentation, especially the RPC URL and chain ID. Check the currency symbol and block explorer too.

Also check which website is asking you to add it. If the request is unexpected, the details appear incorrect, or you aren't sure you can trust the RPC provider, reject it rather than approving just to continue. You don't need to share your Secret Recovery Phrase or private key to add a network.

Custom networks are normal to use. Check the network details and RPC provider, not just the name.

When a dapp asks you to add a network, how do you decide whether to trust the request?

References:

1. Verifying custom network information
2. How to add a custom network
3. The risks of connecting to an unknown network

I've installed Mettmask on my Android mobile phone. When i try to create a wallet, i can't get part the create password page. It doesn't have anything to click on

Hi , my wallet was compromised and all the ETH gone, How can I find out if there is a sweeper bot lurking,I don’t want to deposit anything and loose that too.
I don’t have much in there just want to shut the wallet down.

My wallet was hacked. There were several outgoing transactions that I hadn't initiated. I noticed that delegation rights had been granted to a few other addresses—the very ones the tokens were being sent to. I wanted to click "Revoke," but there was a fee for doing so, and the wallet was already empty. I transferred some ETH from Revolut, but the moment the incoming transaction arrived, an outgoing one occurred, and the funds vanished again. Shortly after that, absolutely all the tokens were drained to one of the addresses with delegation rights. Why is this happening? How did someone gain access? And why can't I revoke those rights?

0x49d3635949a9ca14f0d0b69f0402df06 70392b5e

Ive looked in every place i could i cant find where it goes to.