Rabby Wallet review: features, costs, and limitations

Rabby is a non-custodial wallet, available as a browser extension and a mobile app, built by the team behind the DeBank portfolio tracker. There is no charge to install it or to hold assets in it; the wallet earns from its in-wallet swap, which charges 0.25%. In our test, swapping 0.056 ETH (an equivalent of $107) to USDT cost 0.336%, including ETH gas fees (as of August 5, 2026, at the ETH exchange rate of $1,917). 

Rabby covers Ethereum and EVM chains only: Arbitrum, Base, Polygon, BNB Chain and dozens more. There are no native accounts for Bitcoin, Solana, Tron or Monero, and no way to buy crypto with a card inside the extension. If you need either, Rabby cannot be your only wallet.  

One thing to settle before anything else: the extension and the mobile app are not the same product. They differ in hardware wallet support, licensing, available features, fees on some actions, and what their latest audits found. We tested the extension. The differences are in the table below.

Test passport

Every number here comes from one hands-on session. This is the setup, so you can judge how far it transfers to yours.

What we tested, and what we did not

We installed the extension, created a wallet from scratch, received and sent funds, ran a swap, and restored the wallet on a clean browser profile. We also read the published source, all fourteen audit reports, the privacy policy, and the fee logic as it is written in the code.

We did not install the mobile app, connect a hardware wallet, trade perpetuals, use the lending screen, or time the support team. Everything below about the mobile app comes from its published source and audit reports rather than from our own use, and is labeled as such.

Rabby at a glance

The extension and the mobile app are not feature-equivalent

We found certain distinctions between the Chrome extension of Rabby wallet and its mobile app.

The mobile app came out with more to fix, and two of the five findings concern how your own data is protected on your own device — the key-derivation function is the step that turns your password into the key that decrypts the wallet, so weakening it weakens everything downstream. Rabby publishes both reports in full. But “Rabby is audited” is not a single statement covering both platforms, and no review we found draws the distinction.

One architectural difference is worth naming too. On mobile, perpetuals, lending and prediction markets are not Rabby screens. They are third-party sites loaded in an embedded browser with a Rabby account header on top. It looks like part of the app. It is someone else’s interface, and what you sign there runs on their code.

Setting up Rabby

Installation runs entirely in the browser and takes a few minutes. The one step that cannot be redone later is the seed phrase backup, so read that step before starting.  

Step 1. Install the extension

Install from your browser’s store, reachable from rabby.io. Clones of popular wallets appear in extension stores regularly, so check the publisher and the user count before installing. Do not trust the first search result.

Rabby Wallet Chrome Extension

Step 2. Create a new address or import one

Choose "Create a new address" to start fresh, or "I already have an address" to import a seed phrase or private key from MetaMask, Trust Wallet, OKX or anywhere else. Importing changes nothing about the wallet — addresses, balances and history stay as they were, because they live on-chain rather than inside any app.

Step 3. Set a password

The password unlocks Rabby on this device only. It is not a backup. Rabby neither stores it nor can reset it; forget it and the seed phrase is the only way back in.

Step 4. Back up the seed phrase

Rabby generates twelve words and asks you to confirm a few. Anyone who reads them controls the wallet, on any device, without your password. Write them on paper. Do not photograph them, and do not store them in a notes app that syncs to a cloud you do not control.

Step 5. Start using the wallet

You can now receive funds, connect to dApps, swap, bridge and track balances. Networks are added automatically as you connect to applications.

Receiving and sending

It is the part of the flow where a mistake costs money.

Receiving: The Receive screen shows a QR code, an address line, and supported chains

Receive Screen

Sending displays the balance. Running out of gas is the second. Every chain charges its fee in its own native coin, so exchanging Ethereum (ETH) on one chain and holding tokens on another can leave you stuck with funds you cannot move. Rabby’s Gas Account exists for this: deposit once and it covers gas across supported networks, with no fee of its own. 

Send Screen

How to swap in Rabby

Rabby holds no liquidity of its own. It aggregates quotes from several DEX routers and routes the trade through the one returning the highest amount. Here is the full path.

Step 1. Open Swap

Select Swap from the dashboard. It opens a full page rather than a popup.

Step 2. Choose the network

Pick the chain the swap happens on. Rabby then shows only the assets you hold there, which heads off a common mistake — trying to trade a token that is sitting on a different chain.

Step 3. Choose the token you are selling

The list is filtered to your balances on that network.

Step 4. Choose the token you are buying

Search by symbol or paste the contract address. For anything unfamiliar, verify that address — tokens with identical tickers are a routine scam.

Step 5. Enter the amount

Enter the amount to sell or the amount to receive; Rabby calculates the other side.

Step 6. Open the quote details

Rabby lists the routes it found, the rate, the gas fee, its own service fee, and price impact where the size warrants it. This screen holds every component of the final cost. Screenshot it before confirming.

Step 7. Check the simulation and confirm

Before you sign, Rabby simulates the transaction and shows what will actually leave and enter the wallet, including any approval you are about to grant. Sign only if the simulated result matches your intent.  

What the swap actually costs

Rabby takes 0.25%, included in the quote rather than charged on top. Two categories carry no Rabby fee. Wrapping and unwrapping are exempt, as are same-type pairs — one stablecoin for another, or a coin for its liquid-staking derivative — but that exemption covers a curated list of tokens, not anything that resembles a stablecoin. That rate is worth holding against a dedicated cross-chain swap before moving size across networks. Bridging carries the same 0.25% with no exemptions at all.

For comparison, MetaMask charges 0.875% and Phantom 0.85% on the same in-wallet swap — figures Rabby displays inside its own swap screen. Our measurement:

This is one swap on one day, not an average. Gas moves with congestion and the route depends on liquidity at that moment. Check the current cost for your own pair on the exchange pair pages before assuming this figure holds.  

Can you buy crypto with a card in Rabby?

Not in the extension. We looked on the dashboard, in the token list and in settings; there is no Buy option, and the extension source contains no integration with any on-ramp provider.

This matters more than it sounds. Rabby cannot be a first wallet: there is no way to fund it without already holding crypto elsewhere. Every deposit has to arrive from an exchange, another wallet, or a swap service. Starting from zero, you need to buy crypto somewhere else first and send it in.

The mobile app carries unreleased groundwork for a fiat purchase flow — the screens exist in the source and the backend already stores purchase history — but nothing in the shipped app routes to it, and no provider is named. Treat card purchases as unavailable until that changes.

Networks and assets

Rabby is built for the EVM and nothing else. Inside that scope it covers Ethereum, Arbitrum, Optimism, Base, BNB Chain, Polygon, Avalanche C-Chain, Linea, Scroll, zkSync Era, Blast, Mantle, Gnosis and many more, with new chains added regularly.

We did not find a stable official chain count in the sources checked on August 5, 2026. Its interface mentions "80+" in one place, the fallback list bundled with the extension holds 86 entries, and the live list is fetched from a server and changes without a release. Any specific number in a review of this wallet is stale within a week, which is why there is none here. Check the network list in the app.

Token standards are the usual EVM set: ERC-20, ERC-721 and ERC-1155. Balances across every connected chain appear in one portfolio view, alongside lending, borrowing, liquidity and staking positions — inherited from DeBank, the tracker built by the same team.

There are no native accounts for Bitcoin, Exchange Solana (SOL), Exchange Tron (TRX), Exchange Monero (XMR), Cardano, Cosmos or XRP Ledger. Hold any of those and you need a second wallet alongside Rabby.

What else is in the app

Rabby has grown well past storing and sending. The platform table above shows which of these live where.

• Perpetuals. A native trading interface running on Hyperliquid, with charts and a position panel. Rabby adds a builder fee on top of Hyperliquid’s own — up to 0.02% in the extension, up to 0.04% on mobile for the same trade.
• Lending. An Aave interface for supplying and borrowing, built into the app.
• Staking, NFTs, points and prediction markets. Pool deposits and claims, NFT viewing and approval management, a rewards program, and — on mobile only — prediction markets.

Five sections of the interface therefore have nothing to do with custody of your own assets. Each embedded third-party interface is one more place where a signature is requested, on code that is not Rabby’s.

Open source and audits

The extension ships under the MIT License. In practice that means anyone may read the code, run it, modify it and distribute their own build; Rabby adds a single restriction, that you may not reuse its name or logo. The distinction matters because “open source” is used loosely in this category. MetaMask left the MIT license in 2020 and publishes under a custom license that restricts commercial use above ten thousand monthly active users — source-available rather than open source. Rabby’s extension license carries no such restriction. The repository is at github.com/RabbyHub/Rabby.

The mobile app is a different case. Its source is public at github.com/RabbyHub/rabby-mobile, but the repository carries no license file of its own — only individual sub-packages inside it are MIT-licensed. You can read the mobile code. Nothing states what else you are permitted to do with it.

Fourteen audit reports are published across the two repositories, seven per platform, going back to 2021. The most recent are two Least Authority reports finalized on September 2, 2025, plus SlowMist reports for both platforms from August 2025. The extension report raised two issues: a QR code used to sync addresses that an observer could read, and a race condition — a timing flaw that could produce an invalid transaction. The mobile report raised five, including the weak key-derivation function mentioned above and wallet addresses written unencrypted into cloud backups.

One gap deserves naming. Neither repository publishes a smart contract audit. Rabby’s swap and bridge routes run through contracts, and the contract involved in the 2022 incident below had been audited by a firm whose report is not published here. Open client code and an audited client are not the same as an audited contract handling your funds.

Security incidents

Two details matter more than the amount. First, that contract had been audited before launch and the flaw was missed — the honest limit of what an audit certifies. Second, the remedy required user action: anyone who had swapped had to revoke their token approvals by hand, because approvals granted once persist until revoked. Rabby now ships an approval manager that lists every approval currently granted and revokes them from one screen.  

Beyond that single event, the risks are the ones common to every self-custodial wallet: phishing sites requesting a signature, malicious dApps, over-broad approvals, malware on the device, and exposure of the seed phrase. Transaction simulation and risk warnings address the first three. No software addresses the last two.

Privacy: what Rabby collects

Creating a wallet requires no KYC, and Rabby never holds your keys. Most reviews stop there, and that is half the picture.

The privacy policy, last updated December 9, 2025, states that the service automatically collects your IP address, browser and device characteristics, hardware model, operating system, language, referring URLs, country, internet provider or mobile carrier, and information on how and when you use the app, along with diagnostic and performance data.

In the code that is three telemetry stacks running at once: Google Analytics, a self-hosted Matomo instance, and Sentry for crash reporting. There is an opt-out — Settings, then Data Analysis — and it works: the reporting functions check it before sending anything. One detail is easy to miss. Fresh installs start with tracking disabled, but a migration in an earlier version enabled it for users who were already installed. If you have had Rabby a while, check that toggle rather than assuming the default applied to you.

Separately, Rabby queries its own RPC node by default. You can point it at your own endpoint in settings, at the cost of a few features that depend on Rabby’s infrastructure — MEV protection and the Gas Account among them. On-chain activity is public either way.

Matching Rabby to how you use crypto

If you use DeFi across several chains

Supplying liquidity, lending, staking and moving between L2s in the same week is the workflow Rabby is built around. Automatic chain switching removes a step that would otherwise repeat dozens of times, the simulation screen shows the result before signing, and the portfolio view covers what a separate tracker would.

If you are moving from MetaMask

Rabby imports an existing seed phrase, so addresses and history stay where they are. What changes is the moment of signing — a readable summary of what the contract will do, and a warning when an approval is unlimited — and the swap fee, 0.25% against 0.875%.

If you hold Bitcoin, Solana or Tron

Rabby manages EVM accounts only, so those assets need a second wallet permanently. Nothing in the interface works around it — moving value between them means an external swap, for example Exchange Bitcoin (BTC) into an EVM asset before it can arrive in Rabby.

If this would be your first wallet

The extension has no on-ramp, so the first purchase has to happen elsewhere and arrive as a transfer. The interface also assumes working knowledge of gas, approvals and bridges.

Alternatives

Three wallets cover what Rabby does not, each with its own trade-off. 

• MetaMask — when dApp compatibility matters more than cost: a number of older applications support nothing else. Since 2025 it also holds Solana, Bitcoin and Tron accounts natively from one recovery phrase, which Rabby does not. Its in-wallet swap charges 0.875% against Rabby’s 0.25%, and its code, despite the common claim, is source-available rather than open source.
• Trust Wallet — Bitcoin, Solana and Tron alongside EVM assets, with a card on-ramp in the app. Wider asset coverage than Rabby, without the pre-signature simulation screen.
• A hardware wallet with Rabby as the interface — the extension connects to Ledger, Trezor, Keystone, OneKey, GridPlus and six other brands, which keeps Rabby’s signing screens while the keys stay off the computer.

Frequently asked questions

What does Rabby cost?

There is no charge to install the wallet or to hold assets in it. You pay gas on every transaction, plus 0.25% on swaps and bridges made through the wallet. There is no subscription and no paid tier.

Does Rabby support Bitcoin or Solana?

No. Rabby manages EVM accounts only. There is no native support for Bitcoin, Solana, Tron, Monero, Cardano, Cosmos or XRP Ledger, and none has been announced.

Can I buy crypto with a card in Rabby?

Not in the extension. There is no on-ramp and no provider integrated. Funds must arrive from an exchange, another wallet, or a swap service.

Can I import my MetaMask wallet?

Yes. Rabby accepts a seed phrase or private key from MetaMask and other EVM wallets. Addresses, balances and history stay the same, because they exist on-chain rather than inside either app.

Which hardware wallets work with Rabby?

The extension connects to Ledger, Trezor, Keystone, OneKey, GridPlus Lattice and BitBox02, plus imKey, NGRAVE ZERO, CoolWallet, AirGap Vault and imToken — eleven brands in total. The mobile app supports Ledger, Keystone, OneKey and Trezor, and no others.

Is Rabby open source?

The extension is, under the MIT License, with a restriction on reusing the brand. The mobile app’s source is published but carries no license of its own, so you can read it without any stated permission to reuse it.

Is the mobile app the same as the extension?

No. It supports four hardware wallet brands rather than eleven — no GridPlus, no BitBox02 — has no staking, adds prediction markets, charges double the Rabby fee on perpetuals, and its latest audit reported five findings against the extension’s two.

Has Rabby ever been hacked?

We found no published incident in which the Rabby client exposed users’ private keys. In October 2022 an exploit in the separate Rabby Swap contract took roughly $194,500 from users who had approved it. Private keys and unused wallets were unaffected.

Sources

All links checked on August 7, 2026.

• Rabby Wallet official site
• Rabby privacy policy, last updated December 9, 2025
• Rabby extension source and license
• Extension audit reports
• Rabby mobile source
• Mobile audit reports
• Least Authority audit of the extension, September 2, 2025
• Rabby on the Chrome Web Store
• Rabby on the App Store
• Rabby on Google Play
• The Block on the October 2022 exploit
• Neptune Mutual’s technical breakdown of the 2022 vulnerability
• Revoke.cash record of the exploit
• DeBank, the portfolio tracker by the same team
• Aave, the lending protocol behind Rabby’s lending screen
• Hyperliquid, the venue behind Rabby’s perpetuals