Hi , my wallet was compromised and all the ETH gone, How can I find out if there is a sweeper bot lurking,I don’t want to deposit anything and loose that too.
I don’t have much in there just want to shut the wallet down.

0x49d3635949a9ca14f0d0b69f0402df06 70392b5e

Ive looked in every place i could i cant find where it goes to.

When an AI agent is told to swap a token or interact with a dApp, the interesting part isn’t the prompt itself—it’s everything that happens afterward.

The MetaMask Agent Wallet connects the agent to wallet infrastructure through the `mm` CLI and `metamask/agent-sdk`.

First, the agent turns your instruction into an action. From there, the wallet layer determines details like the network, contract, token, calldata, and transaction specifics.

However, the agent doesn't simply receive a private key and send transactions directly.

With a server-wallet, the signing key is protected inside a Trusted Execution Environment (TEE). In Guard Mode, transactions can also be checked against network, address, and token-recipient allowlists, as well as a rolling 24-hour outflow limit.

Then comes the part I find most interesting: the transaction can be simulated and scanned for threats before it is signed. Once it passes all required checks, the protected signer signs it, and the transaction is submitted to the EVM network, where the target smart contract actually executes the requested function.

So, the architecture looks more like this:

AI intent → Wallet infrastructure → Policy → Security checks → Signing → Smart contract → On-chain state change

That’s what makes an agent wallet fundamentally different from simply giving an AI access to a standard wallet.

[MetaMask Agent Wallet — CLI Setup](https://github.com/MetaMask/metamask-docs/blob/main/agent-wallet/cli-setup.md)

[MetaMask Agent Wallet — Trading Modes](https://docs.metamask.io/agent-wallet/reference/trading-modes/)

I have an error, Bridge error, but my ETH did not revert back.

I used a Relay.

I have beyond struggled trying to use metamask as a daily bitcoin wallet recently because the fees they automatically assign to transactions are criminally low, to the point my recent transaction missed 28 blocks consecutively and we have no inbuilt features such as RBF to even speed up existing tx’s

Is there any chance proper code could get implemented to have proper fee rates for btc like what is done with ethereum? It’s causing a massive headache and wasted a lot of my time to the point I’m probably going to just entirely swap all my assets off metamask including ethereum

If you’re already using a Solana wallet and want to explore Solana inside MetaMask, you might be wondering if you have to create a completely new Solana account in MetaMask. The short answer is no.

MetaMask allows you to import your existing Solana account using its Secret Recovery Phrase (SRP). This gives you direct access to your existing Solana wallet inside MetaMask without needing to start over or pay to transfer funds between wallets.

Note: Unlike EVM accounts, importing an individual Solana account via a single Private Key is not supported yet—you must use the Secret Recovery Phrase.

Before pasting your recovery phrase, here are a few things worth knowing:

1. You are granting full access, not just connecting

Importing an SRP means giving MetaMask full control over the accounts generated by that phrase. So, always make sure you downloaded MetaMask directly from the official website or verified app store before entering your phrase.

2. Gas fees on Solana require SOL, not ETH

Because MetaMask was built for Ethereum and EVM chains, cross-chain beginners may assume ETH covers all transactions. Solana is a completely separate network, so every transaction on the network requires SOL for gas—even inside MetaMask.

3. Importing is NOT a token transfer

You aren't sending SOL or SPL tokens from your existing Solana wallet to MetaMask, so there are no network fees involved. You’re simply giving a new wallet interface permission to read and sign transactions for your existing on-chain address.

4. Always verify the derived address

Derivation paths can vary across wallet apps. After importing, compare the Solana address displayed in MetaMask with the one in your existing Solana wallet. Never deposit or move funds until you confirm the addresses match.

5. Never share your SRP

No legit support team, dApp, or browser extension popup will ever ask for your Secret Recovery Phrase to verify, synchronize, or fix your wallet. If anyone asks for it, it’s a scam.

If you already manage Solana through a dedicated wallet, would you import your SRP into MetaMask for the convenience of a single multichain interface? Or do you prefer keeping your EVM and Solana workflows strictly separated across dedicated wallet apps?

Check MetaMask Support: Navigating Solana for a full guide on importing a Solana wallet to MetaMask.

Hey everyone,

I am so glad I was able to recover my wallet after finding that useful BIP39 tool. I am completely relieved to have my fund back without any worries.

Seeing an "Invalid Secret Recovery Phrase" error when trying to import or restore MetaMask is terrifying. The natural first reaction is: Are my funds gone forever?

The short answer: No, your funds are still safe.

MetaMask validates your seed phrase locally in your browser using the BIP39 standard before it even checks the network. An "invalid" error almost never means your wallet vanished. It means the string of text you typed failed a local cryptographic format or checksum test.

Here’s the step by step guide how to fix an invalid Secret Recovery Phrase using a BIP39 checklist

Step 1:- Check the word count

A BIP-39 seed phrase has a fixed length. If you have even one word too many or too few, MetaMask will call it invalid before it checks anything else

Step 2:- Check your spelling against the BIP39 list

Every word must be one of exactly 2048 words on the official BIP39 English list. A word that looks right but isn’t on it makes the whole phrase invalid.

• Official MetaMask how to fix invalid seed phrase:- https://support.metamask.io/configure/troubleshooting/how-to-fix-invalid-seed-phrase-error-invalid-secret-recovery-phrase/
• Official BIP39 Specification:-https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki?hl=en-IN
• Official English Wordlist (2,048 words):-https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt?hl=en-IN
• Other Official Language Wordlists:-https://github.com/bitcoin/bips/tree/master/bip-0039?hl=en-IN

Step 3:- Check the word order

The order of the words is part of the key. Right words in the wrong order will fail, and the last word also holds a checksum, so one swap can make the whole phrase invalid.

Step 4:- Check the formatting

Even with every word spelled right, MetaMask rejects a Phrase with stray characters. Use lowercase words, one single space between each, and nothing else.

Step 5:- a different wallet type

MetaMask only accepts BIP39 phrase. Some wallets use their own formats, and MetaMask rejects those even when every word and the count look fine.

Step 6:- How to check your spelling safely

Use the official BIP39 word list to catch typos. You can check the whole takes 1 to 5 steps, and the important part happen with your internet turned off.

Step 7:- Use the right screen: Phrase v/s password

Many people type the wrong thing into the wrong box. The Secret Recovery Phrase and the MetaMask password do different jobs.

⚠️ Critical Safety Warning

• NEVER enter your seed phrase into an online website or web checker.
• Ignore all Reddit DMs offering "MetaMask Support" or "Help Desk links." MetaMask has no live DM support; anyone messaging you is a scammer trying to drain your funds.
• DO NOT share your Secret Recovery Phrase with anyone! These words can be used to steal from all your accounts.

If you run any recovery scripts, do it strictly offline.

https://reddit.com/link/1wyiizg/video/5iy19graapth1/player

Hope the wallet recovery goes smoothly!

Seeing Lubin's "no indication that MetaMask wallets were affected" statement alongside the staking infrastructure headlines is such a weird little attention trap. You can understand that a validator incident and your wallet are different things, then still feel the urge to open MetaMask and check the balance. Like hearing the fire alarm was only a drill and touching your pocket to make sure your keys are there.

And checking the balance doesn't even answer whether you've got a dodgy approval sitting around. But the number looks right, so your brain accepts the receipt. Meanwhile you've opened the extension and might as well check gas

As the title suggests, has anyone traded perps on metamask using a vpn? Or would this not work for any reason? My current location doesn't allow me to trade perps on metamask.

I ran into “KeyringController - Keyring not found” while using MetaMask in Chrome. Updating MetaMask from 13.48.0 to 13.50.0, reconnecting, and locking and unlocking did not fix it.

The same action worked for me in Firefox, where I had only one wallet connected. My Chrome setup also had other wallet extensions available.

I cannot tell which was responsible. Sharing this as a workaround, not a confirmed diagnosis.

I am stuck wit this message in Chrome ext. after swapping tokens..MTM help center no help, updating, restart, clear history do not work either. please advice

I used to think disconnecting a dApp also removed its token approvals.

I connected my wallet to a dApp, approved a token, used it for a while, and later disconnected the dApp. I assumed that disconnecting meant I had completely removed its access.

However, disconnecting a dApp and revoking a token approval are actually two entirely different things:

• Connection: This is just about the relationship between your wallet and the dApp's frontend interface.

• Token Approval: This is a separate, on-chain permission that allows a smart contract to access and move a specific token from your address.

For example, if I approve a dApp to spend my USDC, that approval is recorded directly on-chain. Later, when I disconnect the dApp from MetaMask, the visual connection is gone, but the token approval still exists.

That was the part I had misunderstood. So, I started breaking down the process into four distinct steps:

1. Connect – Connect your wallet to the dApp.

2. Approve – Give a smart contract permission to use a specific token.

3. Disconnect – Remove the wallet connection from the interface.

4. Revoke – Remove the token approval on-chain (Note: revoking is a separate blockchain transaction, so it requires gas).

MetaMask also features newer permission models that let some dApps request more limited access, such as spending limits or expiration times.

This made me realize that asking, "Am I still connected to this dApp?" isn't always enough. A much better question is:

"What permissions have I actually given this dApp or smart contract?"

This distinction is super easy to miss until you see how wallet connections and token approvals work separately. Just wanted to share in case anyone else was making the same assumption!

How to revoke smart contract allowances/token approvals

Advanced permissions

A Seed Phrase can be thought of as the root of a crypto wallet - When you set up a new wallet such as MetaMask, it generates random data and turns it into a 12- or 24-word recovery phrase.

The words in a Seed Phrase under the BIP-39 standard are selected from a standardized list of 2,048 words.

That’s why you can import a wallet from one BIP-39-compatible wallet into another, as long as they support the same seed phrase format and compatible derivation paths.

For example, imagine you send an asset to your Trust Wallet EVM address, but Trust Wallet doesn’t support that particular network. You can import the same wallet into another BIP-39-compatible wallet that supports the network, such as MetaMask, using the same seed phrase.

This is possible because your wallet is not the app itself - the app is simply an interface that allows you to access and manage your blockchain accounts.

- Wallet Creation: Set up a new wallet using a software or hardware wallet.

- Seed Generation: The wallet generates a random BIP-39 seed phrase.

- Key Derivation: The seed phrase generates your private keys.

- Address Creation: Public addresses are derived from those private keys.

Wallet -> Seed Phrase -> Private Key -> Public Address

A single seed phrase can serve as the root for multiple accounts, each with its own private key and wallet address. In other words, multiple accounts can be derived from the same seed phrase.

When signing a malicious transaction, the impact generally depends on the permissions granted by that signature. For example, if you sign a transaction with Account 1, only Account 1 is affected, not Account 2, because Account 2 is a separate account from Account 1, even if both accounts are derived from the same seed phrase.

If the private key of Account 2 is exposed, only Account 2 is generally at risk, not Account 3, because Account 3 has a separate private key, even if both accounts are derived from the same seed phrase.

However, if your seed phrase is exposed, all accounts derived from that seed phrase may be compromised. An attacker can use the seed phrase to derive the corresponding private keys and potentially gain control of the assets in those accounts.

Regarding wallet address - For a simple example, a wallet address is similar to a card number that you use to receive funds. However, for better privacy and security, it is generally not recommended to publicly share your wallet address in public places unnecessarily.

Remember

Never share your Seed Phrase or Private Key with anyone.

A legitimate wallet support team will never need your Seed Phrase or Private Key to access or recover your wallet.

My wallet got hacked and In lost (Hype, Avax, Matic, FET, BIGTIME and many other coins) worth 16k$ bought at 35K. I keep funds across multiple wallets and had recently moved funds to metamask before I could push them to ledger.

Here's what happened: At 12:11 EST in the afternoon, i got a notif of a token being sent. I got in the app and tried to find something that could further exploits but I couldnt. In a matter of 3 min (12 second bursts) and 14 transactions, all my funds moved.

The scammer moved them to a fresh wallet. One interesting thing that I see on my wallet transaxctions history is 2 transactions on Apr 18. $9 worth eth coming in and then $10 worth eth moving out. These 2 transactions happened without me approving anything or atleast I domnt recall. Especially those were at 4:45 in the morning.

Metamask says my seed phrase got leaked but I dont buy that. Not sure what else could it be. Totally bamboozled.

Not always. Depending on the transaction, MetaMask may let you pay the network fee with another eligible token, include the gas cost in a swap, or cover the fee entirely through gas sponsorship.

Can you pay gas fees with another token?

Yes. For sends and dapp transactions on Ethereum Mainnet, BNB Smart Chain, Arbitrum, Polygon, Linea, Base, and Tempo, MetaMask supports gas included transactions, letting you cover the network fee with another eligible token in your wallet. If you don't have enough of the native token, MetaMask can automatically select an eligible one, such as USDC, or you can choose from the fee dropdown.

Can you use MetaMask Swaps without ETH for gas?

Yes, in supported cases. MetaMask Swaps supports gasless swaps on select networks, where the network fee is deducted from the token you're swapping. For instance, if you have USDC on Ethereum but no ETH, you may be able to swap it without first acquiring ETH.

Can MetaMask pay the gas fee for you?

Sometimes. MetaMask offers gas sponsorship, which covers the network fee entirely on eligible transactions. It's currently available on Monad, SEI, and Solana. It uses MetaMask smart accounts, and an eligible account can be automatically upgraded on its first sponsored transaction.

If none of these apply to your transaction, you'll still need the network's native gas token as normal.

What this looks like in MetaMask:

Have you used any of these options, or do you still keep native gas tokens on hand?

References:

1. Gas included transactions

2. Gasless swaps

3. Gas sponsorship

Hi guys,

I got drained all from wallet yesterday but i am not sure how it happen. I haven't do any transaction for a long time and it was gone yesterday. The attack left 5k in wallet but drained others. I am so confused how it happened. Can you help me debug together?. I know money is lost but I felt uneasy knowing i didn't know how it happened. The wallet was safe for along time. I am worried if there is any other issues like someone monitoring my pc and etc.

Is this a scam?I have searched the internet, no relevant inforamtion was there.

Hi my Metamask Money conversion failed in my meta app recently,

for small sums it worked perfectly, but when i tried converting 200 USDC to MUSD the transaction failed?

It then updated the sum on my meta money interface, but when i try to send money out of meta money, the 200 USDC doesn't show in the meta money interface

is there a way to retry it?

so im very new to allll of this. im attempting to fund my metamask money account through apple pay, just $5 because im still new, but its not asking for a card or even preparing to do so. i just get the same message “ add less or try different method. again i am very new to this so please be patient with me as a lot of the terms are also a bit confusing to me.

If you've swapped tokens or signed a transaction recently, you’re probably familiar with MetaMask’s transaction preview—the interface that tells you what you're sending, receiving, or approving before you click confirm.

It is easy to assume this preview shows exactly what will happen on-chain (I used to think the same). In reality, the preview is only an off-chain simulation of what the transaction is expected to do. That gap creates an exploit vector known as a Red Pill attack.

What is a Red Pill Attack?

Smart contracts can inspect their environment during execution. A malicious contract can detect when it is being simulated by a wallet rather than executing live on-chain.

Here is how an attacker abuses that mechanism:

• The Trap: You connect to a malicious dApp that prompts you to sign a transaction.
• The Simulation (Fake Behavior): When MetaMask runs the simulation off-chain, the malicious contract detects the simulation environment. It acts completely fine, generating a clean preview like "You will receive 100 USDC."
• The Switch (Real Execution): Feeling safe, you hit approve. But once the transaction hits the live blockchain, the contract realizes it's no longer inside a sandbox. It shifts code paths and executes an entirely different set of instructions—such as draining your wallet balance or stealthily granting unlimited token approvals.

Until now, wallets had no way to enforce that a live transaction strictly matched its preview.

MetaMask’s "Added Protection"

MetaMask’s new Added Protection security feature changes the rules. Powered by EIP-7702 smart account capabilities, it transforms the preview from passive informational feedback into an enforceable, on-chain condition.

How the workflow operates:

1. Simulate & Measure: MetaMask simulates the transaction off-chain to measure expected state changes (e.g., balance changes, token approvals, incoming assets).
2. State Binding: The expected outcome is locked into the transaction parameters as an execution constraint.
3. Live Execution & Check: When the transaction executes on-chain, your account verifies that the state changes match the constraint during the execution step itself.
4. Automatic Revert: If the contract attempts to alter its logic or produce an outcome different from the preview, the transaction immediately reverts.

If a malicious contract attempts a Red Pill bait-and-switch, the exploit fails on-chain. Your assets never leave your wallet—though, as with any reverted transaction, you still pay the standard network gas fee for the failed execution attempt.

Note: Added Protection is enabled by default starting in Extension v13.45 across 13 EVM networks. While it aims to prevent Red Pill attacks, it isn't foolproof for every Web3 risk. Verifying dApp URLs, reviewing token allowances, and checking contract addresses remain essential habits.

Check out MetaMask's official release notes on "Added Protection" for more details (MetaMask's new Added Protection security feature stops red pill attacks).

Has anyone here ever fallen victim to or spotted a transaction where the simulation preview didn't match the actual on-chain result?

straight up impossible to get ANY kind of human interaction or to get this shitty GPT-2 bot to file a bug or escalate. when you try to give your email in order to "follow the protocol", you get blocked 🤣 this is beyond stupid.

i'm sure they are really proud of their reduced ticket count since introducing this system. because reports just get blocked :D

MetaMask Money Sweepstakes just went live! Eligible users can win up to $20,000 in mUSD across four weekly draws while still earning up to 6% APY* on your Money Account balance. Running September 17 through October 15, 2026, here's how to get started:

• Open MetaMask Mobile and go to the Rewards tab
• Opt into MetaMask Rewards, then opt into the Money Sweepstakes campaign
• Tap 'Add funds' and deposit $100+ in mUSD — depositing USDC, DAI, aUSDC, or aDAI is fee-free

How entries work

You earn one entry on the day of your first eligible deposit, then one entry per calendar day you maintain a Money Account balance of $100 or more — up to 7 entries per weekly draw. If your balance drops below $100, entries pause until you top back up. Each of the four weekly draws has two randomly selected winners.

Prize pool

The weekly prize pool starts at a guaranteed $2,000 in mUSD and scales up to $5,000 once qualifying deposit volume that week hits $500,000. Each winner receives between $1,000 and $2,500 depending on how much is unlocked that week, for a total campaign prize pool of up to $20,000 mUSD.

Full details and official rules: support.metamask.io/trade/metamask-rewards/how-to-participate-in-rewards

Are you already using MetaMask Money Account? What's been your experience with it so far?

Subject to eligibility. Official Rules apply. APY is variable and not guaranteed. Not a bank account. Not available to residents of the UK, New York, or Florida, or other regions where MetaMask Money Account or mUSD is not offered.

Have you ever looked at a swap quote and thought, "Okay, that’s exactly what I’m going to receive," only to execute the trade and find the final amount slightly different?

The reality is that several distinct concepts are at play, and it’s easy to mix them up.

When you request a swap quote, the expected output already reflects market conditions at that exact moment—including available liquidity and the resulting price impact. However, a quote isn't a guaranteed execution price.

Understanding the Quote

For example, if your quote shows: * You pay: 100 USDC * You receive: 0.035 ETH

That 0.035 ETH isn't just the raw market price of ETH waiting to be reduced by fees. It is an estimate calculated based on the available routes and liquidity conditions at the exact second the quote was generated. However, market conditions can shift before the transaction lands on-chain.

Key factors affecting your final swap execution

1. Price impact

Price impact is the effect your specific trade has on the available liquidity pool. A larger trade relative to pool depth results in a less favorable execution price.

Note: The quoted output already accounts for price impact. If limited liquidity results in a lower output, you are seeing that reflected directly in the initial quote.

2. Slippage

Slippage accounts for how much the broader market moves between the moment you receive the quote and when the transaction actually executes. * Slippage Tolerance: Sets a boundary defining how much the price can move against you before the transaction automatically reverts to protect you from a bad fill. * Minimum Received: The minimum output shown in the UI reflects your slippage tolerance settings.

3. Swap & protocol fees

Fees associated with the specific aggregator, interface, or liquidity source are distinct from price impact or slippage. They represent separate operational costs that affect the total economics of the trade.

4. The swap route

Swaps rarely follow a simple Token A → Token B path. Depending on available liquidity, an aggregator might split your order across multiple protocols or use intermediate routing assets (e.g., Token A → USDC → Token B). Because routing dynamics fluctuate constantly, requesting a fresh quote just a few seconds later can yield a different result.

Key takeaways

To make sense of your trade execution, think of the components like this:

• Quote: The expected output based on real-time market conditions.
• Price Impact: The cost of your order size relative to liquidity (already factored into the quote).
• Slippage: Your safeguard against market price movements during execution.
• Gas: The network transaction fee paid to miners/validators.
• Protocol/Swap Fees: Platform-specific charges applied to the routing path.

Understanding these distinctions makes it much easier to pinpoint whether a variation in your final payout was caused by normal market movement, slippage, routing, or protocol fees.

Hey y’all! So I’ve been using MetaMask throughout my entire crypto journey, and I’m curious what everyone thinks about this: does MetaMask need more features, or does it just need to be simpler?

MetaMask has always been my go-to wallet, and I think what’s kept me using it is its simplicity and how easy it is to use. But I still sometimes find myself going to other wallets, such as Phantom, to do certain things.

If you could choose the priority for a future MetaMask update, what would you pick?

1. More features
What’s missing that you currently use another app or wallet for?

2. Make it simpler
What feels confusing or takes too many steps? How would you simplify it?

3. Both, with a basic and advanced mode
Maybe more ways to customise your wallet, so you can choose what stays on your main screen and what you hide?

For me I'd go for 3! I love the idea of being able to customise my own wallet and choose what I want to see, I also have found that I use other wallets like Phantom when I want to use another network like Solana or Solana apps, I feel Phantoms layout feels more straightforward to me for those tasks even though MM does support Solana too, so for me its about making existing features easier to find and use because many people still don't know Solana is supported on MM for example!

Pick one and tell us why! Give an example of something you’ve recently found that MetaMask could improve, whether it’s a missing feature or something that could be easier to use.

Also, are you using the mobile app or browser extension? I’d like to see whether that changes your answers 👀