MetaMask: Trade Crypto Security & Privacy Scorecard
Android
Usage patterns and app events are shared with Segment Analytics and Sentry for behavioral tracking and crash reporting. Branch.io receives data to attribute how the app was discovered, while Firebase Messaging handles notifications. Veriff may process identity documents if any built-in verification features are used.
Best for
Crypto users comfortable with standard analytics
Findings
- 0 critical
- 0 high
- 4 medium
- 4 low
- 5 info
1 issue identified across security and privacy analysis.
Top security issues
- Unencrypted AsyncStorage (RKStorage SQLite) exposes account metadata, transaction history, and wallet state in plaintext on rooted devices
- Custom ECIES in libecies.so uses AES-CBC without ciphertext authentication (no MAC), enabling potential padding oracle attacks against eth_decrypt
- Conceal cipher fallback stores AES-256 encryption keys as Base64 plaintext in SharedPreferences, fully recoverable on rooted devices
Top privacy issues
- Sentry Session Replay is integrated and remotely configurable — if sample rates are non-zero, wallet screen recordings including balances and transaction data reach Sentry's servers
- Veriff KYC SDK transmits facial biometrics and government ID images to third-party servers (magic.veriff.me) outside MetaMask's direct control
- Branch.io attribution SDK tracks purchase events and can link user identity to marketing attribution data if setIdentity() is called with user-linked identifiers
Full analysis
MetaMask - Crypto Wallet
io.metamask | Version 7.71.0 | Analyzed: 2026-04-09
Overall Security: 86/100 | Overall Privacy: 84/100
What This Means for You
Usage patterns and app events are shared with Segment Analytics and Sentry for behavioral tracking and crash reporting. Branch.io receives data to attribute how the app was discovered, while Firebase Messaging handles notifications. Veriff may process identity documents if any built-in verification features are used.
Recommendation: Trustworthy
Best For: Crypto users comfortable with standard analytics
Key Findings
Data Security - 3 findings (2 medium, 1 low)
Network Security - 3 findings (3 low)
Code Safety - 0 findings
Privacy - 1 finding (1 medium)
Privacy Concerns
What Data is Collected
MetaMask collects behavioral and usage data through Segment Analytics and crash data through Sentry. Firebase Installations registers the device for notification delivery. Branch.io collects referral data to understand how the app was discovered.
Third-Party Data Sharing
| Service | Purpose |
|---|---|
| Segment Analytics | Behavioral tracking and usage analytics |
| Sentry | Crash reporting and error monitoring |
| Branch.io | Attribution and referral tracking |
| Firebase Messaging | Push notification delivery |
| Firebase Installations | Device registration |
| Veriff | Identity verification (if used) |
| Google ML Kit | On-device processing |
| WalletConnect (Yttrium) | Wallet connection protocol |
| QuickNode | Blockchain network access |
Understanding the Scores
| Category | Score |
|---|---|
| Security | 86/100 |
| Privacy | 84/100 |
| Data Security | 70/100 |
| Network Security | 94/100 |
| Code Safety | 90/100 |
| Data Collection | 94/100 |
| Data Sharing | 96/100 |
| User Control | 93/100 |
Positive Security Features
- Network communications are well-protected, reflected in a 94/100 Network Security score.
- Data sharing with third parties is highly selective, with a 96/100 Data Sharing score indicating tight controls on what leaves the app.
- User control options score 93/100, offering meaningful choices about data.
- Code safety practices rate at 90/100, reflecting responsible engineering standards.
Areas for Improvement
- Local data storage practices scored 70/100, the lowest area in this report. Stronger protections for data stored on the device would raise confidence in this area.
- A small number of medium-priority privacy and data handling issues were identified that a future update could address.
- Analytics data collection is active by default. Reviewing the app's privacy settings may provide additional control over behavioral data sharing.
About This Analysis
This report was generated by canITrustThat using automated static analysis of the published app.
App Details
- App: MetaMask - Crypto Wallet
- Package ID: io.metamask
- Version: 7.71.0 (build 4199)
- Platform: Android
- Analysis Date: 2026-04-09
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #3 (current) | 85/100 | |
| #1 | 52/100 |