MetaMask: Trade Crypto Security & Privacy Scorecard

by MetaMask · iOS

83
Overall trust score
Trustworthy
83
Security
83
Privacy

In-app behavior is tracked by several analytics services, and crash reports may include session replays sent to Sentry. User location can be collected by Braze for CRM and analytics targeting. If identity verification features are used, personal documents are processed by Veriff, a third-party provider.

Best for

Managing crypto and Web3 wallets day-to-day

Avoid if

You want zero location tracking by third parties

Findings

  • 0 critical
  • 0 high
  • 5 medium
  • 5 low
  • 0 info

1 issue identified across security and privacy analysis.

Top security issues

  • Sentry session replay touch tracker compiled into production wallet binary — could capture seed phrases, transaction signing screens, and private key export flows
  • Expo OTA update infrastructure fully configured and enabled with production endpoint — wallet-draining JS bundle delivery possible if check-on-launch re-activated
  • Deprecated kSecAttrAccessibleAlways Keychain protection class referenced — vault keys accessible before device unlock if misapplied

Top privacy issues

  • Sentry Session Replay with undisclosed screen capture capability in a wallet displaying seed phrases and transaction details
  • BrazeLocation SDK collects and links precise location to user identity for analytics — users consent only for hardware wallet BLE scanning
  • Veriff KYC SDK collects biometrics, documents, audio, and sensitive info linked to user identity for any user initiating identity verification

Full analysis

MetaMask: Trade Crypto

What This Means for You

In-app behavior is tracked by several analytics services, and crash reports may include session replays sent to Sentry. User location can be collected by Braze for CRM and analytics targeting. If identity verification features are used, personal documents are processed by Veriff, a third-party provider.

Recommendation: Acceptable

Best For: Managing crypto and Web3 wallets day-to-day
Avoid If: You want zero location tracking by third parties

Key Findings

Data Security - 4 findings (2 medium, 1 low, 1 info)

Network Security - 4 findings (1 medium, 1 low, 2 info)

Code Safety - 0 findings

Privacy - 3 findings (1 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

MetaMask collects behavioral and usage data through Mixpanel and Braze. Crash reports, which may include session replays, are sent to Sentry. Braze also collects user location for CRM targeting and push notification personalization. Using identity verification requires submitting identity documents to Veriff, a third-party KYC provider.

Third-Party Data Sharing

User data is shared with these third-party services:

  • Sentry - Receives crash reports and may capture session replay data reflecting in-app activity.
  • Braze - Receives behavioral data and location information, and handles push notification targeting.
  • Mixpanel - Receives product usage and analytics data.
  • Branch - Receives attribution data to track how users engage with and arrive at the app.
  • Firebase Messaging - Handles push notification delivery only, with no additional behavioral data collection.
  • Veriff - Processes identity documents if KYC or identity verification features are used.

Understanding the Scores

Category Score
Security 83/100
Privacy 83/100
Data Security 85/100
Network Security 92/100
Code Safety 89/100
Data Collection 87/100
Data Sharing 90/100
User Control 89/100

Positive Security Features

  • Network communications for wallet protocol interactions use standard TLS encryption.
  • Firebase Messaging is scoped to push notification delivery, without additional behavioral tracking.
  • Identity verification for KYC uses a dedicated third-party service, keeping document processing isolated from the main app.

Areas for Improvement

  • Crash reporting includes session replay data sent to Sentry, which may capture sensitive in-app interactions beyond basic error information.
  • User location is collected by Braze for CRM and analytics targeting, extending data collection beyond what core wallet functionality requires.
  • Multiple analytics and attribution services collect behavioral data, broadening the overall scope of third-party data sharing.

About This Analysis

This scorecard is based on automated static analysis of the published app binary and configuration files.

App Details

Field Value
App MetaMask: Trade Crypto
Package ID io.metamask.MetaMask
Version 7.72.0 (Build 4333)
Scan Date 2026-04-09

Versions & scan history

ScanDateOverall score
#3 (current) 83/100
#1 81/100