{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"wallet","evidenceReadAt":"2026-11-10","generatedAt":"2026-11-12","criteria":[{"id":"key_export","label":"Can I export my own keys and use them elsewhere?","weight":28},{"id":"signing_visibility","label":"Can I see exactly what I am signing?","weight":30},{"id":"incident_record","label":"What has gone wrong, and did they publish it?","weight":24},{"id":"recovery_exit","label":"If I lose my device, how do I get back in?","weight":18}],"providers":{"metamask":{"key_export":{"s":9,"q":"An account's private key can be used to import it into any compatible wallet software. | Click 'Private key' and enter your MetaMask password to confirm. | Tap the icon next to the desired network to copy your private key.","u":"https://support.metamask.io/configure/accounts/how-to-export-an-accounts-private-key/","d":"2026-11-10"},"signing_visibility":{"s":6,"q":"Networks supported for onchain simulations Ethereum, Optimism, BNB, Polygon, Monad, HyperEVM, Sei, Tempo, MegaETH, Robinhood, Arc, Base, Arbitrum, Avalanche, and Linea.","u":"https://support.metamask.io/manage-crypto/transactions/simulations","d":"2026-11-10"},"incident_record":{"s":8,"q":"Security is at the core of our development. Our libraries have been audited by security experts and independent researchers. Reports are public: | Submit a report through the HackerOne platform | Our HackerOne program is temporarily paused while we work through the existing report backlog.","u":"https://metamask.io/security/metamask-security-program","d":"2026-11-10"},"recovery_exit":{"s":9,"q":"This tool was written by MetaMask co-founder Dan Finlay | you can load this page, and then disconnect your internet connection; it will work offline | note: Vault recovery on Android and iOS mobile devices is not currently possible.","u":"https://support.metamask.io/configure/wallet/how-to-recover-your-secret-recovery-phrase/","d":"2026-11-10"}},"rabby":{"key_export":{"s":9,"q":"3) Choose Backup Option: Select Backup Seed Phrase or Backup Private Key | Note: If these options do not appear, it means the seed phrase or private key was not imported into your current Rabby Wallet local file.","u":"https://support.rabby.io/en/articles/14150621-how-to-back-up-seed-phrase-or-private-key","d":"2026-11-10"},"signing_visibility":{"s":8,"q":"It provides a \"preview\" of your transaction, translating complex code into readable words so you can understand exactly what you are signing and avoid blind signing | Beyond showing you the balance change, Rabby's security engine scans the simulation for hidden dangers. | A \"Simulation Failed\"","u":"https://support.rabby.io/en/articles/14124199-understanding-rabby-s-transaction-simulation","d":"2026-11-10"},"incident_record":{"s":7,"q":"[20260824]Rabby_Browser_Extension_Wallet_SlowMist_Audit_Report.pdf | [20261009]Least Authority - Rabby Wallet Extension Final Audit Report.pdf","u":"https://github.com/RabbyHub/Rabby/tree/develop/audits/2026","d":"2026-11-10"},"recovery_exit":{"s":8,"q":"Unlike a traditional website login, your Rabby password exists only on your specific device. Rabby never receives or stores your password | Imported Hardware Wallets and Safe Wallets | The Reset feature is currently unavailable for Rabby Mobile.","u":"https://support.rabby.io/en/articles/14150795-how-to-change-or-reset-your-password","d":"2026-11-10"}},"phantom":{"key_export":{"s":8,"q":"Wallets created with Google or Apple also have a recovery phrase. | Select a network. View or copy your private key. | Because the private key never leaves the enclave environment, the Show Private Key option is not available for these accounts.","u":"https://help.phantom.com/articles/25334064171795","d":"2026-11-10"},"signing_visibility":{"s":7,"q":"Phantom simulates every transaction before you sign and shows a plain language preview of what will happen. If something looks suspicious you will see a warning.","u":"https://help.phantom.com/articles/13515761228051","d":"2026-11-10"},"incident_record":{"s":8,"q":"first alerted Phantom and other top browser extension crypto wallets to a critical vulnerability that put our collective users at risk.","u":"https://phantom.com/learn/blog/keeping-phantom-safe-from-the-demonic-critical-vulnerability","d":"2026-11-10"},"recovery_exit":{"s":7,"q":"If prompted, enter your four-digit PIN. | Phantom automatically restores accounts that previously had activity. | Can I look up a forgotten recovery phrase?","u":"https://help.phantom.com/articles/15079894392851","d":"2026-11-10"}},"trust_wallet":{"key_export":{"s":8,"q":"Navigate to https://link.trustwallet.com/developer on your mobile web browser. | Tap on \"Export Private Keys\". | Tap on the network that you want the private key for. | Developer mode is currently only available on the iOS and Android apps. It is not available on Browser Extension.","u":"https://support.trustwallet.com/en/articles/717168-how-to-export-your-private-keys","d":"2026-11-10"},"signing_visibility":{"s":8,"q":"Simulation. The scanner runs the transaction against the current blockchain state and computes the outcome: which assets leave your wallet, which arrive, which permissions change. | Plain-language result.","u":"https://trustwallet.com/blog/security/how-trust-wallet-security-scanner-works","d":"2026-11-10"},"incident_record":{"s":8,"q":"On December 24, 2025, an unauthorized and malicious version of the Trust Wallet Browser Extension (version 2.68) was published to the Chrome Web Store outside of our standard release process (without mandatory review).","u":"https://trustwallet.com/blog/company/trust-wallet-browser-extension-v268-incident-community-update","d":"2026-11-10"},"recovery_exit":{"s":7,"q":"you will see the options to back up your secret phrase, including Manual and Cloud Backup. | Tap I already have a wallet on the welcome screen | Select Secret phrase and enter your 12 (or 24) words in the correct order","u":"https://support.trustwallet.com/en/articles/717689-how-to-set-up-restore-or-configure-your-trust-wallet","d":"2026-11-10"}},"coinbase_wallet":{"key_export":{"s":5,"q":"Coinbase Wallet generates a 12-word recovery phrase, also known as a seed phrase. Only you have access to it. | Select Show Recovery Phrase. | Email/social log-in wallets linked to your email reappear when you sign back in.","u":"https://help.coinbase.com/en/wallet/managing-account/wallet-recovery-phrase","d":"2026-11-10"},"signing_visibility":{"s":5,"q":"When a Sub Account attempts its first transaction, Coinbase Wallet displays a popup for user approval. | Allows the user to optionally grant ongoing spend permissions for future transactions in that token | enabling future transactions to execute without user approval prompts","u":"https://docs.cdp.coinbase.com/coinbase-wallet/improve-ux/sub-accounts","d":"2026-11-10"},"incident_record":{"s":7,"q":"to cover the Base network and Base infrastructure. | to cover all deployed smart contracts for Base, and those used as part of Coinbase products and services.","u":"https://raw.githubusercontent.com/coinbase/smart-wallet/main/SECURITY.md","d":"2026-11-10"},"recovery_exit":{"s":6,"q":"We created an encrypted Google Drive and iCloud feature for backup of your recovery phrase. | Signing out of Coinbase Wallet signs you out of all wallets. Recovery phrase wallets are removed from the app and must be re-imported using their individual recovery phrases.","u":"https://help.coinbase.com/en/wallet/managing-account/wallet-recovery-phrase","d":"2026-11-10"}},"exodus":{"key_export":{"s":9,"q":"You have full control of your private keys with Exodus wallet | Only Exodus Desktop supports viewing private keys. | a) Click the More icon in the top right corner, and b) click View Private Keys . | Enter your password and click Unlock Now to view your private keys.","u":"https://intercom.help/exodus/en/articles/8598615-how-do-i-view-my-private-keys","d":"2026-11-10"},"signing_visibility":{"s":2,"q":"Support for Exodus Web3 Wallet ended on October 1, 2026 . | Sending, receiving, and viewing your balances are no longer available. | To keep using dApps or web3 apps, you'll need to use a different wallet that supports web3 connections.","u":"https://intercom.help/exodus/en/articles/8598807-support-for-exodus-web3-wallet-browser-extension-has-ended","d":"2026-11-10"},"incident_record":{"s":6,"q":"Exodus’ coordinated vulnerability disclosure program is operated via our bug bounty program with HackerOne. Find our program here: Exodus HackerOne Bounty. Program details and bounty award ranges are detailed there.","u":"https://www.exodus.com/security","d":"2026-11-10"},"recovery_exit":{"s":9,"q":"As long as you have your 12-word secret key, you can access your funds on the blockchain by importing your secret key into another BIP39-compatible self-custodial wallet.","u":"https://intercom.help/exodus/en/articles/8598852-what-happens-if-exodus-goes-out-of-business","d":"2026-11-10"}},"rainbow":{"key_export":{"s":8,"q":"You're able to get the specific private key of each address by checking out the instructions below: | From here, next to the wallet address, you'll tap the 3 dots and View Private Key | Lastly, after reviewing the message, you'll tap Show Private Key where you can copy and export!","u":"https://rainbow.me/support/app/export-your-private-key","d":"2026-11-10"},"signing_visibility":{"s":5,"q":"Enabled Transaction Previews and simulation for Contract deployments | Now hiding Transaction Simulation tabs when no result is available","u":"https://rainbow.me/updates/extension-v1-4-65","d":"2026-11-10"},"incident_record":{"s":2,"q":"Being open source is a significant factor that enhances the safety of Rainbow. | Rainbow's team consists of world-class developers who have years of experience working on some of the most trusted wallets in the world, like MetaMask.","u":"https://rainbow.me/support/safety/is-rainbow-wallet-safe","d":"2026-11-10"},"recovery_exit":{"s":9,"q":"In Rainbow, you can instantly backup your wallet using our Backup feature | Even if you use our backup feature, it's recommended you also back up manually.","u":"https://rainbow.me/support/app/the-importance-of-backups","d":"2026-11-10"}},"solflare":{"key_export":{"s":10,"q":"Step 4: Click Export Recovery Phrase (or Private Key) | Step 3: Select Export Recovery Phrase (or Private Key)","u":"https://www.solflare.com/guides/how-to-export-and-import-wallets-in-solflare/","d":"2026-11-10"},"signing_visibility":{"s":7,"q":"conveniently called Solflare Core | Before you approve anything, Solflare runs a transaction simulation in the background. | This checks what the transaction actually does, not just what it claims to do.","u":"https://www.solflare.com/crypto-101/crypto-wallet-security-101-how-solflare-protects-your-assets/","d":"2026-11-10"},"incident_record":{"s":2,"q":"Solflare Guards inspect every transaction, ensuring nothing suspicious goes down | Recovery phrases we use are almost impossible to hack.","u":"https://www.solflare.com/security/","d":"2026-11-10"},"recovery_exit":{"s":9,"q":"Select the Derivation path that has your wallets on it and enable all the wallets with assets on it.","u":"https://help.solflare.com/en/articles/16293240-importing-an-existing-recovery-phrase","d":"2026-11-10"}},"sparrow":{"key_export":{"s":6,"q":"This guide will create a keystore using BIP39, a common standard which uses a set of words to create a private key or seed. | Sparrow will then give you the opportunity to check your derivation path.","u":"https://sparrowwallet.com/docs/quick-start.html","d":"2026-11-10"},"signing_visibility":{"s":5,"q":"Starting with coin control and ending with a detailed byte level transaction viewer, Sparrow gives full transparency and control throughout the transaction creation and signing process. | Uniquely, Sparrow provides an editable diagram showing your inputs and outputs as you create a transaction","u":"https://sparrowwallet.com/features/","d":"2026-11-10"},"incident_record":{"s":4,"q":"There is currently no bug bounty programme for Sparrow. | There aren't any published security advisories","u":"https://github.com/sparrowwallet/sparrow/security","d":"2026-11-10"},"recovery_exit":{"s":9,"q":"For Software Wallets, you can choose Mnemonic Words (BIP39) or Electrum import. | The derivation path for the xpub, which is usually different for each script type","u":"https://sparrowwallet.com/docs/quick-start.html","d":"2026-11-10"}},"electrum":{"key_export":{"s":6,"q":"Export private keys and sweep coins | The following command will export the private keys of all wallet addresses that hold some bitcoins:","u":"https://electrum.readthedocs.io/en/latest/cmdline.html","d":"2026-11-10"},"signing_visibility":{"s":5,"q":"Defense: users should preview (and confirm details of) any transaction they sign before signing it. | on the screen of the hardware signer","u":"https://electrum.readthedocs.io/en/latest/malware.html","d":"2026-11-10"},"incident_record":{"s":6,"q":"In Electrum versions before 3.3.3, this error is arbitrary text, and what's worse, it is HTML/rich text (as that is the Qt default). | We did not publicly disclose this until now","u":"https://github.com/spesmilo/electrum/issues/4968","d":"2026-11-10"},"recovery_exit":{"s":6,"q":"To restore your wallet from its seed phrase, create a new wallet, select the type, choose \"I already have a seed\" and proceed to input your seed phrase.","u":"https://electrum.readthedocs.io/en/latest/faq.html","d":"2026-11-10"}},"okx_wallet":{"key_export":{"s":6,"q":"OKX Web3 wallet supports backing up either Seed phrase or Private key. | However, the private key of your wallet is different depending on the network.","u":"https://www.okx.com/help/how-do-i-manage-my-wallet-app","d":"2026-11-10"},"signing_visibility":{"s":5,"q":"High-risk tokens are flagged to reduce exposure to honeypots and bad actors. | Our screening system blocks interactions with malicious DApps and addresses.","u":"https://web3.okx.com/security","d":"2026-11-10"},"incident_record":{"s":6,"q":"Verified by onchain security experts Our products are subject to rigorous evaluation by top onchain specialists and independent firms. | Bug bounty program Web3 stays strong with white-hat hackers and a sharp-eyed community behind it. Report bugs. Earn bounties.","u":"https://web3.okx.com/security","d":"2026-11-10"},"recovery_exit":{"s":6,"q":"Select Import wallet, and you'll be prompted to enter your 12-word seed phrase. | We do not store your password or mnemonic phrase.","u":"https://www.okx.com/help/how-do-i-create-import-an-okx-wallet","d":"2026-11-10"}}}}