Rabby Wallet vs Coinbase Wallet Rabby Wallet leads by 15 points.
Rabby Wallet scores 15 points above Coinbase Wallet, led by clear signing, key export, and account recovery. Rabby Wallet ranks #1 and Coinbase Wallet #11 of 11 published wallets. Every term of the gap is on the ledger below; the inputs are on the audit receipt.
RBRabby Wallet81
vs
Coinbase Wallet66
Scores are out of 100; published scores fall within 41–99 · ranks #1 and #11 of 11
Rabby Wallet scores 15 points above Coinbase Wallet, led by clear signing, key export, and account recovery.
RBRabby Wallet #1 of 1181
Coinbase Wallet #11 of 1166
Scores are out of 100; published scores fall within 41–99; a bar is empty at 41 and full at 99.
Why, term by termRabby Wallet leads on 3 of 4 published criteria; Coinbase Wallet on 0. The terms sum to the gap.
TermRabby WalletCoinbase WalletWeightPoints
Clear signing8/105/107.2+5.6for Rabby Wallet+2.9 of 32
Key export9/105/106.7+7.0for Rabby Wallet+3.6 of 32
Account recovery8/106/104.3+2.2for Rabby Wallet+1.2 of 32
Net of the terms+14.9
Reproduced gap+14.8
Published gapAfter score rounding and bounds — see the note below8166+15.0
Weight is in points of the 86-point weighted total. Points are score points of the gap between the two.
A row-above bound on one row means the criterion arithmetic does not reproduce the displayed gap exactly.
Rabby WalletScore 81The reference implementation of pre-signature transparency in this pool, and the product that proves the signing axis actually separates. Rabby is a self-custodial EVM wallet from OPCODE LABS PTE. LTD. (the DeBank team), shipping as an MIT-licensed browser extension, a desktop app and iOS/Android apps. Where most wallets show a confirm button, Rabby's help centre documents an entire pre-signature apparatus: a simulation that previews the exact balance change, a decode that turns calldata into a readable action, a named Security Engine whose heuristics are published rather than hand-waved, and — uniquely in this pool — a hard lockout, "If a risk is detected, the Sign button will be disabled." Key custody is equally plain: one vendor page documents both Backup Seed Phrase and Backup Private Key on both platforms, with no email or account anywhere in the flow. The paperwork is better than it first appears: fourteen dated third-party audit reports across two repositories, from SlowMist, Least Authority and Cure53, spanning 2021-2025 and covering the extension, iOS and Android separately, joined by SlowMist reports dated 2026-08-24 for all three. What is genuinely missing is the disclosure machinery — no bug bounty, no security policy, no advisory archive — and the help centre remains silent on the October 2022 Rabby Swap contract exploit that cost users roughly $194,000, an event the vendor did in fact disclose on the day, on X, but never on its own website.Strength: Key export — 9/10Watch-out: Read the incident record before the feature list. Rabby is the strongest pre-signature product in this pool and among the weakest at maintaining a place to tell you when it has failed. There is no bug bounty (zero occurrences of "bount" anywhere in the homepage bundle or the help centre), no SECURITY.md (GitHub states outright "No security policy detected"), no security.txt, no advisory archive, no security@ contact and no postmortem page anywhere on rabby.io or support.rabby.io — so a researcher has no published private channel to report a vulnerability. On 2022-10-11 the Rabby Swap contract was drained of roughly $194,000 of user funds via approvals granted to it. In fairness the vendor did disclose it the same day on X, with a list of affected addresses, the four exploited contract addresses and revoke instructions — but that thread is now the ONLY disclosure that exists, and nearly four years on Rabby's own website and help centre still contain no mention of the event, nor any confirmation that the promised "satisfying solution for users within 1 week" was ever delivered. Weigh that against what IS published, which is more than it first appears: fourteen dated third-party audit reports across two repositories, from SlowMist, Least Authority and Cure53, spanning 2021-2025, with iOS and Android audited separately, and the extension set linked from a "Security & Transparency" section on Rabby's own homepage. Better than most of this pool, and newly refreshed: since August, SlowMist reports dated 2026-08-24 for the extension, iOS and Android have been added to the two repositories' audits/2026 folders. Three narrower things before committing. First, the protection you are buying is documented and sold for the EXTENSION: the Chrome Web Store listing advertises "pre-transaction potential risk scanning" and "upcoming balance change before you sign", while Rabby's own App Store and Google Play descriptions claim neither, so do not assume the mobile app is the same object. Second, no Rabby page ever prints "BIP-39" or a derivation path — verified zero hits across every vendor surface — so if you later want to restore your phrase into a different wallet you will be cycling HD-path options by trial and error. Third, the open-source guarantee is uneven: the extension's code is under an MIT grant (its LICENSE adds that "Brand name and logo of Rabby is copyright reserved", and GitHub reports the licence as NOASSERTION), but the mobile repository carries no licence file at all, so its published source grants no formal right to rebuild it if the vendor disappears.Coinbase WalletScore 66Coinbase's self-custody wallet, renamed back to Coinbase Wallet after a spell as Base App on mobile — and whose default onboarding is now an email/Google/Apple account with cloud recovery, not a seed phrase.Strength: Incident record — 7/10Watch-out: Read this before committing: the wallet you install by default is not a seed-phrase wallet. Coinbase Wallet's own store copy steers a new user to "Sign up with your email address, Google or Apple account for seamless wallet recovery", and offers the seed phrase only as an aside — "Prefer a recovery phrase or passkey?" If you want a key you alone hold, you must actively choose that branch at onboarding, and you should verify the export and restore procedure before funding, because no readable vendor page documents a derivation path or a third-party restore, and the consumer help centre at help.coinbase.com/en/wallet returned HTTP 403 (a bot wall) on 2026-09-28, so no export or restore instruction could be read. Second, and specific to what you sign: Auto Spend Permissions is documented as "enabled by default" for Sub Accounts and is designed to let later transactions "execute without user approval prompts", while a signed Spend Permission lets a spender move assets with "no additional prompts, pop-ups, or signatures needed from the user" — so approving once can authorise a recurring stream you will not be asked about again. Third, the product has been renamed back from Base App: the App Store release notes read "We're now Coinbase Wallet.", the listing is titled "Coinbase Wallet: Trade to Win", Coinbase's developer docs call it "Coinbase Wallet (formerly known as Base App)", the Coinbase Wallet SDK is officially "legacy", and the vendor's own developer link dead-ends on a 404.
Quick facts
At a glance
3 of 4 rows read the same for both.
FactRabby WalletCoinbase Wallet
PricingSnapshotThe wallet itself is free: the iOS listing returns formattedPrice "Free" (iTunes Lookup API, id 6474381673, version 0.6.96, fetched 28 October 2026) and the Chrome Web Store listing carries no price, only an install action (version 0.94.13, "Updated October 23, 2026", fetched 28 October 2026). Rabby monetises the swap route, not the wallet. The vendor states the rate once, on its swap help article: "To support the continuous development of the wallet, a service fee of 0.25% is applied to swaps. This fee is already included in the quote shown to you." (support.rabby.io/en/articles/14134156-how-to-use-rabby-swap, fetched 28 October 2026). A separate vendor page waives that fee for like-for-like pairs: "Enjoy fee-free swaps for eligible pairs on the same chain", with the two groups written open-ended, "Stablecoin ↔ Stablecoin(USDT, USDC, USDS, USDe, etc.)" and "ETH & ETH DeFi tokens(WETH, stETH, wstETH, etc.)" (support.rabby.io/en/articles/15956135-0-swap-fee-token-pairs, fetched 28 October 2026). On its own swap route Rabby does not request infinite approvals: "Rabby only approves the required amount for your specific swap." Two further paid surfaces are priced on their own pages, not this one: Rabby Perps — "Rabby's Perps feature is powered by Hyperliquid. When users place trades, both trading fees and builder fees apply." (support.rabby.io/en/articles/14150488-understanding-rabby-perps-fees) — and GasAccount, where the vendor states "Rabby Wallet does not charge any additional service fees for using GasAccount." (support.rabby.io/en/articles/15338818-what-is-gasaccount-and-how-to-use-it), both fetched 28 October 2026. No subscription, licence or per-seat charge is published on any support.rabby.io page loaded.Free. The App Store listing (now titled "Coinbase Wallet: Trade to Win", apps.apple.com/us/app/coinbase-wallet-trade-to-win/id1278383455, fetched 28 October 2026) carries "price":0 and "priceCurrency":"USD" in its JSON-LD offer block, and the iTunes lookup API for app 1278383455 returns "formattedPrice":"Free" (version 30.18.1, released 26 October 2026). The only fee statement the vendor prints on the listing is a sponsorship footnote: "Coinbase will sponsor fees up to 0.3 USD per transaction with a 2 USD max sponsored monthly per user when you use Coinbase Wallet to send USDC on Base." The same listing says "Spot token trading is powered by third-party decentralized exchange aggregator services. Coinbase Wallet does not exchange digital assets."; no swap or trade spread is stated on any page loaded, and help.coinbase.com returned HTTP 403 on 28 October 2026, so its fee pages are unread rather than silent.
Asset coverageEditorial——
Region fitSnapshotglobalglobal
Custody modelEditorialSelf-custody: the vendor cannot move funds without your keySelf-custody: the vendor cannot move funds without your key
From the published criteria
Which should you pick?
RB
Rabby Wallet
81#1 of 11
Leads
Pick it when
Pick Rabby Wallet if clear signing matters most — it scores 8/10 to Coinbase Wallet's 5/10 there (weight 30).
Strength
Key export — 9/10
Tradeoff
Read the incident record before the feature list. Rabby is the strongest pre-signature product in this pool and among the weakest at maintaining a place to tell you when it has failed. There is no bug bounty (zero occurrences of "bount" anywhere in the homepage bundle or the help centre), no SECURITY.md (GitHub states outright "No security policy detected"), no security.txt, no advisory archive, no security@ contact and no postmortem page anywhere on rabby.io or support.rabby.io — so a researcher has no published private channel to report a vulnerability. On 2022-10-11 the Rabby Swap contract was drained of roughly $194,000 of user funds via approvals granted to it. In fairness the vendor did disclose it the same day on X, with a list of affected addresses, the four exploited contract addresses and revoke instructions — but that thread is now the ONLY disclosure that exists, and nearly four years on Rabby's own website and help centre still contain no mention of the event, nor any confirmation that the promised "satisfying solution for users within 1 week" was ever delivered. Weigh that against what IS published, which is more than it first appears: fourteen dated third-party audit reports across two repositories, from SlowMist, Least Authority and Cure53, spanning 2021-2025, with iOS and Android audited separately, and the extension set linked from a "Security & Transparency" section on Rabby's own homepage. Better than most of this pool, and newly refreshed: since August, SlowMist reports dated 2026-08-24 for the extension, iOS and Android have been added to the two repositories' audits/2026 folders. Three narrower things before committing. First, the protection you are buying is documented and sold for the EXTENSION: the Chrome Web Store listing advertises "pre-transaction potential risk scanning" and "upcoming balance change before you sign", while Rabby's own App Store and Google Play descriptions claim neither, so do not assume the mobile app is the same object. Second, no Rabby page ever prints "BIP-39" or a derivation path — verified zero hits across every vendor surface — so if you later want to restore your phrase into a different wallet you will be cycling HD-path options by trial and error. Third, the open-source guarantee is uneven: the extension's code is under an MIT grant (its LICENSE adds that "Brand name and logo of Rabby is copyright reserved", and GitHub reports the licence as NOASSERTION), but the mobile repository carries no licence file at all, so its published source grants no formal right to rebuild it if the vendor disappears.
Coinbase Wallet
66#11 of 11
Pick it when
Coinbase Wallet leads Rabby Wallet on no published criterion and no score dimension — pick it only if a fact outside the score (country, funding rail, custody) decides for you.
Strength
Incident record — 7/10
Tradeoff
Read this before committing: the wallet you install by default is not a seed-phrase wallet. Coinbase Wallet's own store copy steers a new user to "Sign up with your email address, Google or Apple account for seamless wallet recovery", and offers the seed phrase only as an aside — "Prefer a recovery phrase or passkey?" If you want a key you alone hold, you must actively choose that branch at onboarding, and you should verify the export and restore procedure before funding, because no readable vendor page documents a derivation path or a third-party restore, and the consumer help centre at help.coinbase.com/en/wallet returned HTTP 403 (a bot wall) on 2026-09-28, so no export or restore instruction could be read. Second, and specific to what you sign: Auto Spend Permissions is documented as "enabled by default" for Sub Accounts and is designed to let later transactions "execute without user approval prompts", while a signed Spend Permission lets a spender move assets with "no additional prompts, pop-ups, or signatures needed from the user" — so approving once can authorise a recurring stream you will not be asked about again. Third, the product has been renamed back from Base App: the App Store release notes read "We're now Coinbase Wallet.", the listing is titled "Coinbase Wallet: Trade to Win", Coinbase's developer docs call it "Coinbase Wallet (formerly known as Base App)", the Coinbase Wallet SDK is officially "legacy", and the vendor's own developer link dead-ends on a 404.
Self-identify in 10 seconds
Which one is actually for you?
RBRabby WalletLeads
Choose Rabby Wallet if clear signing matters most
Clear signing: 8/10 against 5/10 for Coinbase Wallet (weight 30)
Key export: 9/10 against 5/10 for Coinbase Wallet (weight 28)
Account recovery: 8/10 against 6/10 for Coinbase Wallet (weight 18)
Rabby WalletScore 81The reference implementation of pre-signature transparency in this pool, and the product that proves the signing axis actually separates. Rabby is a self-custodial EVM wallet from OPCODE LABS PTE. LTD. (the DeBank team), shipping as an MIT-licensed browser extension, a desktop app and iOS/Android apps. Where most wallets show a confirm button, Rabby's help centre documents an entire pre-signature apparatus: a simulation that previews the exact balance change, a decode that turns calldata into a readable action, a named Security Engine whose heuristics are published rather than hand-waved, and — uniquely in this pool — a hard lockout, "If a risk is detected, the Sign button will be disabled." Key custody is equally plain: one vendor page documents both Backup Seed Phrase and Backup Private Key on both platforms, with no email or account anywhere in the flow. The paperwork is better than it first appears: fourteen dated third-party audit reports across two repositories, from SlowMist, Least Authority and Cure53, spanning 2021-2025 and covering the extension, iOS and Android separately, joined by SlowMist reports dated 2026-08-24 for all three. What is genuinely missing is the disclosure machinery — no bug bounty, no security policy, no advisory archive — and the help centre remains silent on the October 2022 Rabby Swap contract exploit that cost users roughly $194,000, an event the vendor did in fact disclose on the day, on X, but never on its own website.Strength: Key export — 9/10Watch-out: Read the incident record before the feature list. Rabby is the strongest pre-signature product in this pool and among the weakest at maintaining a place to tell you when it has failed. There is no bug bounty (zero occurrences of "bount" anywhere in the homepage bundle or the help centre), no SECURITY.md (GitHub states outright "No security policy detected"), no security.txt, no advisory archive, no security@ contact and no postmortem page anywhere on rabby.io or support.rabby.io — so a researcher has no published private channel to report a vulnerability. On 2022-10-11 the Rabby Swap contract was drained of roughly $194,000 of user funds via approvals granted to it. In fairness the vendor did disclose it the same day on X, with a list of affected addresses, the four exploited contract addresses and revoke instructions — but that thread is now the ONLY disclosure that exists, and nearly four years on Rabby's own website and help centre still contain no mention of the event, nor any confirmation that the promised "satisfying solution for users within 1 week" was ever delivered. Weigh that against what IS published, which is more than it first appears: fourteen dated third-party audit reports across two repositories, from SlowMist, Least Authority and Cure53, spanning 2021-2025, with iOS and Android audited separately, and the extension set linked from a "Security & Transparency" section on Rabby's own homepage. Better than most of this pool, and newly refreshed: since August, SlowMist reports dated 2026-08-24 for the extension, iOS and Android have been added to the two repositories' audits/2026 folders. Three narrower things before committing. First, the protection you are buying is documented and sold for the EXTENSION: the Chrome Web Store listing advertises "pre-transaction potential risk scanning" and "upcoming balance change before you sign", while Rabby's own App Store and Google Play descriptions claim neither, so do not assume the mobile app is the same object. Second, no Rabby page ever prints "BIP-39" or a derivation path — verified zero hits across every vendor surface — so if you later want to restore your phrase into a different wallet you will be cycling HD-path options by trial and error. Third, the open-source guarantee is uneven: the extension's code is under an MIT grant (its LICENSE adds that "Brand name and logo of Rabby is copyright reserved", and GitHub reports the licence as NOASSERTION), but the mobile repository carries no licence file at all, so its published source grants no formal right to rebuild it if the vendor disappears.
Coinbase Wallet
Coinbase Wallet leads Rabby Wallet on no published criterion
Choose it only if something outside the published criteria decides for you — your country, a funding rail, or custody.
Coinbase WalletScore 66Coinbase's self-custody wallet, renamed back to Coinbase Wallet after a spell as Base App on mobile — and whose default onboarding is now an email/Google/Apple account with cloud recovery, not a seed phrase.Strength: Incident record — 7/10Watch-out: Read this before committing: the wallet you install by default is not a seed-phrase wallet. Coinbase Wallet's own store copy steers a new user to "Sign up with your email address, Google or Apple account for seamless wallet recovery", and offers the seed phrase only as an aside — "Prefer a recovery phrase or passkey?" If you want a key you alone hold, you must actively choose that branch at onboarding, and you should verify the export and restore procedure before funding, because no readable vendor page documents a derivation path or a third-party restore, and the consumer help centre at help.coinbase.com/en/wallet returned HTTP 403 (a bot wall) on 2026-09-28, so no export or restore instruction could be read. Second, and specific to what you sign: Auto Spend Permissions is documented as "enabled by default" for Sub Accounts and is designed to let later transactions "execute without user approval prompts", while a signed Spend Permission lets a spender move assets with "no additional prompts, pop-ups, or signatures needed from the user" — so approving once can authorise a recurring stream you will not be asked about again. Third, the product has been renamed back from Base App: the App Store release notes read "We're now Coinbase Wallet.", the listing is titled "Coinbase Wallet: Trade to Win", Coinbase's developer docs call it "Coinbase Wallet (formerly known as Base App)", the Coinbase Wallet SDK is officially "legacy", and the vendor's own developer link dead-ends on a 404.
Criterion by criterion
Scorecard
Published criteria · weight in points of 868 of 8 cells scored. Strength is read from the evidence file; the weight is the published one. Methodology
Key export
by 4 of 10weight 6.7 of 86Rabby Wallet leads
Rabby Wallet9/10 out of 10
Coinbase Wallet5/10 out of 10
Clear signing
by 3 of 10weight 7.2 of 86Rabby Wallet leads
Rabby Wallet8/10 out of 10
Coinbase Wallet5/10 out of 10
Incident record
weight 5.8 of 86Tie
Rabby Wallet7/10 out of 10
Coinbase Wallet7/10 out of 10
Account recovery
by 2 of 10weight 4.3 of 86Rabby Wallet leads
Rabby Wallet8/10 out of 10
Coinbase Wallet6/10 out of 10
Score dimensions
weights sum to 86
The published score is five dimensions, each weighted for the category. "Published criteria" is the criteria block above; the other four are the engine's own terms — availability, friction, trust record, measured data. Each bar is one side's points out of that dimension's maximum; the weight beside the name is its points of the 86-point weighted total. The published criteria above can fill 24 of the block’s 30. A weight marked “constant here” belongs to a dimension every ranked product in the category holds at the same value: it still counts in the total, and it orders nothing here.
Availabilityweight 20 of 86 · constant here
Rabby Wallet14/20Coinbase Wallet14/20
Tie
Published criteriaweight 30 of 86
Rabby Wallet19.3/30Coinbase Wallet13.6/30
Rabby Wallet leads
Frictionweight 10 of 86 · constant here
Rabby Wallet2.7/10Coinbase Wallet2.7/10
Tie
Trust recordweight 8 of 86 · constant here
Rabby Wallet3.2/8Coinbase Wallet3.2/8
Tie
Measured dataweight 18 of 86 · constant here
Rabby Wallet8.3/18Coinbase Wallet8.3/18
Tie
Decision rulePublished order
Choose Rabby Wallet unless the term Coinbase Wallet leads on is the one you are buying.
Coinbase Wallet leads Rabby Wallet on no published criterion and no score dimension — pick it only if a fact outside the score (country, funding rail, custody) decides for you.
The published order weighs every criterion the same way for everyone. To weigh them your way, run .
From the published order
Next best action
If this isn't your case
Other matchups worth comparing
How you can lose money here, and what the ranking scores
Key failure: your own keys are made, shown or recovered unsafely.
Scored by Can I export my own keys and use them elsewhere? · 28% (Rabby Wallet 9/10, Coinbase Wallet 5/10)
Scored by Can I see exactly what I am signing? · 30% (Rabby Wallet 8/10, Coinbase Wallet 5/10)
Scored by What has gone wrong, and did they publish it? · 24% (Rabby Wallet 7/10, Coinbase Wallet 7/10)
Scored by If I lose my device, how do I get back in? · 18% (Rabby Wallet 8/10, Coinbase Wallet 6/10)
Rabby Wallet scores 15 points above Coinbase Wallet, led by clear signing, key export, and account recovery. Published scores, out of 100: Rabby Wallet 81 (rank 1 of 11 wallets), Coinbase Wallet 66 (rank 11 of 11).
ReviewedRe-read in progressOverdue; re-read by 10 November 2026.Methodology v2026.10.18
How this page is reviewed
Reviewed means both products compared here was read against its sources on or after that date; every ranked category is re-read at least every 45 days. Models research, extract and parse. A deterministic engine ranks. Every quote passes an adversarial refute pass.
Answer a few quick questions and get one clear recommendation based on how you actually plan to use crypto — with rationale, tradeoffs, and a path to monitor the decision.
No signup·Free first pass · Private·No spam · No account
Not financial advice · Independent · Always do your own research
Not financial advice · For informational purposes only · Always do your own research
Coinbase Wallet #11 of 1166