MetaMask Launches New Wallet Protection to Intercept Fraudulent Transfers
According to Decrypt, MetaMask has launched a new batch of wallet security features in its mobile app and browser extension, providing real-time alerts and transaction interception for various common fraud scenarios.
One feature targets "address similarity" attacks: when a user inputs or pastes a recipient address that is highly similar to their historically used addresses but is actually different, the system will proactively display a warning to prevent users from being misled into transferring funds to a fraudulent address disguised as a familiar one.
Another feature specifically identifies investment scams and "pig-butchering" transaction characteristics. When MetaMask detects behaviors that match long-term social manipulation leading to large transfers, it will proactively alert users to the risks instead of waiting for anomalies to be discovered after funds have been transferred.
For scenarios where users are transferring funds to an address for the first time, MetaMask has also added a dedicated reminder: since first-time transfers lack historical transaction records for comparison, this is one of the easiest points for scams to succeed. The system will prompt users to verify the recipient's identity before confirming the transaction.
The transaction confirmation page has been redesigned on both mobile and browser extension platforms to clearly display key information such as recipient address, transfer amount, and contract calls, reducing the likelihood of users mistakenly signing malicious transactions due to unclear page information.
The most significant new feature is "Added Protection": this function previews the transaction before it is executed. If the final execution result does not match the preview, the system will automatically roll back the transaction, preventing "preview vs. actual mismatch" type malicious contract attacks from the source. This feature is prioritized for the browser extension, with mobile support to follow.
Mechanically, this upgrade directly benefits ordinary users holding self-custody wallets and MetaMask itself: enhanced protection helps curb the trend of users moving assets to centralized exchanges out of fear of scams, solidifying MetaMask's share in the Ethereum ecosystem's self-custody wallet market. Meanwhile, scam groups relying on address poisoning, pig-butchering, and malicious contract preview discrepancies will see their success rates significantly reduced due to the simultaneous launch of these interception mechanisms.
Source: Public Information
ABAB AI Insight
MetaMask, incubated and operated by ConsenSys, is the earliest and largest self-custody browser wallet in the Ethereum ecosystem. Over the past few years, the product's security iterations have mostly been reactive—frequent phishing signature attacks around 2022 and the emergence of "address poisoning" incidents in 2023 led to user asset losses and community outcry, prompting MetaMask to gradually add blacklist libraries and signature parsing prompts. The simultaneous launch of address similarity warnings, pig-butchering identification, first transfer reminders, and transaction rollback features marks a shift in MetaMask's security strategy from "post-event patching" to "proactive systematic defense."
In terms of capital and resource investment, these risk control features are backed by the construction of on-chain behavioral characteristic libraries and real-time contract simulation capabilities—"Added Protection" requires a "rehearsal" of execution results before transaction broadcasting, necessitating that MetaMask has independent transaction simulation infrastructure, not just a front-end interface redesign. The on-chain data capabilities accumulated by ConsenSys through the MetaMask Snaps plugin ecosystem and its self-built infrastructure (including its RPC service Infura) support the resource foundation for the launch of such rehearsal-type risk control, with the strategic motive of making security capabilities a moat for wallet products rather than just a free user protection measure.
Comparable paths in the industry include address book verification and transaction simulation warning features previously launched by Coinbase Wallet and hardware wallet manufacturer Ledger, as well as the mature abnormal transfer risk control systems at the exchange level; this indicates that decentralized self-custody wallets are "translating" the risk control capabilities accumulated by centralized exchanges over the years into on-chain native scenarios. The current stage of the industry is a transitional period where self-custody wallets are evolving from mere "asset management tools" to "financial infrastructure with proactive risk control capabilities," with security capabilities replacing early usability and multi-chain support as a new competitive dimension for wallet products.
This is essentially a structural change driven by technological substitution: previously, preventing on-chain fraud relied mainly on user vigilance and community-driven blacklist sharing, which is a labor-intensive and lagging model; whereas transaction simulation and behavioral characteristic recognition represent an automated risk control technology that replaces human vigilance. The mechanism behind this is that as the complexity of on-chain fraud techniques (especially those combining social engineering in pig-butchering) continues to rise, relying solely on user education can no longer reduce the fraud rate. Wallet manufacturers must move risk control to the protocol and client levels, using automated mechanisms to compensate for human judgment shortcomings, which is also a necessary condition for self-custody wallets to maintain user trust and avoid users flowing to custodial platforms.
ABAB News · Cognitive Law
- Security is not a feature; it is the last barrier to retain users.
- Whoever masters transaction rehearsal capabilities holds the pricing power of risk control.
- Education cannot keep up with scams; tools must make judgments for people.