Is it safe to connect your wallet to a website?

Connecting your wallet to a website is usually safe in itself, because a connection mostly lets the site see your wallet address. MetaMask's help center says a connected site cannot move your tokens without a separate approval that you sign. The danger is that a malicious site uses the connection as a first step toward getting that approval.

What happens when you connect your wallet?

Early Ethereum browser wallets handed every website your accounts without asking. EIP-1102, an Ethereum proposal from May 2018, described how that let malicious sites see account details and push unwanted transactions. It proposed that sites must request access and get a list of addresses only if the user agrees. That request is the "Connect wallet" prompt you see today.

Once connected, the site knows your address. Because blockchains are public, MetaMask notes that this also reveals your holdings. The site can then ask your wallet to show you a transaction or a message to sign. It cannot complete either without your click.

What is the difference between connecting and signing a transaction?

A connection shares information. A signature or transaction gives an instruction.

When you approve a token spend, you allow a contract to move a set amount of your tokens, and that permission stays until you change it. Some off-chain signatures can do the same job without an on-chain transaction, as explained in what signing a message means. This is why a site asking you to sign just to "verify" or "claim" deserves a careful read of what the wallet actually shows.

Connections through a QR code work the same way. With WalletConnect, the app sends requests and you accept or reject each one in your wallet.

Is it safe to connect your wallet for an airdrop?

Airdrop claims are a well-known route to drained wallets. In a June 2025 alert, the FBI described criminals sending tokens with links in the memo field, or posting offers on social media, that led to fraudulent sites. Those sites asked victims to connect their wallets to claim rewards, and often to enter a password or seed phrase, which let the criminals empty the wallets.

The FBI's advice is to check that an offer really comes from the project, and never to share a seed phrase or one-time code with anyone. A genuine claim never needs your recovery words. Some people use a separate burner wallet with little in it for untested sites.

How do you disconnect your wallet from a site?

In the MetaMask extension, as of November 2026, open the menu, choose Permissions, select the site, and pick Disconnect. A Disconnect all option sits at the bottom of the same screen. From Permissions you can also limit which accounts a site can see.

MetaMask stresses that disconnecting does not revoke token approvals, so a site may still be able to move tokens you approved earlier. To remove those, follow how to revoke token approvals.