The Setting Most People Don’t Know Exists
On 17 September 2026, MetaMask shipped Added Protection — a feature that fixes a vulnerability almost nobody outside security research knew was there.
Here’s the problem it solves. Before you approve a transaction, your wallet shows a simulated preview of what should happen. A sophisticated attacker can write a contract that returns benign data during simulation but drains funds or transfers assets elsewhere when the real transaction runs. The industry calls these red pill attacks — the preview is a lie, and the lie is the whole point.
Transaction simulation, the defence most people have come to trust, was never a guarantee. It was a best guess that a hostile contract could deliberately mislead.
Added Protection changes the arrangement. MetaMask still simulates the transaction and shows the expected result — but the simulated outcome is now embedded into the transaction’s execution requirements. If the real execution deviates from the preview you approved, it reverts. MetaMask positions itself as the first self-custody wallet to guarantee that the transaction approved is the transaction that runs, charges nothing for the feature, and takes no fee on reverted transactions.
Note the limit, because it matters: it does not block transactions you intend to make. If you deliberately approve a drainer, Added Protection will faithfully execute your mistake. It closes the gap between preview and execution — nothing more, and nothing less.
At launch it covers Ethereum and EVM applications, with mobile support expected in a later release. Check whether it’s enabled on your installation.
MetaMask: The Settings That Matter, Ranked
1. Transaction simulations — verify it’s on
Settings → Security and privacy → Transaction simulations
When you trigger a transaction on a supported chain, MetaMask sends the raw calldata to its own simulation service — powered by Infura plus Blockaid for security signals — before showing the confirmation popup. Zero gas is spent simulating.
The strength here is reach rather than depth: it’s on by default for a very large user base across many chains, which is why industry-wide drainer losses started plateauing.
Verify it’s actually enabled. People disable it during a debugging session and forget, or import a profile with it off.
2. Added Protection — enable it
Covered above. If your version offers it, turn it on. This is the single most meaningful security addition to a mainstream wallet in 2026, and there is no downside: you pay nothing, and reverted transactions cost you no fee.
3. Security alerts (Blockaid) — leave on
Blockaid-powered security alerts have been on by default for MetaMask extension users since February 2024, warning before potentially malicious transactions across Ethereum mainnet, Arbitrum, Polygon, Avalanche and others.
A caveat worth stating plainly: coverage is not complete. Security researchers have publicly flagged scam transactions on impersonator sites that Blockaid did not catch. Treat the absence of a warning as no information, not as a clean bill of health. A green screen is not a verdict.
4. Connected sites — audit monthly
Settings → Connections (or click the account menu → Connected sites)
Every dApp you’ve ever connected to remains connected until you remove it. Most people have dozens of entries, many for sites they used once and some for sites that no longer exist. Disconnect everything you don’t actively use. This takes four minutes.
Important distinction: disconnecting a site does not revoke token approvals you granted it. Those are separate and live on-chain. Connected sites and approvals are two different lists and you need to clear both — approvals are covered in detail in our guide to approval-scanning tools.
5. Show hex data and custom spending caps
When a dApp requests an approval, MetaMask often lets you edit the amount. Use it. Approve the specific amount the transaction needs rather than accepting the default unlimited allowance.
This single habit, applied consistently, eliminates the largest category of drainer exposure — the forgotten unlimited approval that sits open for years.
6. Auto-lock timer — set it short
Settings → Advanced → Auto-lock timer
The default is generous. Set it to five or ten minutes. This matters for shared machines, laptops in public spaces, and the specific scenario where malware or a malicious extension operates in a browser you’ve left unlocked.
7. Privacy settings worth reviewing
Turn off or scrutinise: participation in usage data collection, IPFS gateway settings, and token autodetection (which leaks your address to third-party APIs). None are security-critical, but all leak information about what you hold — and what you hold determines whether you’re worth targeting.
Phantom: Different Chain, Different Risks
Phantom is the most-installed Solana wallet in 2026 with more than 10 million monthly actives, now covering Solana, Ethereum, Polygon, Base and Bitcoin, with rolling security audits by Kudelski Security and Trail of Bits.
What Phantom gets right by default
Transaction simulation has been built in since 2021 — well before it became an industry norm. Phantom simulates the transaction and shows what assets may move in or out of your wallet, whether the transaction will fail, and whether it has dangerous consequences such as allowing others to spend your tokens. If a transaction would drain your USDC and an NFT, you see that in red before you confirm.
Auto-approve is gone. Phantom removed the auto-approve feature from connection request pop-ups and the trusted-app settings entirely. This was the right call and it’s worth knowing, because older guides still reference it.
Blocklist protection draws on an open-source list of blocked sites maintained by the Solana ecosystem.
Spam NFT handling lets you report, hide, or burn spam NFTs — reclaiming storage SOL and improving ecosystem-wide detection. Airdropped spam NFTs are frequently phishing vehicles; clearing them is hygiene, not housekeeping.
The Phantom setting people miss
Settings → Connected Apps
Regularly check your Connected Apps and revoke access to platforms you no longer use. Same principle as MetaMask, same monthly cadence.
The Phantom risk people underestimate
Phantom is multi-chain now, and the security model is not uniform across chains.
Solana uses different permissioning from EVM, so unlimited-approval drains are less of a vector there. But EVM-side approvals made through Phantom can still be drained exactly as they can through any other EVM wallet.
If you enabled Ethereum, Polygon or Base under Settings → Active Networks, you’ve opted into EVM approval risk — and Phantom’s Solana-native protections don’t extend to it. Audit your EVM approvals separately, through a tool that covers them.
A reasonable rule: enable only the networks you actively use. Each additional active network is additional attack surface for no benefit if you don’t transact on it.
Hardware wallet support
Settings → Accounts → Add / Connect Hardware Wallet
Phantom supports Ledger across Solana, Ethereum and Bitcoin apps. If you hold meaningful value, use it. Many users accept Phantom’s software-only polish as a trade-off; security-focused users pair it with hardware or prefer Rabby or MetaMask plus a hardware wallet.
What Actually Matters Most
Not all of the above matters equally. Ranked by how much loss each actually prevents:
- Hardware wallet pairing — the only measure that survives a fully compromised browser
- Added Protection / transaction simulation enabled — catches the largest class of malicious transactions
- Custom spending caps instead of unlimited approvals — prevents the slow-burn exposure
- Monthly connected-app and approval audits — closes doors you forgot were open
- Short auto-lock — matters in specific physical and malware scenarios
- Privacy settings — reduces targeting, doesn’t prevent theft
If you only do two things from this article, do one and three.
What No Setting Protects Against
Be clear-eyed about the boundary. Every protection above operates inside the wallet. None of them help if:
- You enter your seed phrase into a browser page or a “support” chat
- Your browser is compromised by a malicious extension that can rewrite pages before your wallet ever sees them
- You deliberately approve a transaction you don’t understand
The first is covered in our seed phrase guide. The second is the subject of our guide to malicious browser extensions, and it’s the attack that makes everything in this article conditional.
About the Author
N. Singh is the Founder and Editor-in-Chief of TrueToCrypto.com, with over a decade in blockchain and fintech, focusing on cryptocurrency security and wallet safety.
Transparency: N. Singh holds cryptocurrency and uses Ledger and Trezor hardware wallets. TrueToCrypto may earn affiliate commissions from links in articles. Recommendations are based on security merit, not commission rates. This article is educational and is not financial or security consulting advice.
Contact: info@truetocrypto.com
Wallet interfaces change frequently. Menu paths verified October 2026; if a setting isn’t where described, check the wallet’s own documentation.
