设置MetaMask：掌控你资产的十二个单词

MetaMask Setup Guide: Ten minutes to determine the safety of your assets

Setting up MetaMask takes less than ten minutes. In those ten minutes, you need to make two decisions that will directly determine the fate of your balance: where to get the software, and how to deal with the twelve words displayed in the setup wizard. Everything else you can change later. These two points alone cannot be reversed.

This article will walk you through the setup process and explain the terms you encountered in the wizard but were not clearly told what they meant: recovery phrase, password, network, chain ID, and authorization approval (Approval). After reading it, you will understand which steps are one-time, which need to be repeated regularly, and where tax authorities and regulators in Germany will intervene.

What is MetaMask? It won't hold anything for you.

MetaMask is a self-managed wallet, also known as an unmanaged wallet. This means that the software generates a key pair on your device and encrypts it. Developers do not hold copies, cannot reset access rights, and there is no hotline to unlock your account. This is the difference from an exchange: in an exchange you have an "account", while in MetaMask you have a "key".

Everything else is derived from this. In this sense, a wallet is not a container for coins. Coins are stored on the blockchain, and wallets are your tool to prove their ownership. If you delete the software, the coin remains where it is; if you lose the key, the coin remains where it is, but no one can touch it from now on, including yourself.

Extension or application?

MetaMask is available in both a desktop browser extension and an Android/iOS application. When you import the same recovery phrase, both fall back to the same state and display the same address. You can only use one version at first. Using both does not mean that a backup copy is created, but provides two access points for the same key.

Install MetaMask: There are only two trusted sources

The most dangerous minute of the entire setup process occurs before you click the wizard. Counterfeit wallet extensions often appear in the browser's official extension directory, often using names similar to "Ethereum Wallet" and equipped with logos similar to real icons. Instead of waiting to steal your assets later, these counterfeits are eavesdropped the moment the wizard generates a recovery phrase or you import an existing phrase, and then unnoticed.

Make a habit to prevent this: install extensions only through the download button on the manufacturer's website metamask.io, and never through search results, message links, videos or forum posts. On mobile phones, download apps from the official app store and check in advance who the publisher is and how many installations are. For a wallet of this size, extensions with only a few hundred users are a warning sign.

A security incident in early October showed that even manufacturers themselves could have problems. Some MetaMask infrastructure suffered a confirmed security incident, resulting in the affected Ethereum validator being removed from the network. For details, please refer to our relevant reports. For settings, this does not change the rule, but makes it more acute: the less places you know your key, the less risk you are losing it.

Twelve words from the random generator: Secret Recovery Phrase

When first launched, MetaMask generates a sequence of twelve words called the "Secret Recovery Phrase", formerly also known as the Seed Phrase. These twelve words are not memory aids or passwords. The private key is calculated from it. Anyone with these words can access the wallet on any device, in any country, without you even knowing it. As MetaMask puts it bluntly in its guide to creating a new wallet: Once a phrase is lost, no one in MetaMask can recover it.

Therefore, the phrase must be saved offline. A piece of paper is better than a document, and a metal plate is better than paper because it resists water and fire. Don't do anything like taking photos, typing them into a notes app, putting them into a password manager in the cloud, or reading them over the phone to someone posing as a support person. There are no circumstances where real employees need these words.

Two paper copies stored in two places

A single copy stored in a single location means that in the event of an accident such as a pipe burst, it is a complete loss. Two copies are stored in two physically separated locations, neither of which is the home of an acquaintance with access, a common compromise. People who hold large amounts will not split the phrase in half because it reduces security and provides limited protection against loss.

Token authorization: What unlimited spending caps mean for your balance

Most losses occur after setting and do not appear on the welcome screen. Once you use a decentralized application (DApp), it requests an "approval", also known as "token approval" or "spending cap" in English. By doing this, you allow the smart contract to transfer a specific amount of a specific token from your address. This is not a flaw in the system, but a prerequisite for the normal operation of exchange, deposit or pledge functions.

关键在于金额。许多应用程序建议授予无限授权，因为这样方便且节省后续使用的费用。该权限将一直存在，直到你撤销它，几个月后也是如此，即使你早已忘记了该应用程序。如果合同后来被接管，或者从一开始就有问题，旧的权限就足以清空你的余额，无需再次确认。

在设置窗口中，你可以覆盖建议的金额，将其设置为当前实际转移的数量。你可以在 MetaMask 的投资组合视图中查看已授予的授权并在那里撤回；制造商在其撤销授权指南中描述了具体路径。这适用于以太坊主网、Polygon、BNB Chain、Optimism 和 Base 等网络。撤销本身也是一笔交易，需要支付网络费用。签名看似简单，实则可能是一种全权委托，我们曾以“钱包劫持者及其签名”为例进行过剖析。

密码仅解锁此设备

在短语之后，向导会要求输入密码。初学者经常在这里混淆两件事。密码仅解密当前浏览器或手机上的密钥库。因此，它保护的是防止有人短暂坐在你的电脑前转账。在新设备上，这对你毫无用处，因为在那些设备上 MetaMask 询问的是十二个单词，而不是密码。

在实践中，这意味着密码可以很长并舒适地保存在密码管理器中；但恢复短语永远不可以。如果你忘记密码，可以使用短语重新设置钱包并分配一个新密码。如果你忘记短语，密码将无法帮助你。

添加网络：以太坊、Solana 和作为防伪造保护的链 ID

设置完成后，你的账户最初位于以太坊主网。此外，MetaMask 现在支持多链账户：一个账户不仅涵盖 EVM 网络，还涵盖如 Solana 等链，其地址根据 BIP-44 派生标准从相同的恢复短语中派生。为此不需要额外的短语。

你可以通过手动输入添加更多网络。MetaMask 要求提供五个详细信息：名称、RPC 地址、链 ID、网络货币符号和区块浏览器地址。链 ID 是真正的保护：它是分配给每条链的唯一标识号，两条具有相同 ID 的网络不可能共存。如果一个欺诈性站点试图让你设置所谓的“官方”网络，一旦你将其数字与该链文档中的数字进行比较，就会在此处暴露。

RPC 地址的来源

RPC 地址是你的钱包与链通信的接入点。提供者可以看到你查询的地址和发送的交易，并在可疑情况下向你展示虚假余额。因此，请从网络的官方文档或你自己持有账户的提供商处获取 RPC 地址，而不是从不熟悉的站点提供的收集目录中获取。

The fee for in-app exchanges is 0.875%

MetaMask itself is free. Wallets make money through built-in exchanges: a service fee of 0.875% is charged for every exchange within the app, regardless of the network. This was disclosed in the quotes that appeared before the confirmation.

In addition, there are two fees that are not attributed to MetaMask. One is the network fee you pay to the network; it fluctuates with load and has nothing to do with the amount exchanged. Second, the trading venue that actually runs the exchange charges its own fees, and depending on the depth of the market, the exchange rate provided may be worse than initially shown. When processing small amounts of money on networks where network costs are expensive, network costs can account for the largest part of the cost.

Therefore, for regular purchases, it is often cheaper to go through an exchange with a euro account, and the wallet becomes the destination rather than the place of purchase. See our Software Wallet Comparison for the performance of various software wallets in this regard.

Hardware wallets replace browsers: Private keys never leave the device

When it comes to losing amounts that will make you feel painful, the next step is worth it. MetaMask can be connected to a hardware device, and the division of roles changes: the wallet is still the interface through which you operate the application, but the private key is on the device and never leaves. Every transaction requires you to confirm it with a button. Malware on a computer can prepare a transaction but cannot sign it.

在浏览器扩展程序中，MetaMask 支持 Ledger、Trezor 和 Lattice 等；在移动应用中，支持 Keystone、Ledger 和 NGRAVE ZERO 等。在购买设备前值得了解两个限制：从 Ledger 只能集成 EVM 账户，且 Trezor 连接仅适用于 BIP-44 派生路径。这两点都在制造商的帮助页面中，但通常在设备到家后才显现。

设备并不取代短语

硬件设备自带恢复短语，该短语适用于此设备上的账户。你旧的 MetaMask 短语不受影响，继续保护浏览器创建的账户。任何迁移者都会明确将余额转移到新地址，并将两个短语视为同等重要。

自我托管钱包需要 BaFin 许可证吗？

不需要，原因就在欧洲加密货币法规 MiCA 本身。受到监管的是为他人持有或管理加密资产的服务提供商。软件中只有你持有密钥，而制造商仅提供程序，不为任何人保管任何东西，因此不属于许可要求范围。这同样适用于 MetaMask 以及其他纯粹的自我托管钱包和无自有托管服务的硬件设备。

界限在于钱包是否提供额外服务。任何为客户持有加密资产、运营针对欧元的交易所或执行订单的行为，都属于提供加密资产服务，在德国需要 BaFin 的许可证，或在其他成员国进行有效通知。

This has an uncomfortable flip side for you as a user. Because there is no supervisory authority behind it, there is no deposit protection, complaints authority, or right to claim compensation in case of error. Self-managed freedom and total lack of safety nets are two sides of the same coin.

German Tax: Transfer to your own wallet is not a sale

Transferring coins from the exchange to your own MetaMask address does not constitute a disposal transaction. You didn't exchange anything and you didn't realize a gain, just changed the storage location. Obtaining data continues to exist, as does the associated holding period.

Article 23 of the German Income Tax Act applies. If you sell within one year of buying it, the proceeds are taxable; tax free after one year. For short-term gains, the threshold is € 1,000 per calendar year, and the word "threshold" should be understood literally: below it, you pay nothing; reaching it, you need to pay tax on all gains, not just the excess.

Your own wallet makes two things more difficult to handle than an exchange account. First of all, you must bring the data with you because there is no provider and the Chamber of Commerce will send the report at the end of the year. Secondly, every transfer will incur network fees, and the handling method is not self-evident. In contrast, an exchange within MetaMask is definitely a tax-related event because you give up one crypto asset and get another.

Phishing traps around recovery phrases

Attacks against wallet users are almost never targeted at technology, but at moments when someone is under stress. Five patterns appear repeatedly:

• In a chat or forum after you just asked the question, a fake support message asks to "verify" your wallet.
• A form that looks like a real setup wizard claims that your wallet must be "synchronized" to ask for twelve words.
• During a phone call, someone pretended to be an employee and claimed that there was a "security incident" requiring immediate action.
• An airdrop page that requires signature rather than approval, with text that no one reads.
• The second browser extension claims to be your wallet plug-in or security check.

In all five cases, the countermeasure rules are the same and simple and easy to remember: twelve words are entered only at two points in time, first set up and restored on a new device. Any other request is an attack, without exception, no matter how convincing the page may seem. Anyone who is uncertain should close the window and start over with the bookmark you have set.

Comparison of MetaMask with Trust Wallet and Phantom

MetaMask is the most widely used software wallet in the Ethereum world, and this coverage is its biggest practical advantage: it is supported by almost all decentralized applications, there are guidelines for every special case, and the hardware is fully compatible. The cost is that it is also the most common target for counterfeit and phishing pages.

Trust Wallet comes from mobile phones and supports more chains out of the box, while desktop extensions feel immature. Phantom has an advantage in the Solana world, and even though more networks are now supported, there is often still a more convenient alternative. For those who are mainly active on Ethereum and the network it builds, MetaMask is still the obvious starting wallet, and switching makes more sense when the focus of gravity shifts permanently.

MetaMask: What to do next

Set up your wallet on a quiet night, not between meetings.

Download the extension only through the manufacturer's website, write twelve words on paper or metal plate, and store the two copies in different places. When it's worth purchasing a device, see our Hardware Wallet Comparison.

When you first contact the application, manually set the authorization to the amount currently being transferred.

Fixed a date in each quarterly calendar to withdraw old authorizations. Which software wallet suits your focus, please see Software Wallet Comparison.

Starting with the first transfer, record the date, quantity and acquisition cost.

Without these details, the one-year period cannot be proved in subsequent periods, and this period is the key to determining tax. Tools that automatically carry this information can be found in Tax and Portfolio Tool Comparison.

(As of October 6, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please check terms with your provider before purchasing.)