The story always runs the same way. Someone closes their MacBook for the night with the wallet balance intact, and by morning it’s empty. The transactions went out at 3 a.m. while the laptop slept. It seems impossible, because the Mac was off. It isn’t, and knowing why is the most useful thing you can learn about keeping a hot wallet on a Mac. This MacHabits guide to the hot wallet threat model on a Mac walks through it.
A sleeping Mac gives you no protection, because the attacker never used your Mac to take the money.
Why sleep doesn’t matter
A browser wallet such as MetaMask keeps your keys in an encrypted vault on your disk, unlocked by your wallet password. A thief needs two things: a copy of that vault, and either the password or the recovery phrase that rebuilds everything.
With those in hand, your Mac is irrelevant. They open the wallet on their own computer and sign the transactions there. The drain can come minutes after the theft or weeks later, often at night in your timezone, because nobody’s watching.
So the real loss happened earlier: when something copied your vault and captured your password, or when you typed your recovery phrase somewhere you shouldn’t have.
How they get the vault and the password
- Stealers. MacSync and similar malware copy browser wallet extension data, saved browser passwords, your keychain file and your Mac password, which they request directly with a fake prompt. If your wallet password matches or resembles any of those, the vault opens.
- Trojanized wallet extensions. Security researchers documented a campaign aimed at crypto and Web3 developers that modified the MetaMask extension so it sent the wallet password and encrypted vault straight to the attacker. MacSync’s backdoor also has a command for installing browser extensions.
- Lookalike extensions and sites. Fake MetaMask extensions and download pages, pushed with search ads or fake reviews, behave like the real thing until you’ve funded them.
- Phishing for the phrase. Emails and pages posing as MetaMask, with a “mandatory 2026 upgrade” or a fake two-factor setup, drained hundreds of wallets this year. They all end by asking for your recovery phrase.
- Approvals you already signed. A malicious site can trick you into approving unlimited spending of a token. Nothing happens until the attacker uses it, which can be any time later, while your Mac sleeps.
What macOS does and doesn’t protect
- Gatekeeper and notarization stop many malicious apps, but not ones you approve by typing your password, and not commands you paste into Terminal.
- FileVault protects your data if the Mac is stolen and switched off. It does nothing against malware running while you’re logged in.
- Privacy permissions limit what apps can read, but a browser extension runs inside your browser and already has access to the wallet.
Put plainly: on a Mac, as on any computer, a hot wallet is only as safe as everything else running on that computer and in that browser. The hot wallet setup that works starts from that fact.
A threat model that works
- Split your money. Keep only spending money in a hot wallet. Savings belong on a hardware wallet, where every transaction must be confirmed on the device’s own screen.
- Give the wallet its own browser profile, or better, its own macOS user account. Install the wallet extension and nothing else there, and use it only for crypto.
- Use a unique wallet password that isn’t your Mac password, isn’t saved in the browser and isn’t reused anywhere.
- Lock the wallet automatically after a few minutes in its settings.
- Review and revoke token approvals regularly with a trusted approval checker, especially unlimited ones.
- Install wallet extensions only from the link on the wallet’s official site, and check the publisher in the extension store.
- Treat any request for your recovery phrase as an attack. MetaMask, Ledger and Trezor never ask for it by email, in a pop-up or in a browser tab.
- Keep macOS and your browser updated. This week that means 27.0.1, 26.7.1 or 15.8.1.
If it already happened
- From a different, clean device, create a new wallet with a new recovery phrase, and move out anything left in the old wallet and in any wallet that shared its phrase or password.
- Revoke outstanding token approvals from the old address.
- Check the Mac for the signs described in our MacSync guide. If you find any, erase it and reinstall macOS before using it for crypto again.
- Change passwords for email, exchanges and your Apple Account from the clean device.
- Be wary of anyone offering to recover the funds for a fee. Recovery scams target people right after a loss.
The short version
A hot wallet drained while your MacBook slept wasn’t drained through the Mac. Something earlier copied your vault and password, or you entered your recovery phrase somewhere, and the thief signed the transactions on their own machine. Keep only small amounts in a hot wallet, isolate it in its own browser profile or user account, use a unique password, revoke approvals and keep savings on a hardware wallet. The MacHabits breakdown of how hot wallets get drained on a Mac collects the checks in one place. Source: machabits.info/articles/hot-wallet-on-mac-threat-model