Etherscan
Ethereum block explorer for checking transactions, tokens and contracts; it is not a wallet and cannot reverse transactions or recover funds.
Security record: 2 incidents- Search any Ethereum address, transaction, token or contract
- Token Approval Checker lists the contracts allowed to spend your tokens, each with a Revoke button
- Watch List emails you on incoming or outgoing transactions for up to 50 addresses
- Private name tags and notes on any address, visible only to you
- Free account; the API has a free plan and paid plans from 49 USD a month
Six criteria, each 1 to 5 from the facts on this page, weighted into one score inside its category. How we score
- Depth
- Ethereum only; other chains need sister explorers
- Cost
- Free site and account; only the API has paid plans, from 49 USD a month
- Ease
- Search without sign-up; Watch List email alerts; API
- Trust
- Read-only explorer, not a wallet; running for over 10 years
- Access
- Open search; free account for alerts and name tags
- Rewards
- No rewards; free approval checker helps cut exploit risk
- Create a free Etherscan account
- Paste a wallet address into the search bar to see its transactions and tokens
- Add your farming wallets to the Watch List for email alerts
- Open the Token Approval Checker, connect your wallet and revoke approvals you no longer use
Etherscan is not a wallet and cannot reverse transactions or recover funds; each revoke is an onchain transaction that costs gas.
2 incidents
Past incidents 2
Third-party ad script showed phishing wallet popups. Etherscan visitors were prompted to connect MetaMask to nftapes.win, apparently via a malicious Coinzilla ad script also seen on CoinGecko and DEXTools. Etherscan said phishing popups came from a third-party integration, which it disabled. No compensation statement found; Etherscan only disabled the integration (reported by The Block). https://www.theblock.co/linked/146937
Partly own faultRefund not stated
Sources: theblock.co
XSS via Disqus comments showed injected popup. Attackers injected JavaScript through Etherscan's Disqus comment integration, showing a '1337' popup. Etherscan disabled comments and patched it; it said no user funds were compromised. Etherscan confirmed no user funds were compromised (reported by The Register). https://www.theregister.com/2018/07/25/etherscan_xss/
Partly own faultNo user losses
Sources: theregister.com, scotthelme.co.uk
From the project’s statements and security coverage. Own fault means the project’s code, servers or keys; third party means a vendor, registrar, oracle or issuer it relies on.
