Is Chainlist safe for finding RPC endpoints

02 September 2026

Chainlist is a convenient tool that aggregates nodes/rpc-endpoint-basics/">RPC endpoint URLs for hundreds of blockchains. You paste a chain ID, click a button, and your wallet connects. The appeal is obvious. The risk is not always visible.

What Chainlist actually is

Chainlist is not an official blockchain registry. It is a community-maintained website. Anyone can submit an RPC URL to add a network to the list. The site does display some verification statuses, but no independent audit is performed on every submission. The data you see is user-contributed.

How RPC URLs end up on Chainlist

The site sources its endpoint list through public submissions. A developer, a project founder, or an anonymous user sends in a URL. Chainlist checks that the URL responds and returns a chain ID. That is the extent of its automated verification. No one confirms the endpoint belongs to the project it claims to serve. No one checks whether the endpoint is malicious.

This open submission model has a clear consequence. A phisher can submit an RPC URL that looks correct, name it after a well-known project, and have it return a valid chain ID. The URL might be https://rpc.arbitrum-mainnet-phish.com. Your wallet will connect without complaint.

The phishing risk is real

A malicious RPC endpoint can do real damage. It returns whatever data the attacker wants. Your wallet will display falsified balances. A dapp calling a malicious RPC might see contract data that says a transaction succeeded when it did not. The attacker can intercept your call and return a crafted response.

Consider a typical scenario. You visit Chainlist, search for a chain, and click "Add to Metamask." Your wallet imports the RPC URL, the chain ID, and a block explorer URL. If the RPC is malicious, your wallet is now talking to an attacker's server. Every read-only call - checking a balance, querying a contract - passes through that server. The attacker sees nothing if you sign nothing, but they can misinform you about the state of the chain.

Verification steps you should take

You can reduce the risk without abandoning Chainlist. Do not connect your wallet to the first recommended endpoint. Do the following:

• Check the chain ID against the official project documentation. Every blockchain publishes its chain ID in its developer docs. If the number on Chainlist differs, do not use that endpoint.
• Verify the RPC URL against the project's official website or GitHub repository. A legitimate project lists its RPC endpoints in its documentation. If Chainlist shows a URL that does not match, discard it.
• Make a small read-only call before any transaction. Call eth_chainId or eth_blockNumber. Compare what the endpoint returns against a known source of truth. A mismatch means the endpoint is lying.
• Use a read-only wallet or a burner account for the first test. Do not connect a wallet holding significant value to an unverified endpoint.

A common misconception

Many users assume Chainlist vets every entry. They do not. The site displays community-submitted endpoints. Some are legitimate. Some are not. The verification badge you see on some entries means the site confirmed the endpoint returns the correct chain ID - nothing more. It does not mean the operator is trustworthy, the URL is official, or the response data is accurate.

Chainlist defaults vs. manual curation

Chainlist offers a path of least resistance: click one button, and your wallet has an RPC. That convenience has a cost. You depend on an unknown third party to provide accurate data about the chain state.

Manual curation is not as hard as it sounds. You find the official project website, locate the RPC endpoints section in their docs, copy one of the URLs listed there, and add it to your wallet manually. The whole process takes under two minutes. The result is an endpoint you have personally verified against the project's own documentation.

For regular use, consider maintaining a small list of endpoints you trust. Keep them in a text file or your password manager. When you need to connect to a new chain, pull the URL from the project's docs, add it manually, and confirm the chain ID. Chainlist can still serve as a reference - check the chain ID there, then cross-reference with the official source. Do not let Chainlist write settings into your wallet.

The honest answer is that Chainlist is a useful starting point, not a definitive authority. Treat every endpoint it offers as unverified until you check it yourself. That one extra minute of validation is the difference between convenience and compromise.

Back to rpc & nodes