shouldiuse.io

Categories

VERDICT

Thirdweb Review

Depends

Should I use Thirdweb?

Infrastructure for AI Agents - thirdweb.com

· 1 month ago

Buy if you're building an onchain app and want wallets, contracts, RPC, and auth bundled in one platform. Skip it if your product has no blockchain component, or if a multi-incident security record is disqualifying for you.

Confidence

Medium. Based on 30+ public sources; review samples are small, so satisfaction signals are weak.

Ratings

  • Value for moneyNo concrete pricing numbers in reviewed sources
  • Ease of use
  • Feature depth
  • Support qualityNo support evidence found
  • Security posture

Pricing

Usage-based plans

Not published in reviewed sources

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed

Best for

  • Web3 startups shipping token or NFT products
  • Games adding onchain items
  • Teams needing embedded in-app wallets
  • Builders wiring wallets into AI agents

Not for

  • Any product without a blockchain component
  • Hobbyists just learning Solidity — use raw libraries
  • Risk-averse teams handling custody at scale
  • Teams wanting stable, predictable pricing

Gotchas - check before you buy

high

Sep 2025 advisory flagged unauthorized transactions via thirdweb MCP — restrict agent wallet permissions

high

Universal Bridge exploit caused ~$30K loss in Dec 2025; bridge/transfer risk remains

medium

Legacy pricing plans retired Jan 1, 2026 — existing customers forced onto new plans

medium

Wallet pricing changed Sept 2025; usage-based fees make costs unpredictable at scale

Pros and cons

Pros

  • Bundled full stack: wallets, contracts, RPC, auth, payments
  • 95% of code is open source
  • Beginner-friendly; recommended for developers new to blockchain
  • $50K bug bounty and public incident reports
  • $24M raised from Haun Ventures, Coinbase, Shopify

Cons

  • Three public security incidents since 2023, including ~$30K bridge exploit
  • Legacy plans retired Jan 1, 2026; pricing keeps shifting
  • Positioning pivoted from NFTs to AI agents; strategy unsettled
  • Product security page URL returned a 404 at review time
  • Review samples too thin to judge satisfaction

Sources & method

- 10 sources - Three disclosed incidents since 2023 — a library flaw, an MCP advisory, and a bridge exploit — plus an active $50K bug bounty.

official x3review x3security x3news x1
  • Open-source library vulnerability (Dec 2023), A flaw in a common open-source library put multiple NFT collections at risk; thirdweb disclosed it and doubled its bug bounty to $50K.
  • MCP unauthorized transactions advisory (Sep 2025), Security advisory reported thirdweb's MCP setup could enable unauthorized crypto transactions.
  • Legacy Bridge vulnerability (Dec 2025), Thirdweb published an incident report; third-party posts tie a ~$30K theft to a Universal Bridge exploit.

Key stats

  • Ease of use: 4/5

    Rating

  • Not published in reviewed sources

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money. No concrete pricing numbers in reviewed sources
  • Ease of use: 4/5. Positioned as easiest web3 stack; customer stories cite ease
  • Feature depth: 4/5. Comprehensive: wallets, contracts, RPC, auth, payments, agents
  • Support quality. No support evidence found
  • Security posture: 2/5. Three disclosed incidents: 2023 flaw, 2025 MCP advisory, bridge exploit
  • $24M Funding $160M valuation, 2022 (Haun, Coinbase, Shopify)
  • 2021 Founded Raised $5M seed in Dec 2021
  • $50K Bug bounty Doubled after Dec 2023 vulnerability
  • 2.7/5 RFP.wiki rating 1 review — too small to trust

Pricing

Usage-based plans

Not published in reviewed sources

  • Wallet pricing scales with usage (Sep 2025 announcement)
  • Legacy plans retired Jan 1, 2026

Security

Three disclosed incidents since 2023 — a library flaw, an MCP advisory, and a bridge exploit — plus an active $50K bug bounty.

  • Open-source library vulnerability (Dec 2023)A flaw in a common open-source library put multiple NFT collections at risk; thirdweb disclosed it and doubled its bug bounty to $50K.⁵
  • MCP unauthorized transactions advisory (Sep 2025)Security advisory reported thirdweb's MCP setup could enable unauthorized crypto transactions.⁶
  • Legacy Bridge vulnerability (Dec 2025)Thirdweb published an incident report; third-party posts tie a ~$30K theft to a Universal Bridge exploit.⁴

What users say

Reddit threads and reviews skew positive on breadth and beginner-friendliness, but review volume is too small to be conclusive.

“Thirdweb is a comprehensive”
G2 review
“Thirdweb is great for pe”
Reddit, r/ethdev

Companies that use it

  • Coinbase
  • Circle
  • Unthread
  • Forest Knight
Full analysis

Based on 30+ public sources; review samples are small, so satisfaction signals are weak.

Solid all-in-one web3 dev stack, but repeat security incidents and shifting pricing make it a 'depends' for onchain builders.

Methodology

Based on 30+ public sources; review samples are small, so satisfaction signals are weak.

Read how a report is made.

Sources

  1. thirdweb.com — Infrastructure for AI Agentsthirdweb.com
    official
  2. thirdweb Pricingthirdweb.com
    official
  3. Retiring Legacy Pricing Plans on January 1st, 2026blog.thirdweb.com
    official
  4. Smart Contract Incident Report: Legacy Bridge Vulnerabilityblog.thirdweb.com
    security
  5. Multiple NFT collections at risk by flaw in open-source library (BleepingComputer)bleepingcomputer.com
    security
  6. Unauthorized Crypto Transactions Enabled by thirdweb MCP (mcpsec)mcpsec.dev
    security
  7. Thirdweb raises $24M at a $160M valuation (TechCrunch)techcrunch.com
    news
  8. Thirdweb Reviews (G2)g2.com
    review
  9. What do you think about Thirdweb framework (Reddit r/ethdev)reddit.com
    review
  10. Moralis vs thirdweb (RFP.wiki)rfp.wiki
    review

Add this review to your site

This check for Thirdweb says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Thirdweb Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.