A new study of 85 crypto wallet browser extensions reveals a fundamental privacy flaw: the wallets themselves leak enough information to link separate addresses together and track users across websites, even without any hacking or theft involved. Researchers at KU Leuven's DistriNet security group found that these extensions, which collectively serve about 35 million users on the Chrome Web Store, expose addresses through normal operation, allowing outsiders to connect a person's multiple wallets and potentially unmask their real identity.

How Do Wallet Extensions Leak Your Address Information?

The privacy leaks happen through the way wallets communicate with websites and blockchain servers. When a wallet shows your balance, it constantly sends requests to outside servers that contain your wallet address in plain text. If a wallet includes two of your addresses in a single request, or fires separate requests within milliseconds of each other, the server operator can determine that both addresses belong to the same person. Seventeen of the 85 wallets tested exposed connections between a user's separate addresses this way, affecting about 23 million total installs.

The problem extends beyond address linking. Thirty-six of the 85 wallets announce their presence to any website they load, creating a fingerprint that identifies which wallet extensions a user has installed. This fingerprint works even if you never connect a wallet and even if you block cookies. These 36 wallets account for about 82 percent of all the installs studied.

What Happens When You Disconnect a Wallet From a Website?

Many users assume that disconnecting a wallet from a website cuts off access completely. The research found this assumption is often wrong. Of 30 popular Web3 applications tested, only 11 actually sent a proper revoke command when a user clicked "Disconnect" or "Logout." The other 19 simply cleared their own screen without telling the wallet to revoke access.

Even when a revoke command is sent, many wallets ignore it. In 22 of the 36 wallets studied, websites could still read a user's address after requesting revocation, and this access persisted even after clearing cookies and restarting the browser. This creates a persistent tracking tag that is globally unique and unlike a cookie, does not disappear when you clear your browser data. The stale permission remains inside the extension until a user manually opens the wallet's "Connected Sites" list and removes the site by hand.

How Could Your Wallet Address Be Used to Unmask Your Identity?

The most serious privacy risk involves cross-site tracking. Of the 36 wallets that announce themselves to websites, 23 will provide your address from inside an invisible frame that one page has loaded from another site. This creates an opportunity for tracking scripts running on multiple websites to connect your crypto activity to your real identity.

Here is how the attack works: a tracking script runs on both a crypto application you once connected to and an unrelated website. When you visit the ordinary website, the tracker quietly loads the crypto app inside an invisible frame. Because the app's page was already authorized by your wallet, the wallet responds from inside the frame and hands your address back to the tracking script without any action from you. If that same tracking script already has your name or email address on file from the ordinary website, it can now link your pseudonymous crypto profile to your real identity. A wallet address is a public record of balances, transactions, and token holdings, so tying that address to a real name and browsing history gives an attacker a named target whose money is now visible.

The researchers demonstrated that this attack path is real and usable, though they did not claim that trackers are already running it at scale. When they reported this cross-site problem to wallet makers before publishing, most declined to treat it as a bug. MetaMask called it a known issue and said it had no immediate plans to stop injecting its provider because doing so would break too many applications. Rabby argued the attack would require the same malicious script running on two sites at once, calling that "virtually impossible." OKX agreed the finding was technically correct but closed it as informational because it exposes data without stealing money.

Rabby

Steps to Reduce Your Wallet Privacy Exposure

• Clear Old Site Permissions: Open your wallet and remove old site permissions you no longer use. This stops stale-address tracking from persisting after you disconnect, though it does not address address leaks to servers or the installed-wallet fingerprint.
• Use Separate Wallets for Different Activities: Keep different activities on separate wallets or browser profiles to prevent a single address from being linked to all your crypto activity across multiple platforms and services.
• Test Your Wallet's Behavior: The researchers created a demo tool that shows how your own wallet behaves; it runs in your browser and stores nothing. Using a throwaway wallet to test is recommended for safety.

The study builds on 2023 research that first showed browser wallets leaking addresses to outside servers. This new work catches leaks that earlier tools missed, maps out cross-site tracking in detail, and shows how the same leak could be used to unmask people. Unlike scanners that hunt for outright bugs, this paper demonstrates that a wallet does not need a bug to expose you; the leak is built into the design.

The paper was posted on arXiv on July 7 and is set for presentation at the PETS 2026 privacy conference in Calgary, July 20 to 25. By the time of a February 2026 retest, Coinbase Wallet and Coin98 had already fixed the cross-site problem, and Hana Wallet did so later. However, several major wallet providers have indicated that the design is fine as-is.

The real fix, according to the researchers, is not another warning to users. It is wallets that stop exposing themselves inside embedded frames, and an ecosystem standard that defines what logging out must actually do. Until then, the wallets work as designed, and the privacy risks remain built into how browser-based crypto wallets function.

" }