Listen to this Post
Introduction
Cryptocurrency has long been promoted as a way to gain greater financial privacy and independence. Millions of users believe that by creating multiple wallet addresses and avoiding centralized platforms, they can remain anonymous while interacting with decentralized applications. However, new academic research suggests that this assumption may not be as strong as many people think.
A team of security researchers from KU Leuven has discovered that many of today’s most popular browser-based cryptocurrency wallets unintentionally expose enough information to allow websites and blockchain infrastructure providers to track users, connect multiple wallet addresses together, and in some cases even associate blockchain identities with real-world individuals. The findings affect wallets used by an estimated 35 million people worldwide and reveal privacy weaknesses that exist by design rather than through traditional software vulnerabilities.
KU Leuven Researchers Reveal Widespread Privacy Risks in Crypto Wallet Extensions
Researchers from KU
Instead of searching for traditional security flaws, the researchers examined how wallets naturally interact with decentralized applications (dApps), blockchain infrastructure, and websites during everyday use.
Their conclusion is concerning: users can be tracked even when no hacking occurs because the wallets themselves expose identifying information as part of their normal operation.
The research paper was published on arXiv and is scheduled for presentation at the PETS 2026 Privacy Enhancing Technologies Symposium in Calgary.
Privacy Rather Than Security Is the Main Concern
Unlike attacks that steal cryptocurrency or compromise private keys, these newly documented issues focus entirely on privacy.
Nothing is hacked.
Nothing is infected.
Nothing is stolen.
Instead, the
For users who believed cryptocurrency transactions were naturally anonymous, these findings challenge one of the ecosystem’s biggest assumptions.
Problem One: Multiple Wallet Addresses Can Be Connected Together
Many cryptocurrency users deliberately create several wallet addresses.
One wallet may be used for DeFi investments.
Another may be reserved for NFT collections.
A third might be dedicated to online purchases or testing decentralized applications.
The expectation is simple: separate addresses equal separate identities.
The researchers found that this separation frequently fails.
Wallets constantly communicate with blockchain infrastructure providers to retrieve balances, transaction histories, and token information.
During these requests, wallet addresses are transmitted openly to backend servers.
In 17 wallets examined during the study, separate addresses belonging to the same user could be linked together.
Thirteen wallets grouped multiple addresses into the same network request, immediately revealing ownership relationships.
Four additional wallets issued requests within milliseconds of each other, allowing infrastructure providers to infer that the addresses almost certainly belonged to the same individual.
According to the researchers, these affected wallets account for approximately 23 million installations.
Once linked, blockchain activity that users intended to keep isolated becomes part of a much larger identity profile.
Problem Two: Disconnecting a Wallet Often Does Not Remove Access
Most cryptocurrency users assume that selecting “Disconnect” or “Logout” immediately removes a website’s ability to communicate with their wallet.
The research suggests otherwise.
The team tested 30 popular Web3 platforms.
Only 11 properly instructed the wallet to revoke existing permissions after a user disconnected.
The remaining websites simply updated their own interface while leaving wallet permissions untouched.
Even more concerning, 22 of the tested wallets continued exposing wallet addresses after receiving legitimate revoke commands.
This behavior remained active even after:
Browser cookies were deleted.
Browsers were restarted.
User sessions ended.
The permission remained stored inside the wallet extension itself.
As a result, websites could continue silently reading wallet addresses until users manually removed permissions inside their wallet settings.
Unlike cookies, wallet addresses do not expire.
They remain globally unique identifiers capable of following users across multiple browsing sessions.
Problem Three: Cross-Site Tracking Could Reveal Real Identities
The researchers identified what may be the most significant privacy issue.
Twenty-three wallet extensions allowed authorized websites embedded inside invisible browser frames to continue requesting wallet addresses.
This creates the possibility for cross-site identity tracking.
Imagine a cryptocurrency platform that previously received wallet permission.
Later, while visiting a completely unrelated website, that site loads the crypto platform invisibly in the background.
Since the wallet still recognizes the embedded platform as previously authorized, it automatically provides the wallet address without user interaction.
If the unrelated website already possesses identifying information such as:
Email address
Full name
Customer account
Phone number
the anonymous blockchain identity can suddenly become associated with a real person.
Once that association exists, attackers or tracking companies gain access to public blockchain history, balances, token holdings, transfers, and financial behavior tied directly to an identified individual.
The researchers emphasize that they demonstrated the technical feasibility of this scenario but did not claim that widespread tracking campaigns are already occurring.
Wallet Fingerprinting Creates Another Layer of Tracking
The study also found that many wallet extensions announce their presence to every website users visit.
Thirty-six wallets automatically reveal which wallet extensions are installed.
Even without connecting a wallet, websites can read this information and use it as a highly distinctive browser fingerprint.
Unlike cookies, which users can block or delete, installed wallet combinations remain surprisingly stable identifiers.
Researchers estimate these fingerprinting behaviors affect around 82% of all wallet installations included in the study.
This creates yet another method for advertisers, analytics companies, or malicious actors to recognize returning users across multiple websites.
Industry Response Shows a Difference in Security Priorities
Before publishing the research, KU Leuven privately disclosed the findings to wallet developers.
Responses varied significantly.
Coinbase Wallet, Coin98, and Hana Wallet implemented fixes addressing the cross-site tracking issue before or shortly after publication.
Other vendors were less concerned.
MetaMask acknowledged the behavior but classified it as a known issue, explaining that changing provider injection could disrupt many decentralized applications.
Rabby argued that the attack scenario required identical malicious scripts operating across multiple websites simultaneously and therefore considered it unrealistic.
OKX accepted the technical findings but categorized them as informational because they expose information rather than directly stealing funds.
Several additional wallet providers considered the findings low risk or outside their vulnerability disclosure scope.
These differing responses illustrate an ongoing debate within the cryptocurrency ecosystem over whether privacy weaknesses should receive the same priority as traditional security vulnerabilities.
Users Have Limited Options for Protection
The researchers note that users can only reduce—not eliminate—the risks.
Removing unused website permissions from wallet settings helps prevent persistent access after disconnecting.
Using separate browser profiles for different cryptocurrency activities can reduce address correlation.
Dedicated wallets for different purposes also provide stronger privacy separation.
Temporary or disposable wallets may further reduce exposure when interacting with unfamiliar decentralized applications.
However, these are workarounds rather than permanent solutions.
The underlying architectural issues remain within wallet software itself.
Privacy by Design Must Become the New Standard
The study ultimately argues that privacy protections should become part of wallet architecture rather than relying entirely on user behavior.
Wallets should avoid exposing provider information unnecessarily.
Embedded frames should not automatically receive wallet access.
Logout functions should consistently revoke permissions across all platforms.
Without standardized privacy expectations across the Web3 ecosystem, users remain responsible for defending themselves against behaviors they often cannot even observe.
As decentralized finance continues expanding, privacy should be considered a core security feature rather than an optional enhancement.
Deep Analysis
Command: Examine the Architectural Weakness
The most important takeaway from this research is that these findings are architectural rather than accidental. The wallets generally operate exactly as their developers intended, meaning the privacy exposure originates from design decisions instead of programming mistakes.
Command: Compare Privacy Versus Security
Most cryptocurrency discussions prioritize stolen funds and hacked wallets. This research shifts attention toward privacy, showing that a secure wallet can still expose sensitive behavioral information.
Command: Evaluate Blockchain Transparency
Public blockchains permanently record transactions. Once a wallet address becomes linked to a person’s identity, years of financial history become visible to anyone capable of querying blockchain explorers.
Command: Assess Real-World Tracking Risks
Although the researchers did not observe large-scale abuse, advertising networks and analytics providers already specialize in linking online identities. Similar techniques could eventually migrate into Web3 ecosystems.
Command: Analyze Wallet Fingerprinting
Wallet fingerprinting functions similarly to browser fingerprinting but may be even more persistent because wallet combinations rarely change.
Command: Examine Permission Persistence
Disconnect buttons often create a false sense of security. If permissions remain stored within wallet extensions, users unknowingly leave long-term identifiers available to websites.
Command: Review Industry Responses
The varied reactions from wallet vendors demonstrate that many organizations still prioritize functionality and compatibility over stronger privacy protections.
Command: Evaluate Infrastructure Providers
RPC providers and blockchain gateway operators receive enormous amounts of wallet traffic. Address correlation at this level creates valuable behavioral datasets.
Command: Consider Enterprise Implications
Organizations increasingly use browser wallets for treasury operations and decentralized finance. Employee privacy may become an enterprise cybersecurity concern rather than an individual issue.
Command: Analyze User Awareness
Many cryptocurrency users believe multiple wallet addresses automatically guarantee anonymity. This research demonstrates that assumption is often incorrect.
Command: Compare Traditional Tracking
Cookies can be deleted.
Wallet permissions may remain.
Cookies expire.
Blockchain addresses remain permanent.
This makes wallet identifiers significantly more valuable for persistent tracking.
Command: Review Privacy Standards
Current Web3 standards emphasize interoperability. Future standards may need mandatory privacy requirements governing provider injection, permission revocation, and embedded content behavior.
Command: Consider Regulatory Attention
Privacy regulators could eventually examine whether wallet extensions expose more personal information than users reasonably expect during normal browsing.
Command: Evaluate Future Wallet Designs
Next-generation wallets may increasingly isolate identities through sandboxed sessions, temporary permissions, encrypted communication channels, and stronger consent mechanisms.
Command: Final Security Perspective
The study reminds the cryptocurrency industry that protecting assets alone is no longer sufficient. Preserving user anonymity must become an equal design priority if decentralized technologies intend to deliver the privacy many users expect.
What Undercode Say:
The Biggest Issue Is Invisible Tracking
The most alarming aspect of this research is not financial theft but silent identity exposure. Users may never realize that multiple wallets, browsing sessions, and blockchain activities are being correlated behind the scenes.
Privacy Expectations Need to Change
Many people incorrectly equate blockchain pseudonymity with anonymity. This research clearly shows that the surrounding software ecosystem can undermine that assumption.
Design Choices Matter More Than Bugs
Traditional vulnerability scanners search for coding mistakes. This study demonstrates that intentional software behavior can create equally serious privacy consequences.
Browser Extensions Have Become High-Value Targets
As cryptocurrency adoption grows, browser wallet extensions increasingly function as digital identity providers. Every design decision now carries significant privacy implications.
Wallet Fingerprints Could Become the Next Tracking Cookie
Tracking technologies continuously evolve. Installed wallet combinations may become one of the strongest identifiers available to analytics platforms if industry standards remain unchanged.
Permission Management Requires Modernization
Disconnecting should mean disconnecting. Anything less creates unnecessary trust issues between users and wallet providers.
Infrastructure Providers Gain Extraordinary Visibility
RPC operators process billions of blockchain requests. Address correlation at this level can generate extensive behavioral intelligence without compromising private keys.
Cross-Site Tracking Is Technically Plausible
Although researchers stopped short of claiming active exploitation, their proof-of-concept demonstrates that the technical pathway exists.
Industry Responses Reveal a Cultural Divide
Some vendors responded quickly with patches, while others viewed the issues as acceptable trade-offs. This difference reflects broader disagreements over whether privacy should be treated as a security objective.
Regulators May Eventually Take Interest
If wallet extensions expose personally identifiable information through normal operation, future privacy regulations could require architectural redesigns rather than optional improvements.
Developers Need Better Standards
Web3 standards currently emphasize compatibility across decentralized applications. Equal attention should now be given to user privacy and permission lifecycle management.
User Education Remains Essential
Even advanced cryptocurrency users often misunderstand what browser wallets reveal. Better documentation and clearer permission interfaces would reduce unnecessary exposure.
Long-Term Trust Depends on Privacy
Mass adoption of decentralized finance depends not only on protecting digital assets but also on protecting digital identities.
The Research Should Not Be Ignored
Because these behaviors are intentional, dismissing them as “not bugs” risks allowing privacy weaknesses to become permanent ecosystem features.
✅ Verified: KU Leuven researchers evaluated 85 browser-based cryptocurrency wallet extensions and documented multiple privacy weaknesses that can expose wallet addresses, fingerprint users, and enable address correlation. The research is scheduled for presentation at PETS 2026.
✅ Verified: The study does not claim attackers are currently exploiting these techniques at internet scale. Instead, it demonstrates that the tracking mechanisms are technically feasible under existing wallet designs and normal browser behavior.
✅ Verified: Several wallet providers acknowledged the findings with varying responses. Some implemented fixes, while others classified the issues as informational or expected behavior rather than security vulnerabilities.
Prediction
(+1) Privacy-Centered Wallets Will Gain Competitive Advantage
Wallet developers are likely to introduce stronger permission controls, improved logout mechanisms, anti-fingerprinting protections, and enhanced identity isolation as privacy becomes a major selling point for Web3 users.
(-1) Identity Correlation Will Become Easier if Standards Do Not Change
If browser wallets continue exposing addresses and permissions by design, tracking companies, threat actors, and intelligence platforms may gradually develop increasingly sophisticated methods to connect blockchain activity with real-world identities, reducing the anonymity many cryptocurrency users currently expect.
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.github.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
