Study Reveals Address Leaks and Tracking Risks in Crypto Wallet Extensions
5 critical privacy flaws affecting 35 million users identified in browser-based wallets.
1Introduction
Researchers at KU Leuven analyzed 85 popular crypto wallet extensions with 35 million users. The study revealed these extensions compromise privacy by linking users' separate addresses. The issues stem from fundamental design choices in how extensions communicate with websites and servers.
2Problem 1: Linked Addresses
Users often maintain separate wallet addresses for different transactions. However, 17 extensions expose connections by bundling addresses in server requests. While 13 combine addresses directly, 4 send sequential requests within milliseconds. This affects 23 million users, creating significant privacy risks.
3Problem 2: Ineffective Disconnection
36 extensions fail to properly terminate access when users disconnect. Only 11 of 30 tested Web3 apps send proper revocation commands. 22 extensions continue leaking address data even after receiving disconnection requests, creating persistent tracking identifiers that survive browser clearing.
4Problem 3: Cross-Site Tracking
23 extensions allow connected sites to identify users on unrelated websites. When the same tracking script runs on both a crypto app and regular site, wallets share addresses without user interaction. This enables de-anonymization by linking wallet addresses to real identities.
5User Mitigations
Researchers recommend users clear old site permissions and use separate wallets for different activities. However, server leaks and extension fingerprinting remain unresolved. A provided demo lets users observe their wallet's behavior without data collection.
6Industry Responses
While Coinbase Wallet and Coin98 implemented fixes, MetaMask acknowledged but declined immediate action, citing compatibility concerns. OKX validated the findings technically but classified them as informational. Rabby dismissed the issue as 'virtually impossible' to exploit in practice.
7Implications
The study exposes fundamental privacy flaws in crypto infrastructure affecting 35 million users. The ability to trace financial activities raises serious security and regulatory concerns. Since most issues stem from core design decisions, comprehensive solutions require vendor cooperation and industry standards.