The Masks We (Think We) Wear Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem

Jul 16, 2026

Upload by Miles

Cryptocurrency wallets act as the primary interface for managing pseudonymous blockchain addresses and interacting with Web3 applications, yet wallet communications with blockchain infrastructure and dApps create network-side and web-side signals that can break address independence. The paper identifies and formalizes five privacy threats stemming from wallet–network and wallet–browser interactions. Large-scale dynamic measurements of 85 popular Chrome extension wallets (35.16M users) show RPC leakage of structural address links, inconsistent permission revocation, and provider exposure enabling cross-site tracking and identity deanonymization. Results support mitigation guidance through improved wallet implementation and privacy-preserving standards.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages15

Reading Time38 min

Abstract

Introduction

Wallets as financial interfaces and identity providers

Address unlinkability and privacy assumptions

Study scope and threat classes

The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem Weihong Wang DistriNet, KU Leuven Leuven, Belgium [weihong.wang@kuleuven.be](weihong.wang@kuleuven.be) Yana Dimova DistriNet, KU Leuven Leuven, Belgium [yana.dimova@kuleuven.be](yana.dimova@kuleuven.be) Victor Vansteenkiste DistriNet, KU Leuven Leuven, Belgium [victor.vansteenkiste@hotmail.com](victor.vansteenkiste@hotmail.com) Tom Van Goethem DistriNet, KU Leuven Leuven, Belgium [tom.vangoethem@kuleuven.be](tom.vangoethem@kuleuven.be) Tom Van Cutsem DistriNet, KU Leuven Leuven, Belgium [tom.vancutsem@kuleuven.be](tom.vancutsem@kuleuven.be) arXiv :2607 .06 14 1v 1 [ cs .CR] 7 Jul 2026 Abstract Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user’s addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architecturesand provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem. Keywords Browser-Extensions, Blockchain Wallets, Web Tracking, User Privacy This work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license visit [https://creativecommons.org/licenses/by/4.0/ or](https://creativecommons.org/licenses/by/4.0/ or) send a letter to Creative Commons, PO Box 1866, Mountain View, CA 94042, USA. Proceedings on Privacy Enhancing Technologies YYYY(X), 1–15 © YYYY Copyright held by the owner/author(s) . [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX) 1 Introduction Browser-extension wallets such as MetaMask form a common entry point to interact with so-called “Web3” or “decentralized applications” (dApps) in the browser. As illustrated in Figure 1, these wallets typically serve a dual role. First, they operate as a financial interface, querying blockchain nodes (or the wallet’s own backend) for balances and other on-chain data associated with the user’s addresses. Second, they act as an identity provider: when adApp requests access, the wallet lets the user select which address to reveal so the dApp can authenticate the session. The wallet thus coordinates the user’s interactions with blockchain infrastructure on the one hand, and dApp front-ends on the other hand. Figure 1: A wallet’s two roles: financial interfaces (show

FAQs

What privacy assumption do users typically make about cryptocurrency addresses in wallets?

Users often assume wallet-controlled addresses remain independent unless the user intentionally reveals connections. The paper shows that wallet interactions can create signals that undermine this assumption.

How were the privacy threats evaluated in this study?

The authors used large-scale dynamic measurements of 85 popular Chrome Web Store browser-extension wallets, representing 35.16 million users.

What are the main types of privacy threats identified?

The work identifies five classes of threats, including network-side address linkability, web-side wallet fingerprinting, and additional web-side tracking risks enabled by wallet behavior.

Jul 16, 2026

Upload by Miles