[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83047-en":3,"doc-seo-83047-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83047,13056703019404,"Miles","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","The Masks We (Think We) Wear Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem","Cryptocurrency wallets act as the primary interface for managing pseudonymous blockchain addresses and interacting with Web3 applications, yet wallet communications with blockchain infrastructure and dApps create network-side and web-side signals that can break address independence. The paper identifies and formalizes five privacy threats stemming from wallet–network and wallet–browser interactions. Large-scale dynamic measurements of 85 popular Chrome extension wallets (35.16M users) show RPC leakage of structural address links, inconsistent permission revocation, and provider exposure enabling cross-site tracking and identity deanonymization. Results support mitigation guidance through improved wallet implementation and privacy-preserving standards.","The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem  \nWeihong Wang  \nDistriNet, KU Leuven Leuven, Belgium [weihong.wang@kuleuven.be](weihong.wang@kuleuven.be)  \nYana Dimova  \nDistriNet, KU Leuven Leuven, Belgium [yana.dimova@kuleuven.be](yana.dimova@kuleuven.be)  \nVictor Vansteenkiste DistriNet, KU Leuven  \nLeuven, Belgium [victor.vansteenkiste@hotmail.com](victor.vansteenkiste@hotmail.com)  \nTom Van Goethem  \nDistriNet, KU Leuven Leuven, Belgium [tom.vangoethem@kuleuven.be](tom.vangoethem@kuleuven.be)  \nTom Van Cutsem  \nDistriNet, KU Leuven Leuven, Belgium [tom.vancutsem@kuleuven.be](tom.vancutsem@kuleuven.be)  \narXiv :2607 .06 14 1v 1 [ cs .CR] 7 Jul 2026  \nAbstract  \nCryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption.  \nIn this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user’s addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction.  \nTaken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth.  \nWe discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architecturesand provide actionable guidance for strengthening user privacy in the emerging Web3 ecosystem.  \nKeywords  \nBrowser-Extensions, Blockchain Wallets, Web Tracking, User Privacy  \nThis work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license visit [https://creativecommons.org/licenses/by/4.0/ or](https://creativecommons.org/licenses/by/4.0/ or) send a  \nletter to Creative Commons, PO Box 1866, Mountain View, CA 94042, USA. Proceedings on Privacy Enhancing Technologies YYYY(X), 1–15  \n© YYYY Copyright held by the owner/author(s) .  \n[https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \n1 Introduction  \nBrowser-extension wallets such as MetaMask form a common entry point to interact with so-called “Web3” or “decentralized applications” (dApps) in the browser. As illustrated in Figure 1, these wallets typically serve a dual role. First, they operate as a financial interface, querying blockchain nodes (or the wallet’s own backend) for balances and other on-chain data associated with the user’s addresses. Second, they act as an identity provider: when adApp requests access, the wallet lets the user select which address to reveal so the dApp can authenticate the session. The wallet thus coordinates the user’s interactions with blockchain infrastructure on the one hand, and dApp front-ends on the other hand.  \nFigure 1: A wallet’s two roles: financial interfaces (show","cbCaiovYeC1xIDbp","https://ap.wps.com/l/cbCaiovYeC1xIDbp","pdf",7865290,2,1,15,"English","en",105,"# Abstract\n# Introduction\n## Wallets as financial interfaces and identity providers\n## Address unlinkability and privacy assumptions\n## Study scope and threat classes","[{\"question\":\"What privacy assumption do users typically make about cryptocurrency addresses in wallets?\",\"answer\":\"Users often assume wallet-controlled addresses remain independent unless the user intentionally reveals connections. The paper shows that wallet interactions can create signals that undermine this assumption.\"},{\"question\":\"How were the privacy threats evaluated in this study?\",\"answer\":\"The authors used large-scale dynamic measurements of 85 popular Chrome Web Store browser-extension wallets, representing 35.16 million users.\"},{\"question\":\"What are the main types of privacy threats identified?\",\"answer\":\"The work identifies five classes of threats, including network-side address linkability, web-side wallet fingerprinting, and additional web-side tracking risks enabled by wallet behavior.\"}]",1784184859,38,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-web3-ecosystem","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,47,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":20},"https://docshare.wps.com/document/","Document",{"item":48,"name":12,"@type":43,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-web3-ecosystem/83047/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-23","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What privacy assumption do users typically make about cryptocurrency addresses in wallets?","Question",{"text":75,"@type":76},"Users often assume wallet-controlled addresses remain independent unless the user intentionally reveals connections. The paper shows that wallet interactions can create signals that undermine this assumption.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How were the privacy threats evaluated in this study?",{"text":80,"@type":76},"The authors used large-scale dynamic measurements of 85 popular Chrome Web Store browser-extension wallets, representing 35.16 million users.",{"name":82,"@type":73,"acceptedAnswer":83},"What are the main types of privacy threats identified?",{"text":84,"@type":76},"The work identifies five classes of threats, including network-side address linkability, web-side wallet fingerprinting, and additional web-side tracking risks enabled by wallet behavior.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]