Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates the privacy vulnerabilities associated with browser-extension cryptocurrency wallets by analyzing 85 popular wallets used by over 35 million users. The authors identify five key privacy threats, including the leakage of structural links between user addresses and inconsistent permission revocation practices, which can lead to user deanonymization and tracking across sessions. Their findings underscore the urgent need for enhanced privacy measures and standardized wallet architectures to protect users in the Web3 ecosystem.
Wallet interactions can expose users to serious privacy risks, linking multiple addresses and enabling cross-site tracking without user consent.
Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures.