Study of 85 Crypto Wallet Extensions Reveals Address Leaks and Cross-Site Tracking Risks

Researchers at KU Leuven’s DistriNet security group tested 85 popular crypto wallet browser extensions, collectively used by about 35 million users on the Chrome Web Store, and found that the wallets leak enough data to link and track users across websites. The study, published on arXiv on July 7, 2026, and set for presentation at the PETS 2026 privacy conference in Calgary (July 20-25), identified five privacy weaknesses in how wallets interact with websites and blockchain servers.

Key findings include: (1) Address linking: 17 wallets expose connections between a user’s separate addresses by bundling them in requests or firing requests within milliseconds, affecting about 23 million installs. (2) Logout failures: 36 wallets announce their presence to websites, and in 22 of those, a site can still read the user’s address after the user clicks ‘Disconnect’ or ‘Logout’, even after clearing cookies and restarting the browser. (3) Cross-site tracking: 23 of those 36 wallets will hand out the user’s address from inside an embedded frame, allowing a shared tracker on an ordinary website to silently obtain the address and potentially link it to a real identity.

The researchers disclosed the cross-site issue to affected wallet makers before publication. By February 2026, Coinbase Wallet, Coin98, and Hana Wallet had fixed it. However, MetaMask called it a known issue with no immediate plans to change, Rabby denied the vulnerability, OKX closed it as informational, and Bybit, Backpack, and Core deemed it low-risk or out of scope. The study builds on 2023 research by Christof Ferreira Torres and colleagues, showing that wallets do not need a bug to expose users—the leaks are built into their design.