KU Leuven Researchers Find 85 Browser Crypto Wallets Leak User Data

Key points

• Researchers at KU Leuven in Belgium tested 85 of the most popular cryptocurrency wallet browser extensions and found privacy leaks in every one.
• The wallets expose enough information during normal use to link a person's separate crypto addresses together.
• Websites can quietly track users across the internet through the way wallets announce themselves in the browser.
• On any site that already knows a user's name or email, the leak can attach a real identity to their entire on-chain history.
• The findings, first reported by The Hacker News, cover extensions used by millions of people worldwide.

A team of academic researchers at KU Leuven has published a study showing that the browser extensions people use to hold cryptocurrency are themselves a privacy problem. Every wallet in the study leaked something.

The researchers looked at 85 of the most widely installed wallet extensions: small add-ons like MetaMask that sit inside Chrome or Firefox and let a user sign in to crypto websites and move funds.

What does the leak actually mean for an ordinary user?

It means the person behind the wallet can be followed around the web, and their different crypto accounts can be tied together.

When you visit a website, your wallet extension has to introduce itself so the site knows you can pay in crypto. That introduction, the researchers found, includes signals unique enough to fingerprint you, recognising your specific browser and wallet setup the next time you show up somewhere else.

Separately, the way wallets fetch data from blockchain servers, the computers that keep the public ledger of transactions, can reveal which addresses belong to the same person. Many users keep several addresses on purpose, to separate savings from spending or to stay anonymous. That separation often doesn't hold.

There's a sharper edge too. If you use your wallet on a site that already knows who you are, a shop with your delivery address or an exchange with your ID on file, that site can connect your name to every address the leak reveals. Your on-chain history stops being pseudonymous.

This pattern fits what we've been watching closely. Our 13 July story on the ModHeader extension pulled from Chrome and Edge showed how quietly a browser add-on can collect what it shouldn't, and the KU Leuven findings suggest the structural problem runs deeper than any single extension.

How did the researchers test this?

They installed each of the 85 extensions and monitored both the code inside the wallets and the network traffic going out. The leaks weren't the result of a hack. They came from ordinary design choices repeated across the industry.

The problem is structural. A small number of shared blockchain data providers see an enormous amount of traffic, and wallets expose themselves generously to any webpage that asks, which makes fingerprinting straightforward.

What should wallet users do right now?

A few practical steps.

Keep high-value funds in a hardware wallet, a small physical device that stores keys offline, rather than a browser extension you use daily. Use different browsers, or browser profiles, for different crypto identities you want to keep apart. Be cautious about connecting your wallet to sites that also hold your real name or email, because that's where linkage becomes identification.

None of this fixes the underlying issue. That sits with the wallet developers.

The KU Leuven team has disclosed the findings to the vendors. Fixes will depend on how each wallet changes the way it announces itself to sites and queries blockchain servers. Install updates promptly when they arrive.

Regulators have so far focused crypto privacy rules on exchanges and payment services. Wallet extensions, which sit closer to the user, have received far less scrutiny. Given that our earlier coverage of the "Ill Bloom" wallet flaw showed real money moving to attackers through weak extension security, this study is likely to sharpen that regulatory conversation sooner than the industry expects.