Study Exposes Severe Leaks and Tracking Risks in 85 Crypto Wallet Extensions

KU Leuven, Belgium’s largest and highest-ranked research university, has discovered structural flaws linking user identity to on-chain crypto assets.

Crypto Wallet Extensions Leaking Private Data

According to a recent publication, the study found that 85 popular browser wallet extensions leaked unique user data to third-party trackers and RPC providers (bridges that connect wallets to decentralized protocols). This enabled the trackers to map over 35 million users’ activities and IP addresses to their associated wallet addresses. 

Even more, most of these wallets failed to revoke address permission even after users logged out or cleared session data. All this created a highly specific blueprint for targeted phishing and extortion.

Source: KU Leuven News

While the university refrained from publicizing the list of extensions, it noted that they were popular multi-chain and Ethereum-compatible wallets from the Chrome Web Store. 

Following these findings, companies such as Coinbase Wallet, Coin98, and Hana Wallet installed the necessary patches to prevent unauthorized websites from tracking users’ information. Others, such as OKX Wallet, Bybit Wallet, and Core Wallet, classified the disclosure as low risk and therefore low on their priority lists.

Nonetheless, the university plans to present this vulnerability at the July 20-25, 2026 Privacy Enhancing Technologies Symposium (PETS).

No bailout from the Fed

The study highlights one of the many vulnerabilities plaguing the crypto ecosystem. Just recently, an attacker hijacked the X accounts of SpaceXAI and Starlink, using them to shill the SCATMAN meme coin. Shortly afterward, the attacker executed a rug pull and walked away with about $125,000.

While these events continue to occur, the US Federal Reserve clarified that it would not bail out failed crypto projects. Coupling these with the industry’s inherent vulnerabilities means crypto remains largely a high-stakes “buyer beware” market.