Web3 at risk: wallet extensions can link addresses to identities without stealing keys

A team from KU Leuven University has shown something that many cryptomoneda users already feared but few had been able to document with numbers: the browser wallet extensions, designed to facilitate access to blockchains from web pages, reveal enough information for link directions, follow movements and ultimately de-annonize people they use them. The study, developed by the DistriNet group and published on arXiv prior to its presentation at the PETS 2026 conference, shows that there is no need for a sophisticated explosion or a key theft for privacy to be lost; it is enough with the normal behavior of many extensions and the way Web3 applications interact with them. More information about the research group is available on the DistriNet website: https: / / distrinet.cs.kuleuven.be /.

The work tested 85 popular handlers in the form of browser extension, which add tens of millions of facilities on platforms such as the Chrome Web Store, and drew five practical filtration vectors that allow a remote server or a third party to capture its traffic link several addresses of the same user to each other. These vectors include from the explicit sending of multiple directions in a single request to temporary signals (requests separated by milliseconds) that serve to correlate them, through the ability of a page to detect which extensions of the purse are installed without the user having interacted with them. The result: persistent and globally unique profiles that survive cookies erasing and browser restart if the extension does not correctly revoke the permissions.

The most alarming of the routes described by the researchers is the one that takes advantage of embedded frames (iframes) and shared follow-up scripts. When a tracker runs on several sites and one of them has previously been authorized to read an address, the same script can recharge the approved application within an iframe in another site and receive the address without any user action. If the "normal" site already has a name, mail or visitor identification, the combination turns a critical address, which is public by nature, into a direct link between heritage and real identity. The community following the PETS conference can consult the programme at https: / / petsymposium.org /.

Beyond the implications of privacy, there are practical consequences: knowing the addresses associated with a person allows you to see all your history of transactions, balances and participations in tokens; this facilitates targeted attacks of social engineering, extortion or the construction of economic profiles that many users try to avoid with multiple portfolios. Unlike incidents where keys are stolen, here no asset subtraction, but conscious exposure by software design, and several suppliers have defended the choice of designing their interfaces as well by compatibility or by avoiding breaking the experience of DAPps developers.

What can a user do today? The mitigations are partial but practical: to open the extension and manually clean the list of connected sites reduces the risk that a stale permit will continue to expose an address; to use throwaway for public interactions; to separate activities into different accounts and, where possible, in different browser profiles to avoid the print correlation of installed extensions. It is also advisable to limit extensions to those strictly necessary, and to distrust applications that request connections without a clear reason. These actions help, but They do not solve leaks to external servers or the fingerprinting of installed purse, which require changes in software and standards.

For wallets developers and DAPps managers there are concrete and technical steps that the ecosystem should take: to prevent the extension provider from responding to directions from iframes unless there is an explicit and verifiable user intention; to implement and standardize a revocation API that makes the "Disconnect" effective from the dApp interface; to minimize telemetry and to avoid packing multiple addresses in a single consultation to third parties. These are changes that involve a cost of compatibility, but without them the promise of "autonomy and privacy" of the Web3 ecosystem is weak.

The response of several manufacturers to the responsible disclosure was varied: some corrections were already observed in retests, but other companies closed the reports as "informational" or defended the current design by arguing compatibility with existing applications. This debate reveals a real tension between interoperability and privacy; until industry agrees to minimum standards (for example, to demand explicit consent and effective revocation), the responsibility lies with users and regulators who want to demand safer practices. Meanwhile, researchers and auditors will continue to push suppliers and platforms to reassess what they now accept as normal behavior.

In practice, there is little miraculous solution: combining digital hygiene (cleaning permits, using separate profiles, disposable portfolios) with systemic pressure (public claims, open source reviews, technical guarantees) is the most effective way to reduce risk. Users who handle significant sums should also consider solutions outside the browser, such as hardware forks with limited interfaces, or services that minimize exposure of addresses to third parties. The key lesson is that on Web3 anonymity is achieved not only with keys and directions, but with protocols and products that explicitly limit the signal leaving the customer.