The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem

• URL: http://arxiv.org/abs/2607.06141v1
• Date: Tue, 07 Jul 2026 11:08:23 GMT
• Title: The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem
• Abstract summary: We identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser.<n>We show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth.
• Score: 4.233155487893623
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Cryptocurrency wallets are the primary interface for managing pseudonymous blockchain addresses, viewing balances, and interacting with Web3 applications. Although users typically assume that their addresses remain independent of each other unless intentionally revealed, modern wallets routinely communicate with both blockchain infrastructure and decentralized applications (dApps), generating network-side and web-side signals that may undermine this assumption. In this paper, we identify and formalize five privacy threats that arise directly from wallets interacting with the network and the web browser. Using large-scale dynamic measurements of 85 of the most popular Chrome Web Store browser-extension wallets (representing 35.16 million users), we observe that routine remote procedure call (RPC) operations leak structural links between a user's addresses; that the majority of Ethereum wallets implement permission revocation inconsistently and continue to expose previously revoked addresses across sessions; and that many wallets inject their provider interfaces into cross-origin iframes, enabling passive cross-site tracking beyond dApps and potentially real-world identity deanonymization without user interaction. Taken together, our results show that these wallet behaviors leak sensitive information that can be used to link multiple addresses to the same user, track wallet users across sessions and sites, and connect their browsing activity to their on-chain wealth. We discuss practical mitigations and show that many of these threats can be substantially reduced through improved wallet implementation, stronger privacy considerations in ecosystem standards, and stricter controls over provider exposure. Our results highlight the need for standardized, privacy-preserving wallet architectures.

Related papers

• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• Stateful Online Monitoring Catches Distributed Agent Attacks [63.00394432922707]
  We develop an online stateful monitor that uses real-time clustering to collect weak suspiciousness signals across many agent transcripts.<n>Our results point toward a new class of safety monitors which reason over groups of users rather than isolated transcripts.
  arXiv  Detail & Related papers  (2026-05-29T17:57:00Z)
• Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces [44.063707111215216]
  We introduce WebDecept, a framework that enables controlled injection of deceptive interface patterns into existing web environments.<n>We instantiate seven deceptive patterns commonly observed on the open web, including targeted advertisements, domain redirection, and shopping manipulation.<n>Our results show that current web agents are highly susceptible to multiple classes of deceptive interfaces, and that prompt-based constraints are often insufficient to mitigate these failures.
  arXiv  Detail & Related papers  (2026-04-26T17:46:28Z)
• "What I Sign Is Not What I See": Towards Explainable and Trustworthy Cryptocurrency Wallet Signatures [2.5717964450615614]
  We investigate how users interpret authentic signing requests and what cues they rely on to assess risk.<n>Findings reveal that users often misread critical parameters, underestimate high-risk signatures, and rely on superficial familiarity rather than understanding transaction intent.<n>A prototype framework reconstructs and visualizes the intent behind wallet signatures prior to confirmation.
  arXiv  Detail & Related papers  (2026-01-23T13:56:07Z)
• Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacy [50.66105844449181]
  Individual Differential Privacy (iDP) promises users control over their privacy, but this promise can be broken in practice.<n>We reveal a previously overlooked vulnerability in sampling-based iDP mechanisms.<n>We propose $(varepsilon_i,_i,overline)$-iDP a privacy contract that uses $$-divergences to provide users with a hard upper bound on their excess vulnerability.
  arXiv  Detail & Related papers  (2026-01-19T10:26:12Z)
• Time Tells All: Deanonymization of Blockchain RPC Users with Zero Transaction Fee (Extended Version) [29.846192259039455]
  We propose a novel deanonymization attack that can link an IP address of a RPC user to this user's blockchain pseudonym.<n>By monitoring network traffic and analyzing public ledgers, the attacker can link the IP address of the TCP packet to the pseudonym of the transaction initiator.<n>Our attack achieves a high success rate of over 95% against normal RPC users on various blockchain networks.
  arXiv  Detail & Related papers  (2025-08-29T09:08:16Z)
• BridgeShield: Enhancing Security for Cross-chain Bridge Applications via Heterogeneous Graph Mining [41.291205709614026]
  Cross-chain bridges play a vital role in enabling blockchain interoperability.<n>Due to the inherent design flaws and the enormous value they hold, they have become prime targets for hacker attacks.<n>Existing detection methods mainly address single-chain behaviors and fail to capture cross-chain semantics.<n>We propose BridgeShield, a detection framework that jointly models the source chain, off-chain coordination, and destination chain within a unified graph representation.
  arXiv  Detail & Related papers  (2025-08-28T07:59:20Z)
• EGNInfoLeaker: Unveiling the Risks of Public Key Reuse and User Identity Leakage in Blockchain [10.349392384230274]
  In this paper, we design a system called EGNInfoLeaker.<n>Our study is the first work that uncovers widespread public key reuse across peer-to-peer networks.<n>Going forward, our detection framework provides a foundation for enhancing real-world privacy preservation in decentralized networks.
  arXiv  Detail & Related papers  (2025-07-02T12:07:03Z)
• WalletProbe: A Testing Framework for Browser-based Cryptocurrency Wallet Extensions [8.064056857526813]
  WalletProbe is a mutation-based testing framework based on visual-level oracles.<n>We have identified 13 attack vectors that can be abused by attackers to exploit cryptocurrency wallets and exposed 21 concrete attack strategies.
  arXiv  Detail & Related papers  (2025-04-16T03:24:30Z)
• Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents [36.49717045080722]
  This paper investigates the vulnerabilities of AI agents within blockchain-based financial ecosystems when exposed to adversarial threats in real-world scenarios.<n>We introduce the concept of context manipulation -- a comprehensive attack vector that exploits unprotected context surfaces.<n>Using ElizaOS, we showcase that malicious injections into prompts or historical records can trigger unauthorized asset transfers and protocol violations.
  arXiv  Detail & Related papers  (2025-03-20T15:44:31Z)
• Firewalls to Secure Dynamic LLM Agentic Networks [36.6600856429565]
  LLM agents will likely communicate on behalf of users with other entity-representing agents on tasks involving long-horizon plans with interdependent goals.<n>We identify required properties for agent communication: proactivity, adaptability, privacy (sharing only task-necessary information), and security.<n>We propose a practical design and protocol inspired by network security principles.
  arXiv  Detail & Related papers  (2025-02-03T21:00:14Z)
• VELLET: Verifiable Embedded Wallet for Securing Authenticity and Integrity [0.6144680854063939]
  This paper proposes a new protocol to enhance the security of embedded wallets. Our VELLET protocol introduces a wallet verifier that can match the audit trail of embedded wallets on smart contracts.
  arXiv  Detail & Related papers  (2024-04-05T03:23:19Z)
• Pudding: Private User Discovery in Anonymity Networks [9.474649136535705]
  Pudding is a novel private user discovery protocol. It hides contact relationships between users, prevents impersonation, and conceals which usernames are registered on the network. Pudding can be deployed on Loopix and Nym without changes to the underlying anonymity network protocol.
  arXiv  Detail & Related papers  (2023-11-17T19:06:08Z)
• Cross-Network Social User Embedding with Hybrid Differential Privacy Guarantees [81.6471440778355]
  We propose a Cross-network Social User Embedding framework, namely DP-CroSUE, to learn the comprehensive representations of users in a privacy-preserving way. In particular, for each heterogeneous social network, we first introduce a hybrid differential privacy notion to capture the variation of privacy expectations for heterogeneous data types. To further enhance user embeddings, a novel cross-network GCN embedding model is designed to transfer knowledge across networks through those aligned users.
  arXiv  Detail & Related papers  (2022-09-04T06:22:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.