Study Reveals 85 Crypto Wallet Browser Extensions Leak Addresses, Enabling Cross‑Site Tracking
What Happened — Researchers at KU Leuven examined 85 popular browser‑based crypto wallet extensions and discovered that the extensions expose enough address information to link a user’s multiple blockchain identities and allow cross‑site tracking by third parties.
Why It Matters for Compliance & Audit Readiness
- The leakage bypasses the privacy safeguards that SOC 2’s CC5.2 (Privacy) expects, making it difficult to demonstrate “reasonable” protection of personal data.
- Continuous evidence of consent management and data‑subject request handling becomes essential when third‑party code can expose user identifiers.
- Mapping this privacy gap to a formal control (e.g., “Data is not disclosed to unauthorized parties”) provides audit‑ready documentation and reduces risk of regulatory findings.
Who Is Affected — FinTech firms offering crypto‑related services, SaaS platforms integrating wallet extensions, and any organization that permits employees or customers to use such extensions.
Recommended Actions
- Inventory all browser‑extension wallets used within your environment and assess their data‑handling disclosures.
- Align the findings with SOC 2 CC5.2 privacy controls; document the risk and mitigation steps in your compliance evidence repository.
- Deploy a consent‑management solution that captures user opt‑in for address sharing and supports DSAR (Data Subject Access Request) workflows.
Source: The Hacker News
Technical Notes
- Leakage occurs via the extensions’ communication with web pages and blockchain nodes, allowing correlation of wallet addresses across domains.
- No specific CVE was reported; the issue stems from design‑level data exposure rather than a software bug.
Source: Same as above