Wallet privacy · browser extension

See who's watching your wallet.

> your address could be going to Google Analytics▌

See what anyone who gets your address learns, in 10 seconds.

Wallets guard keys, not identity. The moment you connect, a dApp's own code can send your address to analytics and ad companies. 0xRay watches every request, shows you exactly who got it, with proof, and blocks it in one click.

+ Get the extension
eth_requestAccounts()
> 0x5290…9ee7
> shared GET /collect?wallet=0x…
POST /b base64
POST /id sha256 $ who.received(address)
> ??? [analytics] [ads]
[rpc] [replay]

Your wallet
talks

Trackers
listen

Nobody
tells you

SCAN_001 / 003

Under the X-ray

Same page. Different view.

On the surface, a swap screen. Under 0xRay, every request leaving the page that carries your address, in plain text, Base64 or a "hashed" form, with the company that received it.

swapdemo.app
Swap
You pay1.0 ETH
You get3,412 USDC
Connected · 0x5290…9ee7
Looks fine, right?
illustration
211

of 1,572 dApps leaked users' wallet addresses to third parties.1

22/36

browser wallets kept exposing addresses after the user disconnected.2

$30M+

taken in physical "wrench attacks" on crypto holders in H1 2026.3

GDPR

A linkable wallet address is personal data, even when hashed.4

Field test · real sites

We looked. They were watching.

A random address that belongs to nobody, opened on popular explorers, with 0xRay watching.

Etherscan→ Google Analytics, req.adx.wsdelivered
OpenSea→ hyperliquid.xyz, openseaprorelayproxy.comdelivered
DeBank · Arkham · OKLinkNo third-party recipientsclean

Observations, not accusations: an address in a URL is normal for explorers. Method and results.

The toolkit

Four ways to stop being watched.

01Extension

Live leak detector

Checks every request a page sends to another company for your address, even hashed or Base64-encoded. Proof for every finding. One switch to block.

get it → 02Agent

Privacy audit agent

Visits 9 popular crypto sites for you with a decoy address and reports which ones hand it to trackers. Your real address never leaves.

see how → 03Scan

Exposure report

Paste any address: see what a tracker learns the moment it has it. Names, linked socials, balances, activity across chains.

scan now → 04Registry

Public leak registry

Check a site before you connect. Observations live on Arkiv, public and verifiable, and expire after 30 days.

look up a site →

Two minutes · no account

Put on the X-ray glasses.

  1. 01download and unzip
  2. 02open chrome://extensions → developer mode
  3. 03load unpacked → guided setup does the rest
Download 0xRay → Try the demo dApp
  1. Torres et al., "Is Your Wallet Snitching On You?", USENIX Security 2023. usenix.org
  2. "The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem", 2026. arxiv.org
  3. Chainalysis, "Violent Wrench Attacks Targeting Crypto Holders", 2026. chainalysis.com
  4. EDPB Guidelines 02/2025 on blockchain, v2.0, July 2026. edpb.europa.eu