Your Bitcoin Payments Can Reveal More Than You Bargained For

What Happened

The wallet pings an outside server to display a balance, and that request already carries the address in the clear. No exploit is involved; the extensions behave exactly as they were built to. Across all 85, the fingerprinting weakness alone reaches 36 wallets, which account for roughly 82% of the installs studied — the subgroup every later number in this section is measured against.

And this holds even for the honest ones. Andy Greenberg spent a decade as crypto crime’s most careful chronicler, reporting on the hackers, dealers, and launderers who treated the blockchain as a hiding place — and watching investigators pull them out of it one by one. It took him ten years to see how far from untraceable Bitcoin actually was. The ledger that was supposed to protect them was the record that convicted them.

There are real examples of this working. After the Colonial Pipeline ransomware attack in 2021, US investigators followed Bitcoin through several wallets and recovered about $2.3 million of the $4.4 million ransom payment.

Market Context

In the early years of Bitcoin, Helix was very popular in the darknet markets. It built to do one thing: make Bitcoin untraceable. Larry Dean Harmon ran it as a tumbler from 2014 to 2017, mixing customers’ coins to obscure where their funds came from, and he marketed the output as “clean” bitcoin. The entire model was concealment. Nothing about the service existed except to break the link between a coin’s origin and its destination.

Why It Matters

Right now, while you’re reading this, a competitor can open a block explorer and see who you paid in Bitcoin for your last deal — how much, when, and to which counterparty. Transaction tracing isn’t a problem for people with something to hide. It’s a standing business risk: treasury movements, partner relationships, and deal flow sit open to anyone willing to spend an afternoon following the trail.

A crypto wallet can reveal information before you even make a transaction. To show your balance, a browser wallet usually contacts outside servers and sends them your wallet address. Researchers from KU Leuven tested 85 popular browser-extension wallets, representing around 35 million Chrome Web Store installs. They found that 36 wallets — covering roughly 82% of the installs studied — could be identified and followed this way.

Seventeen wallets, covering about 23 million installs, could also expose links between different addresses belonging to the same user. In 22 of the 36 affected wallets, websites could still read an address even after the user revoked access and restarted the browser.

There is another problem. Websites can often detect which wallet extensions someone has installed without the user connecting a wallet at all. Researchers also found that 23 of the 36 affected wallets could leak an address through content loaded from another website, without the user clicking anything.

Blockchain-analysis companies look for transaction patterns that suggest several addresses belong to the same person or organization.

The result is fairly simple: a wallet address may look like a random string of characters, but once enough activity is connected around it, it can become a detailed financial profile.

Some 354,468 BTC, about $311M at the time, passed through it. The mixing changed what the trail looked like; it did not remove the trail. Every coin still left a permanent mark on the blockchain, one that couldn’t be altered or deleted after the fact.

Harmon took a 2.5% commission on each swap, and that commission went where every other coin went: onto the chain, permanently. The cut he skimmed to run a concealment service became the record that led back to the operator of it. The one service designed from the ground up to erase the trail wrote its owner into the trail it couldn’t erase.

Details

There’s a big problem with Bitcoin transactions from a business perspective that no one often talks about. Let’s say a business pays a supplier in BTC from a reused wallet address. They can actually look beyond the invoice.

The reflex is to assume this exposure starts on-chain, at the moment you sign a transaction. It doesn’t. In July 2026, researchers from KU Leuven’s DistriNet group tested 85 of the most popular browser-extension wallets and found that the wallets themselves leak enough to fingerprint and follow their users — before a single transaction is ever signed.

The false confidence runs in one direction — the people who assume they’ve done enough to stay private are mostly the ones who never had anything to hide: a donor whose entire giving history is now public, a journalist whose sources can be inferred from a payment trail, the B2B counterparty above.

Almost every layer of this happens to you, not by you. The rest of this piece maps the exposure in full — and marks the one link that was ever yours to write.

What Leaks From a Wallet Beyond the Transaction Itself

Most wallet providers contacted by the researchers did not treat this as a serious bug. Coinbase Wallet, Coin98 and Hana made changes, while others including MetaMask, Rabby and OKX did not. The researchers also tested 30 decentralized apps and found that only 11 properly revoked wallet access when users clicked “disconnect” or logged out.

Once an address becomes visible, the public blockchain provides the rest of the picture.

For example, if several wallets repeatedly send funds between each other or interact in similar ways, software can group them together. One known address can therefore lead analysts to several others.

This happens at enormous scale. By mid-2026, Chainalysis said it had grouped more than 1 billion blockchain addresses into over 134,000 identified entities.

Moving funds between blockchains does not necessarily break the trail either. Analysts can follow assets through bridges between networks. Using a decentralized exchange does not automatically hide the transaction, because swaps are still recorded publicly on the blockchain.

Helix: The Mechanism You Can’t Fool by Trying to Hide

How a Wallet Trail Gets Tied to a Real Person