An independent audit of WalletConnect v2 has flagged a 'Data Exposure' issue tied to insecure session storage, while a broader look at wallet metadata shows that off-chain information can tie users to their crypto addresses long before they sign a single transaction. The findings point to privacy risks that go beyond on-chain analysis, touching on routine RPC calls, browser extensions, and even the way transactions propagate across the peer-to-peer network.
What leaks before you click 'connect'
Wallet metadata—off-chain data such as RPC requests, IP addresses, analytics pings, WalletConnect handshake fields, and browser headers—can link multiple addresses and sessions to the same user before any transaction occurs. RPC providers can log IP addresses alongside the set of addresses a wallet exposes, making it possible to connect addresses to a person even before they approve a trade.
Browser-extension wallets are especially leaky. Three confirmed channels exist: routine RPC calls reveal structural links between addresses, some wallets expose previously revoked addresses across sessions, and injected providers in cross-origin iframes enable passive cross-site tracking. That last channel links browsing activity directly to on-chain holdings, a combination that strips away the anonymity many users assume they have.
Network-layer and on-chain heuristics pile on
Even without direct metadata, network-layer analysis can probabilistically bind transaction origin IPs and coarse locations to transactions by observing how they propagate through the peer-to-peer network. That means a user's general location can be inferred from the timing and path of a broadcast.
On-chain heuristics do the rest. Multi-input and change-address clustering collapse addresses into wallet clusters, and a small amount of tagging can taint entire clusters, enabling attribution. Once one address in a cluster is identified, every other address in that cluster becomes suspect.
Commercial forensics and the WalletConnect audit
Commercial forensics and compliance tools combine these on-chain clusters with external metadata like exchange KYC, OSINT, and web logs. They build knowledge graphs that attribute wallets to real-world identities, often without the wallet owner ever interacting with a centralized service.
The WalletConnect v2 audit specifically called out insecure session storage in localStorage. That flaw could lead to cross-site scripting or exfiltration of session metadata, meaning a malicious script on a page could siphon off the very data that links a user to their wallet.
WalletConnect's own best-practice guidance urges careful session handling, using the latest SDKs, verifying API usage, and restricting redirect or callback metadata to reduce leakage. Whether those steps are enough to counter the broader metadata problem remains an open question. The audit didn't offer a fix for the underlying reality that off-chain data, by design, carries identifying fingerprints.
