➥ crypto wallet IP-exposure scorecard my main wallet GOT DRAINED...

➥ crypto wallet IP-exposure scorecard

my main wallet GOT DRAINED yesterday, so i spent hours checking safer wallets to move on

the Open Source Press recently analyzed the network traffic of popular Web3 wallets

to identify how much info leaves your device before you even create a wallet

the setup was intentionally simple:
- clean Android device
- no SIM card
- fresh APK installation
- VPN enabled
- every packet logged from the moment the wallet was opened

the user never created a wallet, imported a seed phrase & connected an account

the only thing measured was what each wallet sent to the internet immediately after launch

how the privacy score works?
- the score ranges from 0 - 100
- a higher score means less network exposure

the ranking is based on 2 simple metrics:
→ number of unique IP addresses contacted
→ number of unique domains contacted

fewer outbound connections = fewer parties learning your IP address + device info before you even own a wallet

privacy ranking post-filtered:

[1] Top Tier (90-100)
@cakewallet
@stack_wallet
@zodl_app
@Trezor
@vultisig
@unstoppablebyhs
@ZeusLN
@phantom
@tetherwallet
@bluewalletio
@zano_project

[2] Middle Tier (70-89)
@exodus
@AtomicWallet
@Thorwallet
@keplrwallet
@TrustWallet
@safe
@Rabby_io
@rainbowdotme
@Backpack
@EdgeWallet

[3] Lower Tier (<70)
@Ledger
@MetaMask
@base wallet
@solflare
@Cryptocom wallet
@Tangem
@wallet
@SafePal

the differences are significant as bellow

- Cake Wallet generated 0 outbound packets, 0 DNS requests, contacted 0 domains before user interaction

- Zodl contacted just 1 endpoint

- Unstoppable contacted only 2 endpoints

- Phantom routed third-party services through its own infra, reducing direct exposure to external vendors

at the other end:

- SafePal contacted 26 domains across 41 IP addresses immediately after launch
- OKX Wallet initialized AppsFlyer, Amplitude, OneSignal, ThreatMetrix fingerprinting, Alibaba endpoints, and other services before a wallet even existed

many mainstream wallets also initialize analytics, attribution, crash reporting

or messaging platforms such as Firebase, AppsFlyer, Segment, Braze, Customerio, Sentry, Crashlytics, Amplitude during cold start

that doesn't automatically make them insecure

these services help teams improve products, diagnose crashes, and measure usage

but they also mean your IP address + device can be visible to multiple third parties before you generate your first private key

for anyone who values network privacy, that's an important distinction

onchain privacy starts with the wallet you choose

but network privacy starts the moment you open the app

s/o to @r4nk0X for the great insights