➥ crypto wallet IP-exposure scorecard my main wallet GOT DRAINED yesterday, so i spent hours checking safer wallets to move on the Open Source Press recently analyzed the network traffic of popular Web3 wallets to identify how much info leaves your device before you even create a wallet the setup was intentionally simple: - clean Android device - no SIM card - fresh APK installation - VPN enabled - every packet logged from the moment the wallet was opened the user never created a wallet, imported a seed phrase & connected an account the only thing measured was what each wallet sent to the internet immediately after launch how the privacy score works? - the score ranges from 0 - 100 - a higher score means less network exposure the ranking is based on 2 simple metrics: → number of unique IP addresses contacted → number of unique domains contacted fewer outbound connections = fewer parties learning your IP address + device info before you even own a wallet privacy ranking post-filtered: [1] Top Tier (90-100) @cakewallet @stack_wallet @zodl_app @Trezor @vultisig @unstoppablebyhs @ZeusLN @phantom @tetherwallet @bluewalletio @zano_project [2] Middle Tier (70-89) @exodus @AtomicWallet @Thorwallet @keplrwallet @TrustWallet @safe @Rabby_io @rainbowdotme @Backpack @EdgeWallet [3] Lower Tier (<70) @Ledger @MetaMask @base wallet @solflare @Cryptocom wallet @Tangem @wallet @SafePal the differences are significant as bellow - Cake Wallet generated 0 outbound packets, 0 DNS requests, contacted 0 domains before user interaction - Zodl contacted just 1 endpoint - Unstoppable contacted only 2 endpoints - Phantom routed third-party services through its own infra, reducing direct exposure to external vendors at the other end: - SafePal contacted 26 domains across 41 IP addresses immediately after launch - OKX Wallet initialized AppsFlyer, Amplitude, OneSignal, ThreatMetrix fingerprinting, Alibaba endpoints, and other services before a wallet even existed many mainstream wallets also initialize analytics, attribution, crash reporting or messaging platforms such as Firebase, AppsFlyer, Segment, Braze, Customerio, Sentry, Crashlytics, Amplitude during cold start that doesn't automatically make them insecure these services help teams improve products, diagnose crashes, and measure usage but they also mean your IP address + device can be visible to multiple third parties before you generate your first private key for anyone who values network privacy, that's an important distinction onchain privacy starts with the wallet you choose but network privacy starts the moment you open the app s/o to @r4nk0X for the great insights