Bitcoin Transactions Leak More Than You Think
KU Leuven found that many browser wallets leak address data before an on-chain transaction even happens. Through KYC and blockchain analysis, counterparties and treasury movements can still become visible.
Key Takeaways
- Bitcoin payments can reveal more than just the invoice amount, such as treasury movements and business relationships.
- KU Leuven found that many browser extension wallets could leak addresses, wallet choices, and links between addresses.
- Through blockchain analysis and KYC links, visible Bitcoin addresses can often still be tied to real identities.
Bitcoin payments often seem practical and fast for companies, but they can reveal a lot more than just the amount on the invoice. A reused wallet, a visible counterparty, or a link through a crypto exchange can already be enough to expose treasury movements and business relationships.
Wallets Leak Before They’re Sent
Researchers at KU Leuven tested 85 popular browser extension wallets in July 2026 and found that the wallets themselves could already leak information. To show a balance, these wallets often send a request to an external server, with the address included in clear text. In the study, that was the case for 36 wallets, or about 82% of the installations tested.
That matters for anyone who thinks privacy only becomes an issue once a transaction is on the blockchain. In 17 wallets, websites could also link different addresses from the same user. In 22 of the 36 affected wallets, an address stayed visible even after access was revoked and the browser was restarted.
The researchers also saw that websites could sometimes tell which wallet extensions someone had installed, even without that person connecting a wallet. Of the 36 affected wallets, 23 could also leak an address through content from another website, without the user clicking anything.
From Address to Identity
Once an address is visible, blockchain analysis can do the rest. Analysts look for patterns that show multiple addresses belong to the same person or organization. Bitcoin is pseudonymous, not anonymous: addresses do not directly say who someone is, but they can be linked to a real identity through KYC at exchanges or through public addresses on websites and social channels.
KU Leuven also found that 17 wallets, together accounting for about 23 million installations, could expose links between different addresses. That makes it easier for an outsider to reconstruct a larger payment pattern than many users expect. For companies, one payment to a supplier can reveal earlier payments, treasury movements, and other counterparties.
Privacy coins only change that picture partly. Monero and Zcash make tracing harder, but most business Bitcoin payments still run through a public ledger where every step remains visible. At the same time, privacy-focused tools like PayJoin and the Lightning Network are under pressure from increasingly sophisticated surveillance tools.
Why This Matters for Europe
For European crypto users and companies, this is more than a technical detail. Anyone working with Bitcoin can accidentally give away sensitive information to competitors, trading partners, or researchers following a payment trail. That makes wallet choice, address management, and the way a payment is sent more important than many users think.
The issue also ties into compliance. Regulated exchanges link addresses to customer data through KYC, which means a visible address can sometimes be enough to unravel a larger network of transactions. For companies paying with crypto, the bottom line stays simple: a Bitcoin transaction is often less private than it looks at first glance.
Earlier, the movement of old Bitcoin wallets already drew extra attention to how hard it is to separate addresses and ownership from each other.
