Searching your Bitcoin wallet can put your IP address in Chainalysis’ hands

A warning posted on X on Aug. 5 urged Bitcoin users to avoid entering their own wallet addresses into public block explorers. It alleged that explorers log visitors' internet protocol addresses, sell the information to Chainalysis, and ultimately expose it to government agencies.

Public block explorers allow anyone to enter an address or transaction identifier to retrieve records from a blockchain. Like other websites, a hosted explorer receives connection details and the requested page.

When that request includes a public blockchain address, the operator may technically be able to associate an internet connection with interest in the address.

That creates a layer of off-chain metadata around a public on-chain record. Its privacy significance depends on whether the operator joins an IP address to a query, how long it retains the record, and who can receive it.

Published policies from WalletExplorer, mempool.space, Blockchair, Etherscan, Blockchain.com and OKLink describe materially different practices.

WalletExplorer identifies itself as a Chainalysis website and explicitly describes sharing visitor information within the company. The other policies range from short webserver-log schedules to purpose-based retention.

Together, they support a focused conclusion: hosted explorers can collect connection and request metadata, while linkage, duration and disclosure vary by operator.

WalletExplorer documents sharing within Chainalysis

WalletExplorer's privacy notice says the site's servers automatically record the IP address of the requesting user and the requested URL, which may contain a Wallet Name, Wallet ID, or Bitcoin address.

The notice also says that blockchain information and visitor information are shared with other Chainalysis business lines, making this a disclosed flow within the corporate operator. Service providers may also process or access the data to perform functions on Chainalysis' behalf.

Its legal disclosure language covers law enforcement requests, court orders, and other legal processes. That provision establishes a route for disclosure under specified conditions and leaves the visitor-log retention period without a numeric limit.

The notice was last updated Oct. 14, 2021, and remains publicly accessible as the service's published privacy statement in August 2026.

In 2021, CoinDesk reported that it had authenticated leaked documents describing the use of WalletExplorer IP data associated with Bitcoin addresses to generate leads for law enforcement. The episode involved WalletExplorer and Chainalysis at that time.

A hosting, analytics or security provider processing data for another explorer occupies a different role, and a processor clause alone is insufficient to establish a sale of lookup records.

Explorer policies vary on linkage, retention and disclosure

The policies differ in whether, and how specifically, they describe joining an IP address to an address query. They also use different retention clocks and definitions.

Service IP address and request handling Published retention Third-party and legal disclosure WalletExplorer Automatically logs the requesting IP and URL, which may contain a wallet address, ID or name Numeric visitor-log period undisclosed Shares visitor information with other Chainalysis business lines and service providers; permits disclosure through lawful requests and legal process mempool.space Says nginx webserver logs collect an IP address together with requests made to the site Webserver logs deleted after 10 days Says it uses no third-party analytics or trackers and does not share private information from ordinary site use; its policy leaves the law-enforcement process unspecified Blockchair Says the browser sends an IP address and the requested page; persistence of an exact IP-to-address-query pair is unspecified Incoming IPs kept in clear or masked form for one to two days; popular queries analyzed in aggregate Disclaims third-party analytics and personal-data sharing; its policy leaves the law-enforcement process unspecified Etherscan Lists IP data separately from searches, browsing and explorer interactions; originating-IP storage is off by default and may be enabled temporarily Raw webserver logs kept for at least five days before automated purging; inactive personal data scheduled for purge within 24 months Allows specified infrastructure, analytics and legal disclosures; says it will not trade or sell personal data without consent Blockchain.com Its platform-wide policy may record IPs, visit history, searches, page views, clicks and accessed URLs; pairing a particular explorer query with a particular IP is unspecified Purpose- and law-based schedule, with no fixed explorer-log period Allows transfers to service providers and lawful disclosures to authorities OKLink Its Explorer-covering notice permits collection of IP, geolocation and site activity; pairing an address query with an IP is unspecified Purpose-based schedule, with no fixed explorer-log period Allows service-provider access and disclosures under legal process

WalletExplorer expressly connects an IP address to the requested URL, and mempool.space says its nginx logs collect an IP with the requests made to the site.

Blockchair says a browser sends both an IP and the requested page, while Etherscan, Blockchain.com, and OKLink describe relevant categories of data at a broader level, leaving the exact query-to-IP relationship unstated.

Those broader terms may authorize collection of several categories without demonstrating how the records are joined in practice. A missing description leaves the linkage undisclosed without supplying confirmation or a privacy guarantee.

Etherscan separates raw webserver logs from its broader personal-data lifecycle: the shorter period applies to raw logs, while the 24-month disposal schedule covers inactive personal data.

Blockchain.com and OKLink use purpose-based language, so when a policy supplies no number, the duration is undisclosed.

WalletExplorer, Etherscan, Blockchain.com, and OKLink all contemplate disclosures to authorities under stated legal conditions.

Blockchain.com's separate law-enforcement guide describes the process it expects authorities to follow. Such clauses establish possible access under legal process while leaving the frequency of requests unanswered.

The mempool.space and Blockchair policies leave their law-enforcement procedures unspecified.

Infrastructure, storage, analytics, and security vendors may receive data to perform services for an operator. A processor relationship establishes access for those functions, and a sale claim requires separate evidence.

Among these published policies, WalletExplorer alone documents a relationship with Chainalysis through corporate ownership and internal sharing.

Related Reading Bitcoin holders can now hide more of their activity, but only by trusting new middlemen Starknet’s strkBTC launch highlights a broader Bitcoin privacy tradeoff, where the fastest way to shield BTC may be to move it into wrappers, sidechains or e-cash systems that add new trust assumptions. May 13, 2026 · Gino Matos An address search signals interest, not ownership

Identity, motive, ownership, and control of private keys require independent evidence, such as subpoenaed records, device forensics, or direct admissions.

An explorer request contributes one narrower fact to that picture: an internet connection sought information about a public address at a particular time.

Related Reading A $239B claim on dormant Bitcoin wallets faces a new obstacle after old address moves A June 5 court stay and a June 2 spend turned the Noah Doe case into a test of legal title versus private-key control. Jun 8, 2026 · Liam 'Akiba' Wright

Blockchain.com's law-enforcement guide says a public blockchain address or transaction ID is less likely to return useful customer information than a Blockchain.com wallet identifier, email address, or exchange-account detail.

CryptoSlate's wallet address guide likewise explains the difference between a public address, used to receive assets, and the private credentials used to control them.

The 2021 WalletExplorer report shows how query metadata can serve as an investigative lead when paired with other information. The description is a clue to interest from a connection, while ownership attribution requires corroboration.

Using a hosted public explorer can expose a visitor to offchain metadata collection. The practical risk turns on the operator's query-to-IP linkage, retention window, service-provider access, and legal-disclosure terms.

Those dimensions provide a defensible way to compare explorers and the privacy trade-offs behind a seemingly simple address search.

The post Searching your Bitcoin wallet can put your IP address in Chainalysis’ hands appeared first on CryptoSlate.