Searching your Bitcoin wallet can put your IP address in Chainalysis’ hands

A warning posted on X on Aug. 5 urged Bitcoin users to avoid entering their own wallet addresses into public block explorers. It alleged that explorers log visitors' internet protocol addresses, sell the information to Chainalysis, and ultimately expose it to government agencies.

Public block explorers allow anyone to enter an address or transaction identifier to retrieve records from a blockchain. Like other websites, a hosted explorer receives connection details and the requested page.

When that request includes a public blockchain address, the operator may technically be able to associate an internet connection with interest in the address.

That creates a layer of off-chain metadata around a public on-chain record. Its privacy significance depends on whether the operator joins an IP address to a query, how long it retains the record, and who can receive it.

Published policies from WalletExplorer, mempool.space, Blockchair, Etherscan, Blockchain.com and OKLink describe materially different practices.

WalletExplorer identifies itself as a Chainalysis website and explicitly describes sharing visitor information within the company. The other policies range from short webserver-log schedules to purpose-based retention.

Together, they support a focused conclusion: hosted explorers can collect connection and request metadata, while linkage, duration and disclosure vary by operator.

WalletExplorer documents sharing within Chainalysis

WalletExplorer's privacy notice says the site's servers automatically record the IP address of the requesting user and the requested URL, which may contain a Wallet Name, Wallet ID, or Bitcoin address.

The notice also says that blockchain information and visitor information are shared with other Chainalysis business lines, making this a disclosed flow within the corporate operator. Service providers may also process or access the data to perform functions on Chainalysis' behalf.

Its legal disclosure language covers law enforcement requests, court orders, and other legal processes. That provision establishes a route for disclosure under specified conditions and leaves the visitor-log retention period without a numeric limit.

The notice was last updated Oct. 14, 2021, and remains publicly accessible as the service's published privacy statement in August 2026.

In 2021, CoinDesk reported that it had authenticated leaked documents describing the use of WalletExplorer IP data associated with Bitcoin addresses to generate leads for law enforcement. The episode involved WalletExplorer and Chainalysis at that time.

A hosting, analytics or security provider processing data for another explorer occupies a different role, and a processor clause alone is insufficient to establish a sale of lookup records.

Explorer policies vary on linkage, retention and disclosure

The policies differ in whether, and how specifically, they describe joining an IP address to an address query. They also use different retention clocks and definitions.

WalletExplorer expressly connects an IP address to the requested URL, and mempool.space says its nginx logs collect an IP with the requests made to the site.

Blockchair says a browser sends both an IP and the requested page, while Etherscan, Blockchain.com, and OKLink describe relevant categories of data at a broader level, leaving the exact query-to-IP relationship unstated.

Those broader terms may authorize collection of several categories without demonstrating how the records are joined in practice. A missing description leaves the linkage undisclosed without supplying confirmation or a privacy guarantee.

Etherscan separates raw webserver logs from its broader personal-data lifecycle: the shorter period applies to raw logs, while the 24-month disposal schedule covers inactive personal data.

Blockchain.com and OKLink use purpose-based language, so when a policy supplies no number, the duration is undisclosed.

WalletExplorer, Etherscan, Blockchain.com, and OKLink all contemplate disclosures to authorities under stated legal conditions.

Blockchain.com's separate law-enforcement guide describes the process it expects authorities to follow. Such clauses establish possible access under legal process while leaving the frequency of requests unanswered.

The mempool.space and Blockchair policies leave their law-enforcement procedures unspecified.

Infrastructure, storage, analytics, and security vendors may receive data to perform services for an operator. A processor relationship establishes access for those functions, and a sale claim requires separate evidence.

Among these published policies, WalletExplorer alone documents a relationship with Chainalysis through corporate ownership and internal sharing.

An address search signals interest, not ownership

Identity, motive, ownership, and control of private keys require independent evidence, such as subpoenaed records, device forensics, or direct admissions.

An explorer request contributes one narrower fact to that picture: an internet connection sought information about a public address at a particular time.

Blockchain.com's law-enforcement guide says a public blockchain address or transaction ID is less likely to return useful customer information than a Blockchain.com wallet identifier, email address, or exchange-account detail.

CryptoSlate's wallet address guide likewise explains the difference between a public address, used to receive assets, and the private credentials used to control them.

The 2021 WalletExplorer report shows how query metadata can serve as an investigative lead when paired with other information. The description is a clue to interest from a connection, while ownership attribution requires corroboration.

Using a hosted public explorer can expose a visitor to offchain metadata collection. The practical risk turns on the operator's query-to-IP linkage, retention window, service-provider access, and legal-disclosure terms.

Those dimensions provide a defensible way to compare explorers and the privacy trade-offs behind a seemingly simple address search.