Bitcoin address lookups can expose IPs to Chainalysis

Searching a Bitcoin address on a public block explorer can expose the visitor’s internet protocol (IP) address to the site operator. When a user loads an explorer page, the server receives standard web data such as the visitor IP and the requested URL; if that URL contains a wallet address, the operator may associate the connection with interest in that address.

On Aug. 5 a social-media warning urged users to avoid entering their own addresses into public explorers, alleging that explorers log IPs and share the data with Chainalysis. WalletExplorer’s privacy notice records the requesting IP and the requested URL and states that blockchain and visitor information is shared within Chainalysis business lines and with service providers. The notice includes legal-disclosure terms covering law-enforcement requests and does not specify a numeric visitor-log retention period.

Published policies from other hosted explorers show different practices. mempool.space notes that nginx webserver logs collect IPs and says those logs are deleted after 10 days. Blockchair records incoming IPs in clear or masked form for one to two days and analyzes popular queries in aggregate. Etherscan separates raw webserver logs from broader personal-data handling, purging raw logs after at least five days and scheduling inactive personal data for deletion within 24 months. Blockchain.com and OKLink use purpose-based retention schedules without a fixed explorer-log period.

Most explorer policies allow hosting, analytics or security vendors to process data to support the service. Several operators include legal-disclosure language permitting responses to lawful requests; WalletExplorer, Etherscan, Blockchain.com and OKLink explicitly reference disclosures to authorities, while mempool.space and Blockchair do not specify their law-enforcement procedures. A statement that a vendor may process data does not by itself establish a sale of lookup records.

An address lookup records that an internet connection accessed information about a public address at a specific time; it is not proof of ownership or control of private keys. Attribution of ownership requires additional evidence such as exchange account records, device forensic data, subpoenaed records, or admissions from the account holder. In 2021 leaked documents, WalletExplorer lookup metadata was used as an investigative lead when combined with other records.

Users who want greater privacy can run self-hosted explorers, use privacy-preserving tools that avoid third-party servers, or route queries through privacy services. The privacy impact of using a hosted explorer depends on whether an operator links IPs to queries, how long logs are retained, which internal teams or vendors can access them, and how the operator responds to legal requests.