Every portfolio tracker you connect asks for the same thing: a durable link between an account you control and a server someone else runs. That link is the product. It is also the risk. A tracker that knows your wallet address and your email has already done the work an attacker would otherwise have to do.
What a tracker collects, and why each piece matters
Most people assume a tracker just reads balances. In practice it needs a persistent pipeline between your accounts and its servers. That pipeline is where privacy goes wrong.
Wallet addresses and on-chain history
A public address is a permanent, searchable record of every transaction tied to it. On its own it is pseudonymous. Attach a name or an email to it and the pseudonym collapses. A tracker that stores your addresses next to your login has built that bridge for you.
Read-only API keys
Exchange integrations usually ask for keys with read permissions. Read-only sounds harmless. It still exposes balances, trade history, and sometimes withdrawal addresses, which is enough to estimate net worth and map your habits. The key cannot move funds, but the data it reveals can fuel convincing phishing.
Device and behavioral metadata
Which screens you open, how often you check prices, your timezone, your IP address. Each detail is mundane alone. Stacked together they form a fingerprint that can deanonymize you even when you never type a name.
Three failure points you can control
You cannot audit a company's backend. You can shrink your exposure at the spots where failures tend to cluster.
1. Permission scope
A tracker asking for withdrawal rights or full account access is asking for too much. Read-only, no-trade keys are the ceiling. Anything beyond that is a red flag dressed up as a feature.
2. Retention policy
Does the app delete your data when you close your account, or keep it indefinitely? Privacy policies often bury this. Look for an explicit deletion timeline. If you cannot find one, assume the data stays.
3. Breach surface
Every service holding your addresses and keys is a target. Centralized storage means one compromise exposes every connected user at once. Self-custody tools that keep keys on your device reduce that surface, though they shift responsibility to you.
How one address became a phishing target
Consider a trader we will call Daniel. In early 2024 he connected a hardware wallet address to a free tracking app and signed up with his Gmail account. The app stored the address next to that login. Six months later, a breach exposed the pairing.
His on-chain history showed holdings worth roughly $47,000 at the time. Within days he received targeted phishing emails citing his actual positions. One message posed as a security alert and carried a link built to drain the wallet. He did not click. The lesson holds anyway: his address was public and his identity was not, until the tracker merged them.
The cleanup took ten minutes. He revoked the app's access, rotated his exchange API keys, and moved to a tracker that kept data on his device. The breach was not his fault. The linkage was.
Practical steps to reduce exposure
You do not need to abandon tracking. You need to treat it like any other security decision, which means a few habits applied consistently.
- Use read-only keys, always. Revoke any key with trade or withdrawal permissions immediately.
- Separate identities. Use a dedicated email for crypto services, never your primary one.
- Prefer local storage. Tools that keep keys and addresses on your device limit what a breach can expose.
- Audit connected apps quarterly. Old integrations you forgot about are still live attack surface.
- Check retention policies. If deletion is not documented, assume your data persists.
Major exchanges such as Kraken publish security guidance and support read-only API keys with granular permissions. Review that guidance before you connect anything. Exchange controls only help if you configure them correctly.
Frequently asked questions
Is a read-only API key actually safe?
Safer than a full-access key, but not risk-free. A read-only key still exposes balances and trade history if the app storing it is breached. It cannot move funds, which limits catastrophic loss, but the data it reveals can fuel targeted phishing. Treat it as a sensitive credential, not a harmless token.
Can a portfolio tracker link my wallet to my real identity?
Yes, and that is the core risk. If you sign up with an email and connect a wallet address, the app holds both pieces. A breach or a data sale merges them permanently. A dedicated email and local-storage tools reduce that linkage significantly.
Do I need to worry if I only track small amounts?
Your balance is not the only thing exposed. Your transaction history and habits are too. Attackers profile users over time regardless of current holdings. A small balance today can grow, and the historical record stays public. Privacy hygiene matters at every portfolio size.
How often should I review connected apps?
Quarterly is a reasonable baseline. Check which apps still have API access, revoke anything you no longer use, and rotate keys after any service announces a breach. Old integrations are easy to forget and hard to miss when they are exploited.
Open your tracker's connected-apps page now and revoke one integration you no longer use. Then rotate the API key on the exchange side. That single pass takes minutes and closes a gap that most users leave open for years.