# Web3 Wallet Security and Privacy – Victor Vansteenkiste (KU Leuven) | Onchain Soirée [1] @ KU Leuven

- Channel: [ETHBelgium](https://streameth.org/ethbelgium)
- Date: 2025-10-07
- Duration: 10:43
- Watch: https://streameth.org/watch/yt-pUQCmgugXl0
- YouTube: https://www.youtube.com/watch?v=pUQCmgugXl0

## Description

Onchain Soirée [1] was hosted by ETHBelgium at KU Leuven on April 28, 2025; an intimate evening of lightning talks, meaningful conversations, and high-signal energy with researchers, founders, students, open source builders, lawyers, and the Web3-curious.

ETHBelgium is building Belgium’s most vibrant community of Web3 builders — one conversation, event, and hack at a time.

💬 Join the conversation: https://t.me/ethbelgium

🧠 Follow us for more:
• Twitter: https://twitter.com/ethbelgiumHQ
• LinkedIn: https://www.linkedin.com/company/ethbelgium

## Transcript

All right. So, I do want to introduce our next uh speaker in the lineup. Uh and that's Victor Vansteinista. And Victor is um final year master student studying master in computer science here at KUven. And uh he's actually doing his his graduation thesis, his master thesis under my guidance. And as part of that, as you can see, he's actually studying the privacy and security of different types of web three wallets in a very intriguing way. But I'll leave that to Victor to tell you about. Thank you, professor. Um, so as Professor Mutson said, my name is Victor. I'm a blockchain enthusiast. I once bought an NFT for 100 euros. I think it's worth 50 cents now. I think we've all been there. Um, but today I'll Excuse me. Today I'll walk you through uh some wallet security and privacy. But maybe first off uh a small trip down memory lane. Well, I wasn't born yet. Uh but let's go back to the start of the internet. I think it was about in the 1990s, actually a bit before that with the start of the Arpanet. Uh but I think Mr. Tim Berners Lee was the real founder that actually coined the term the worldwide web in 1991 to be uh precise. uh and browsers launched and the internet became something accessible by everyone. But if you wanted to create something, you had to be like this lovely gentleman here. You had to create your own infrastructure, launch your own website on your server. So actually the first web was decentralized. There were no centralized players. But then fast forward 10 years later to the 2000s and actually also today uh with the rise of social media uh Facebook, YouTube and people were actually enabled to create content on the web not only through like posting a post on social media creating a video on YouTube but it was never easier to actually also create your own website and deploy it using a cloud service like AWS or Google. But the reason it was so easy is actually because the internet became centralized. Nobody likes putting on servers and nobody has that technical skill. So now people are very connected and are very yeah connected to the internet and they love creating stuff. But because we all like stories and we all like creating content uh this creates a lot of data a lot of data in the hands of the big tech corporations. I think a statistic was that around 65% of the total internet infrastructure is actually contained by the big tech players. Uh and also a fun fact more than 60% of the world population is on social media. And everybody likes it. Everybody nobody asked questions until uh a few years ago we had the Cambridge Analytica scandal. This is the first time that actually general public became worried about their privacy. Uh some backstory, Cambridge Analytica, they uh used millions of Facebook profiles to create psychological profiling uh to create targeted ads for the US elections and also the Brexit uh elections as well. And our friends at Netflix, they decided to actually create a beautiful documentary called The Great Hack. And this went pretty much viral and people started realizing they were a product and that the system was pretty much broken. And in the background, web 3 was gaining gaining traction. Uh but this was a real pivotal moment as people really started caring about the privacy and about the future of the web. So the future of the internet, I think this is a synonym for web 3. Uh I think the audience pretty much knows what it is. But a quick recap, I think the main goal or at least how I understand it is actually re reempowering the users that people are owning their own data. They know what's being shared. that privacy is actually in their hands and not in the hands of the bad guys let's say Facebook, Google, uh, Amazon etc. And for that you have like your own central online identity and that's how you play in the in the internet. So in order to make that work you have two major components. First off uh as mentioned in the previous talks as well you have your decentralized applications. These are applications that run uh actually on the chain. Their back end is coded in a smart contract. And then the second important part is your wallets and this is essentially your online identity. So instead of using an email address and password, your identity is actually contained in a public private key pair and this is all stored within a wallet. But the funny thing is about the pure theoretical concept of web3. If you really want a decentralized web, we were all going to be like this guy. Remember him? We all have to create our own notes who are really in control. But as so often in the world, history is repeating himself. Our friend Moxy Marlinspike, he's the founder of Signal. He had a famous quote and I truly believe in that. If there's one thing I hope we've learned about the world, it's that people do not want to run their own servers. But how is web 3 ever going to work? Well, introducing the central node providers in web 3. These are central node providers that actually contain a pool of nodes similar to AWS and maybe Google as well. And they actually uh provide DAP creators to actually just launch your dabs very easily uh without having to set up their own nodes. Sounds very good. And of course, this is a natural thing. This is not necessarily a bad thing, but you should know it does come with some privacy issues. So here comes my thesis then. So my thesis is actually largely based um on a paper by a US paper uh about called is your wallet snitching on you and they did like a deep study on they captured requests and to see like what is being shared uh but they focused on metam mask. So for my thesis what we're doing is actually a large scale analysis of 10 most used wallets and a large range of the most popular deps and uh we built actually um a sort of a web scraper based on the puppeteer library. It's library created by Google uh which actually allows you to capture requests and analyze them. Uh, and I think the main goal of my thesis is to create a comparative study between the different wallets that users can use and to actually know what is being shared and to definitely demystify the fact that web 3 is private. Um, because in a sense it's not. You still have to be careful and I believe that's a very large misconception especially we all know Bitcoin started because it was a currency so you could illegally buy drugs online because you're not traceable. I think that reality is not the case anymore and I feel like uh not a lot of people are quite aware of that. So what are we actually doing? Uh well this is a very basic uh representation of how the interaction between wallets deps and the node providers work. So you have a wallet and your DAP they communicate with each other through an object that is injected in the browser. And then your wallet and your DAB, they each separately uh communicate with a node provider of choice. For example, MetaMask and Infura, they're from the same company. So naturally uh they they yeah, I mean they communicate with each other. But then here you also have requests to other things. For example, front ends of the DAP. They're usually hosted on normal web two technologies and those requests also happen and actually what we do we capture all of them and uh we capture them so that we can look for certain patterns certain things that are being shared things that shouldn't be shared uh because as you know whenever you share something to a node provider uh they actually have access to that and they can save stuff for example to give it some more context uh these are some funny things that actually no providers have and they also communicate it but I think it's something that nobody actually knows. I think by law um and infura and alchemy they have to track your IP address just in case if any suspicious behavior does come across you and the government call comes calling um then they have to be able to show you your IP address IP address so you could be trackable. I'm not sure if that was the real intention of web 3 to be fair. Uh and also all of your transaction metadata is also stored. And for example, imagine I connect to a DAP and I have a MetaMask wallet with multiple accounts. Uh often those accounts are merged together in a request. And then people can actually see, oh, those two accounts belong to me. And what an in the fur can do then actually take that figure out how much money I have and maybe do some targeting ads on me as well, which does not seem quite web 3 vibes to me. And maybe a a fun thing about uh tornado cashache, it's been mentioned here before. Uh tornado cashache is actually one of the most private um crypto coins out there. Uh and I think in the beginning it was used a lot for illegal practices. Um but actually what happened is the government again a very centralized party um they told these node providers from okay you cannot handle transactions with tornado cashache anymore which meant that tornado cashache was actually blocked um on these main node providers which meant you couldn't do any transactions with tornado cache uh but I think this year they were actually delisted so you can still use them now but there was a time that the government had to intervene uh and I and stresses a nut but you can feel the paradox between centralization and decentralization. Um and also a last one as well um I think I wouldn't call us all nerds but we are enthusiasts um if people see that you have a wallet object in your browser they can use that to again do some profiling and do some uh yeah effective advertising to you. So what my thesis is all about is actually to make more awareness and to make a comparative study between the wallets and uh to actually make people aware that actually web 3 theoretically it's very good but in order to make it work in the industry and to scale it we do have to take some privacy measures. Thank you for listening. [Applause]