Wallet fingerprinting is browser-side reconnaissance that looks for signs of installed cryptocurrency wallets, related extensions, or extension artifacts such as IDs, storage keys, and injected scripts. The goal is not to steal funds immediately, but to classify the visitor and identify people who are more likely to hold valuable digital assets.
This matters because it turns a generic phishing page into a targeting tool. Attackers can use wallet fingerprinting to prioritize victims, adapt lures, or route high-value users into deeper malicious flows. Defenders should treat unexpected extension probing, unusual browser object checks, and suspicious JavaScript that enumerates crypto wallets as warning signs. Limiting unnecessary extensions, separating browsing from signing activities, and reviewing page scripts can reduce exposure.