# Wallet Address Doxxing and ENS Privacy: What Is Exposed

Wallet address doxxing and ENS privacy explained: what a public ledger shows, how a name links to you, how to separate wallets and what cannot be undone.

---


A wallet address is not a name, but on a public blockchain it is a permanent, readable account number: anyone can see what it holds and what it has done. Wallet address doxxing happens when that address becomes tied to a real person, and the most common tie is one the owner made on purpose, such as an ENS primary name that matches their own name. Once the tie exists, the whole history of the address is read as the history of that person.

This guide is about the exposure you can still control. It explains what a public ledger shows, what an ENS name adds, the ways an address becomes linked to a person, how to separate wallets by purpose, and, just as important, what can never be undone on a chain that does not delete. It is written from the protective side, for owners auditing their own exposure, and it does not describe how to find out who owns an address.

Three neighboring subjects are covered elsewhere, so here they get one sentence each: a founder's reputation with investors, a full executive footprint audit across the web, and a response plan for being doxxed. This guide covers only the onchain layer underneath all three: addresses, names, labels and the habits that connect them to you. This is information, not legal or tax advice. The external pages linked here could not be re-read in full for this guide, so where a point depends on one, the text says so.

<div class="box"><b>The short version</b>
<ul><li>A blockchain address is pseudonymous, not anonymous. Its balance and history are readable by anyone, so the only question is whether a real name is attached to it.</li><li>Most links between an address and a person are created by the owner: a primary name, a profile, a bio, a payment to a named party. Audit those first, because you can change what you publish from now on.</li><li>You can stop adding links and you can start fresh wallets for new purposes. You cannot delete past transactions, and moving funds between your own wallets can itself create a visible link.</li><li>Separate wallets by role, keep the seed phrase and recovery details off every public surface, and treat privacy as a safety measure, never as a way around tax, sanctions or reporting duties.</li></ul></div>

## What a public ledger shows about an address, and what it does not

A public ledger shows the address, its balance, every transaction it sent or received, the other addresses involved, the time of each, and any contracts it interacted with. It does not show a name, an email address or a location. The identity layer is missing by design, and that is what people mean when they call the system pseudonymous.

In general terms, an externally-owned account is controlled by whoever holds its private keys, and a contract account is controlled by code. An address is a 42-character string, the "0x" prefix plus 40 hexadecimal characters. An account is not a wallet: a wallet is the interface you use to reach an account. Your wallet app can be replaced, but the account it points to, and everything ever done by it, stays on the ledger. The [Ethereum accounts documentation](https://ethereum.org/en/developers/docs/accounts/) is the place to read the technical definitions, which could not be re-opened for this guide.

Three consequences follow. The record is read by everyone, not only by people who know you. It is complete from the first transaction, so a change in your habits today does not alter how an address looked last year. And it is about the address, not about you: when a stranger says "this address is yours", the ledger cannot confirm or deny it. Only the links around the address can, and those links are the subject of this guide.

## ENS and primary names: the link you choose to make

The Ethereum Name Service lets a readable name such as a name ending in .eth point to an address. Two separate things are often confused here, and the difference decides your exposure.

The first is forward resolution: a name points to an address. Anyone who owns an ENS name can set this, and it lets other people send funds to the name instead of a long string. The second is reverse resolution, which ENS calls a primary name: an address points back to a name, so apps can show the name instead of the address. The [ENS documentation on primary names](https://docs.ens.domains/web/reverse) is the source for the exact rules. It could not be re-read for this guide, so the details of how apps verify a name, which networks support primary names and how long a change takes to appear are left to that page.

What is stable is the principle. A reverse lookup is an ordinary operation that any application can run on an address, so an app that supports primary names can display the name next to the address without asking you.

Put those facts together and the exposure becomes clear. The primary name is an opt-in setting, and it is the setting that turns a bare address into a labeled identity in every app that honors it. If the name is a real name, a company name or a handle you use elsewhere, then every balance, transfer and collectible tied to that address is now presented under it.

Names have a second, quieter effect. A registered name is itself an onchain record, so the owning address and the registration are visible. A name that you bought for a personal brand, an old username or a family surname connects to the wallet that bought it even if you never set a primary name.

<aside class="callout">
<span class="callout-label">Rule</span>
<h4>A primary name is a publishing decision, not a setting</h4>
<p>Before you set one, ask whether you would be comfortable putting the balance and full history of that address on a page with that name as the headline. If the answer is no, the address should not carry the name.</p>
</aside>

The table below sorts the naming choices people actually make by what they reveal. It is a decision aid for your own wallets, not a ranking of good and bad practice, because a public figure who wants to be paid and recognized may rightly choose the first row.

<div class="tablewrap"><table><thead><tr><th>Naming choice</th><th>What a viewer sees</th><th>Link to a real person</th><th>Best used for</th></tr></thead><tbody>
<tr><td><strong>Real-name ENS as primary name</strong></td><td>Name shown in place of the address in compatible apps</td><td>Direct and public</td><td>A deliberately public wallet for receiving payments</td></tr>
<tr><td><strong>Brand or project name as primary name</strong></td><td>The brand, with the full history beneath it</td><td>Direct to the brand, usually indirect to individuals</td><td>A treasury or business wallet</td></tr>
<tr><td><strong>Handle used on other sites</strong></td><td>A name that matches your social profiles</td><td>Indirect, but easy to follow if the handle is reused</td><td>A wallet you accept is tied to one persona</td></tr>
<tr><td><strong>Name registered, no primary name set</strong></td><td>The name and the owning address, if someone looks</td><td>Indirect through the registration</td><td>Holding a name without labeling a spending wallet</td></tr>
<tr><td><strong>No name at all</strong></td><td>A bare address</td><td>None by itself</td><td>Wallets for private holdings and day-to-day use</td></tr>
</tbody></table></div>

## How an address becomes linked to a person

Links come in two kinds: the ones you made, and the ones other parties hold or create. The list below is defensive on purpose. It describes categories so you can audit your own wallets, and it contains no method for investigating anyone else.

The first kind is self-published. You put the address or the name in a social bio, a website footer, a conference profile, a payment page, a newsletter or a message to a client. You signed up for a service with your real name and connected that wallet. You set a primary name that matches your identity. These are the largest category by far, and the only one fully within your control.

The second kind sits with a counterparty that knows who you are. A regulated exchange or payment provider that holds your identity records can see which addresses you deposit from and withdraw to. A client who pays an invoice knows which address it came from. A marketplace, a game or a platform that required a verified account has the same knowledge. These parties are not public, but they are not nothing: their records can be breached, subpoenaed or leaked, and their staff can talk. You cannot remove the link, but you can decide how many parties hold it.

The third kind is inferred from behavior. Addresses that fund each other or are used together in recognizable patterns can be grouped by anyone who studies the ledger, and you cannot know who has. The more your wallets touch, the easier the grouping.

The fourth kind is a label. Some block explorers and analytics services let people attach names or tags to addresses. A tag can be accurate, mistaken or malicious. Whether a particular service accepts corrections, and how, varies, and the policies of these services were not read for this guide, so check each service's own contact route before you rely on getting a label changed.

<div class="tablewrap"><table><thead><tr><th>Kind of link</th><th>Who holds it</th><th>Can you stop adding to it</th><th>Can you remove it</th></tr></thead><tbody>
<tr><td><strong>Self-published</strong></td><td>Anyone who reads the page or profile</td><td>Yes, immediately</td><td>Often, from the page; copies may remain</td></tr>
<tr><td><strong>Counterparty record</strong></td><td>An exchange, client or platform</td><td>Partly, by choosing fewer counterparties</td><td>Rarely; records are kept for legal reasons</td></tr>
<tr><td><strong>Behavioral grouping</strong></td><td>Anyone analyzing the ledger</td><td>Yes, by keeping wallets from touching</td><td>No; the transactions stay</td></tr>
<tr><td><strong>Third-party label</strong></td><td>The labeling service</td><td>Not directly</td><td>Sometimes, by asking the service</td></tr>
<tr><td><strong>Statement by others</strong></td><td>Wherever it was said</td><td>No</td><td>Sometimes, through the platform or publisher</td></tr>
</tbody></table></div>

## What can be undone on a public chain and what cannot

The ledger is built so that history cannot be edited. That is why people trust it, and it is also why it behaves differently from every other part of your footprint. Almost everything else in a privacy audit rests on the idea that someone can take a page down. A blockchain has no one to ask.

What cannot be undone: the transactions themselves, the balance history, the dates, the counterparties, the contracts the address interacted with, and the fact that an ENS name was registered by a given address. Moving your assets to a new wallet does not delete the old one.

What can be changed: what you publish from today onward. You can stop using a name as a primary name for an address, point a name somewhere else, remove an address from a bio or a payment page, and ask a website or platform to take down a page that names your address. You can choose different wallets for new activity and reduce how many counterparties know who you are. None of this rewrites the past.

Data protection law is relevant here, but it should be described with care. The European Data Protection Board has published guidelines titled "Guidelines 02/2025 on processing of personal data through blockchain technologies". The [EDPB document page](https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en) lists them, but their text could not be read for this guide, so nothing here says what they conclude. What stable general knowledge supports is narrower: erasure rights under data protection law are asked of parties that control personal data, and a public ledger has no single party to ask. The practical route for most people is therefore the off-chain parties: the websites, services and companies that hold your name next to your address. If you rely on a legal right, read the guidelines themselves and take advice from a lawyer in your country.

<aside class="callout">
<span class="callout-label">Limit</span>
<h4>No one can delete a transaction</h4>
<p>Anyone who promises to remove your address history from a public chain is either misdescribing the service or selling something else. What can be removed is the name attached to the address, in places that accept requests.</p>
</aside>

## Separating wallets by purpose without creating new links

Separation is the single most effective practical control, and it works by role, not by secrecy. The idea is to decide in advance which wallets are public, which are semi-private and which are never to be connected to your name, and then keep each wallet to one role.

A workable split uses four roles.

The public wallet is the one you are happy to attach your name to. It receives payments, appears in a profile and may carry a primary name. It should hold only what you are comfortable having visible. The spending wallet is for routine transactions, signing into services and minting or buying things. It carries no name, and it holds a limited balance, so an exposed address is a smaller target. The holding wallet is for long-term savings. It is never used to sign into sites or interact with unfamiliar contracts, it has no name, and its address does not appear on any page of yours. The disposable wallet is for anything unproven: a new service, a claim, a test. It holds a trivial amount and can be abandoned.

Two details keep the split from failing. The first is that wallets which fund each other become one group in the eyes of anyone studying the ledger. Moving funds from the holding wallet to the public wallet creates a visible tie between them, in both directions. If you need to move value, decide knowingly which tie you are creating, and prefer a route where the link sits with a counterparty that already knows your identity, such as an account in your own name, rather than on a public path. The second is that habits reconnect what addresses separate. Using the same device, the same browser profile, the same email for recovery, or the same cadence of activity across wallets can recreate the link without any transaction between them. Treat recovery details as part of the wallet, and never put a seed phrase or private key in an email, a notes app, a cloud drive or a screenshot.

<div class="tablewrap"><table><thead><tr><th>Wallet role</th><th>Name attached</th><th>Balance policy</th><th>Allowed to touch</th></tr></thead><tbody>
<tr><td><strong>Public</strong></td><td>Yes, by choice</td><td>Only what you accept being visible</td><td>Clients, payers, your profiles</td></tr>
<tr><td><strong>Spending</strong></td><td>No</td><td>Small, topped up as needed</td><td>Known services only</td></tr>
<tr><td><strong>Holding</strong></td><td>No</td><td>Long-term savings</td><td>As few counterparties as possible</td></tr>
<tr><td><strong>Disposable</strong></td><td>No</td><td>Trivial</td><td>Anything unproven; never your other wallets</td></tr>
</tbody></table></div>

Separation is a safety measure, not a way of avoiding obligations. Tax authorities, sanctions rules and the reporting duties that apply to exchanges and businesses still apply to you wherever you live. Keep your own records of which wallet is yours and why, so that you can explain your holdings to an accountant, a regulator or a court if you are ever asked. Privacy from the public and transparency to those with a legal right to ask are compatible, and the good practice is to maintain both.

## A worked scenario: a designer who set a name and then took on a larger client

This is an invented scenario with generic parties, not a real person or case.

A freelance designer, who works under their own name, bought an ENS name years ago and set it as the primary name of the wallet they use for everything: payments from clients, a few collectibles, a long-term savings position and some small experiments. They also list the name on their portfolio site. For a long time this was harmless. Then they win a contract with a larger company, and a project manager there looks up the portfolio. The name is on the page. A reverse lookup shows the full history and balance under it.

Nothing illegal is exposed. But a savings balance larger than the contract value and a history of speculative activity now sit under the designer's name, where the client can read them and a stranger can treat the designer as a phishing target.

The audit finds a short list. The primary name is set on the combined wallet. The portfolio page lists the name. A social profile lists the same address in its bio. An exchange account in their name has been funded from, and withdrawn to, the same wallet. A past message in a public community channel mentions the name next to the address.

The fix cannot touch the history, and the designer accepts that. They do five things. They create a new public wallet with a brand-new address for client payments and move the primary name to point to it, with only a small balance. They open a separate holding wallet and a spending wallet. They remove the old address from the bio and the portfolio and update both to the new public wallet. They ask the community channel's moderators to take down the old message. They move the savings to the holding wallet in planned steps, accepting that this move links the old wallet and the holding wallet in public, and they record the reason and the dates for their own file. The old wallet's history stays readable. What changes is that new activity no longer sits under the name.

## An order of operations, and a realistic timeline

The sequence matters, because the wrong order creates new links. Start with what you can see, then stop adding, then build the new structure, then move.

<figure class="fig">
<figcaption><b>Onchain privacy audit, in order</b></figcaption>
<ol class="fig-steps">
<li><b>List every address you control</b>Include old, test and hardware wallets. Note which hold value, which carry a name and which touched an account in your name.</li>
<li><b>Search your own name and handles with each address</b>Check bios, portfolio, newsletters, old posts and community channels for any address or ENS name you published.</li>
<li><b>Decide the role of each wallet</b>Assign every address to public, spending, holding or disposable before you change anything. A wallet with no role is the one most likely to be misused.</li>
<li><b>Stop publishing and unset names</b>Remove addresses from the pages you control. Review each primary name against the naming table above, and change the ones that label a wallet you want private.</li>
<li><b>Request removal of third-party mentions</b>Ask the owners of pages, platforms or channels that name your address to take the mention down. Contact label services through their own channels where a tag is wrong.</li>
<li><b>Create new wallets for the roles you lack</b>Use new keys, a new recovery routine and, where possible, a separate device profile. Do not fund them from a wallet you want kept separate unless you have chosen that link.</li>
<li><b>Move value deliberately and keep records</b>Move only what you need, one purpose at a time, and keep your own record of why. Re-run the audit after any large move.</li>
</ol>
</figure>

The timeline below is how this usually unfolds for a person with a handful of wallets, and it runs longer when several communities or a legal dispute are involved.

<div class="tablewrap"><table><thead><tr><th>When</th><th>What happens</th><th>Who acts</th></tr></thead><tbody>
<tr><td><strong>Day 1</strong></td><td>Inventory of addresses, names and published mentions</td><td>You</td></tr>
<tr><td><strong>Days 2 to 4</strong></td><td>Decide roles; remove addresses from pages you control; review primary names</td><td>You</td></tr>
<tr><td><strong>Week 1 to 2</strong></td><td>Requests to third parties; new wallets created; recovery details separated</td><td>You, platforms, channel moderators</td></tr>
<tr><td><strong>Weeks 2 to 4</strong></td><td>Answers to requests arrive, usually in days to weeks; value moved in planned steps</td><td>You, counterparties</td></tr>
<tr><td><strong>Week 4 onward</strong></td><td>Repeat the audit; check whether any copies or labels remain</td><td>You</td></tr>
</tbody></table></div>

## When your address has been tied to you without your consent

If someone else publishes your address next to your name, the situation is a privacy and safety problem first and a technical one second. The ledger is not what you act on. The page is.

Start with the practical risks. A visible balance can invite targeted phishing, fake support messages, fake airdrop claims and extortion attempts. If anyone has threatened you or knows where you live, treat it as a doxxing situation and contact the police first. Do not pay anyone who demands money to stay quiet, and never send a seed phrase to anyone for any reason.

Then act on the page. Capture the post, the URL and the date before you report it, since reported content disappears. Report it to the platform under its rules on private information or harassment. Where a service has published your name next to an address, ask it to remove the mention; a lawyer can say whether a legal right applies where you live.

## What this work will not do, and the line it will not cross

It will not make an address anonymous after a name has been attached, because the past link remains in the record and in copies of the record. It will not stop an analytics service from grouping addresses it can group. A label service, a forum or an archive decides for itself whether to remove a mention.

It will not help hide accurate, lawful information that the public has a legitimate interest in. A public official, a project treasurer or a person whose wallet is part of a lawful public accountability process does not get to separate wallets in order to avoid scrutiny. And it will not support evasion of taxes, sanctions or lawful orders. Where a regulator, a court or an exchange compliance team has a right to ask who owns a wallet, the ethical answer is to give a truthful one.

What it can do is reduce what a stranger can connect to you, close the paths that other people can use to find you, and give you a file that explains your own holdings if you are ever asked. Reputation Partners treats the onchain layer as one part of a person's exposure, to be reviewed alongside what search engines and AI assistants show, and that is how the audit above is meant to be used.

## Your next step: one inventory, one decision per wallet

<div class="box hot"><b>If this is happening to you now</b>
<p>Start with the inventory in step one and write down every address you control and every page that names one. If an address has already been tied to you by someone else and you feel unsafe, treat it as a safety matter first. For a private review of what is linked to your name, request an audit.</p>
<p><a href="/audit">Request a private audit</a></p></div>

## Questions people ask

### Is a wallet address personal information?

On its own, an address is a string tied to a key, not a name. It becomes personal information when it can be connected to an identifiable person, for example through a primary name, a profile or a counterparty record. Whether a specific legal regime treats it as personal data depends on the law and the facts, so ask a lawyer in your country.

### Can I delete my ENS name to hide my identity?

Letting a name go, or pointing it elsewhere, stops it from labeling your address going forward. It does not delete the registration or the earlier connection, because those are onchain records and may be copied by explorers and archives. If your goal is to stop a label from appearing in apps, change the primary name setting and the name's records first.

### Is it safe to put my wallet address in my bio?

It is safe only if you accept that everyone who reads the bio can see the balance and history of that address. Use a wallet you built for public payments, hold a small balance in it, and never publish an address that also holds your savings or that you have used to sign into private services.

### If I move funds to a new wallet, am I anonymous again?

No. The old address and the transfer remain on the ledger, and a direct transfer links the two addresses in public. A new wallet only limits what is tied to you from the time it is created, and only if you avoid funding it in a way that reconnects it to the first one.

### Who should I tell if someone publishes my address and name together?

Report the post to the platform under its personal information or harassment rules, and keep a record of the URL and date. If you feel unsafe or have been threatened, contact the police first. If the post is false about who owns the address, say so in writing to the publisher and avoid posting the address yourself to prove anything.