Is Casper Wallet safe?

Medium risk

Casper Wallet sends visited merchant URLs and the active wallet public key to api.bringweb3.io for its BringWeb3 integration.

Casper Wallet includes a BringWeb3 integration that checks visited merchant pages against remote configuration from api.bringweb3.io. When a matching page is processed, it sends the page URL, merchant domain, extension metadata, a persistent user ID, and the active Casper wallet public key to that service.

Casperv2.6.0Chrome Web Store
45Risk
Who publishes it

MAKE Technology LLC - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Casper
Declared legal entity
MAKE Technology LLC
Registered address
30 N Gould St Suite R, Sheridan, WY 82801, US
Registered contact
Michael Steuer

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

manager.api.live.ledger.com
Also called by 3 other listings, including OKX Wallet
sandbox-api.bringweb3.io
Also called by 5 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Casper Wallet reports every site you visit and your wallet key to BringWeb3

When you visit a merchant on BringWeb3's own domain list, Casper Wallet's background script reports the exact page URL and a persistent install ID to api.bringweb3.io, and attaches your Casper public key if your wallet is unlocked.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate a tab to a domain that appears on BringWeb3's own server-supplied merchant list.

The content script runs on every http(s) page in every frame from page load, so the check happens on every navigation.

The extension did this

The background script reports the exact page URL, a persistent install ID, and your Casper wallet public key (if unlocked) to api.bringweb3.io.

This runs whether or not you interact with the cashback popup; the report happens on the navigation alone.

What gets sent to api.bringweb3.io on a matched visit
  • Page you visited
    https://www.justanswer.com/pricing

    The exact URL tells BringWeb3 which merchant page you are on right now.

  • Persistent install ID
    fc787ab0-fb92-4a2c-afc4-2cf4cf3b643a

    A UUID generated once and reused on every report, tying all your visits to the same install.

  • Casper wallet public key
    02ddc3b66a556cdd9f1d742844300ef698f723ea246be7fbe080b9a376fece52a4 (illustrative format; no wallet was unlocked during this test session)

    Attached automatically by the shared request code whenever your wallet is unlocked in this browser.

  • Visit phase
    new

    Marks whether this is a first-seen visit or a return visit for BringWeb3's own funnel tracking.

Captured request
POSThttps://api.bringweb3.io/v1/extension/check/popup

302 redirect to extension.bringweb3.io carrying a signed token; the same request pattern repeated verbatim for udemy.com, shopify.com and nordvpn.com with each request's own visited URL

Body
{  "phase": "new",  "url": "https://www.justanswer.com/pricing",  "matches": [    {      "match": [        "moc.rewsnatsuj/pricing",        "moc.rewsnatsuj"      ],      "type": "d"    }  ],  "version": "1.6.4",  "optOut": 0,  "userId": "fc787ab0-fb92-4a2c-afc4-2cf4cf3b643a"}
Why you can't catch this in DevTools

The redirect BringWeb3 sends back after a merchant visit carries a token that decodes to the matched retailer's name and cashback rate, confirming the visited URL drove per-merchant attribution.

Decoded value
{  "retailerId": "10192b10-d567-a2ed-e46e-6f0db690082c.00",  "name": "NordVPN",  "maxCashback": "24.000"}
The code that does this

The shared request helper splices your wallet key into every POST body

Readable version
sendBringWeb3Request = async ({ path, method, params, timeout }) => {  if (!path || !method || (!params && method === "POST")) {    throw new Error("Missing endpoint or method");  }  const config = BringWeb3Config.getInstance();  const baseDomain = config.getBaseDomain();     // "https://api.bringweb3.io"  const apiPath = config.getApiPath();  const envName = await getStorageValue("envName");  let requestUrl = envName    ? `${baseDomain}/${envName}/${apiPath}${path}`    : `${baseDomain}/${apiPath}${path}`;  const apiKey = config.getApiKey();  if (method === "GET") {    requestUrl += `?${new URLSearchParams({      ...params,      version: getVersion(),      timestamp: Date.now().toString(),      opt_out: await getStorageValue("optOut") || 0,      user_id: await getOrCreateInstallId() || "undefined",      wallet_address: await getStorageValue("walletAddress") || "undefined"    })}`;  } else if (method === "POST") {    // The caller (e.g. reportVisit -> POST /check/popup) only passes    // {domain, phase, url} -- walletAddress is spliced in here, from the    // in-memory value or straight out of chrome.storage.local, whether    // or not the caller asked for it.    params = {      ...params,      version: getVersion(),      timestamp: Date.now(),      optOut: await getStorageValue("optOut") || 0,      userId: await getOrCreateInstallId() || undefined,      walletAddress: params?.walletAddress || await getStorageValue("walletAddress") || undefined    };  }  return await (await fetch(requestUrl, {    method,    headers: { "Content-Type": "application/json", "x-api-key": apiKey },    body: method === "POST" ? JSON.stringify(params) : undefined,    signal: timeout ? AbortSignal.timeout(timeout) : undefined  })).json();}
Where the visit report and the wallet key end up
    • api.bringweb3.io

    BringWeb3's cashback/affiliate-tracking backend; receives the visited URL, the persistent install ID, and the wallet key when unlocked.

    • extension.bringweb3.io

    Receives the post-report redirect carrying a signed token that names the matched retailer and cashback rate.

Where it sends data

Destinations our analysis observed Casper Wallet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.bringweb3.io

    Casper Wallet sends data to api.bringweb3.io. 2 other extensions we have analysed send data here.

Updated 30 September 2026abkahkcbhngaebpcgfmhkoioedceoigp