Is TronLink safe?

Question

Is TronLink safe?

Accepted Answer

TronLink is high risk. Every six hours, when TronLink is set to TRON mainnet and the asset-sync feature (isOpenTokenAsync) is on, the extension reads your wallet's TRX balance, USDT balance, total token value in USD, and transaction-history statistics from its local IndexedDB and POSTs them to https://api.mixpanelink.org/api/stat/some. Each report includes a stable per-wallet UUID, so reports from the same wallet can be linked over time. We observed one such POST during dynamic analysis of a fresh test wallet on TRON mainnet (request body contained the encrypted asset payload; the transaction-stats payload was absent because the wallet had no transactions yet). The destination api.mixpanelink.org is a separate domain from mixpanel.com (the well-known product-analytics service) and is not named in the Chrome Web Store listing or TronLink's privacy policy. Bodies are AES-encrypted on the wire using a key derived from a per-request signature parameter, so the contents are not directly inspectable in DevTools.

Is TronLink safe?

Findings