Our guide to RPC endpoints explains the basic job they do: your wallet is not a full node, so it sends its questions, such as checking a balance or broadcasting a transaction, to a node operator's web address, and gets an answer back. That article focuses on why this exists and what to do when it feels slow. This one focuses on a different question: what does the operator on the other end of that connection actually see, and what does that mean for your privacy.
This is not a story about funds being at risk. Nobody can move your assets just by operating an RPC endpoint you happen to use. It is a story about metadata, the quieter kind of exposure that sits alongside the public ledger itself.
Two different kinds of exposure
Our article on on-chain privacy covers what anyone in the world can see once they know your address: every balance, every transaction, every contract you have touched. That exposure is permanent and public, by design, because a blockchain only works if its history is verifiable by anyone.
RPC exposure is different. It is not public. It is visible to one party at a time: whichever RPC provider happens to be handling your wallet's requests at that moment. That party sees something the chain itself does not record anywhere: your IP address, tied to the request you just made.
What actually crosses the wire
When your wallet talks to an RPC endpoint, the request carries two things worth noting. First, your IP address, because that is simply how any connection on the internet works. Second, the content of the request itself, which for a wallet usually means a specific address and an action: check this balance, look up this transaction, or broadcast this signed transaction to the network.
Put those two together, and the operator of that endpoint can see that a specific IP address is associated with a specific wallet address, at a specific time. On their own, neither piece is especially revealing. An IP address alone just points at a rough location or an internet provider. A wallet address alone is pseudonymous, as described in our on-chain privacy article. Linked together, they are a stronger signal than either piece by itself, and that link is something only the RPC provider holding the connection has.
A real example of how this worked in practice
This is not a hypothetical concern. In 2022, Consensys, which runs both the MetaMask wallet and the Infura RPC service, updated its privacy policy to disclose that Infura collects a user's IP address together with their wallet address when that wallet sends a transaction through Infura's default endpoint, which MetaMask used out of the box at the time. The company later clarified that this applied specifically to transactions rather than balance checks, and said the data supported things like load balancing and abuse prevention rather than any kind of surveillance program. Users who connected through a different provider instead of the default one were not subject to that same collection.
The detail worth keeping from that episode is not the specifics of one company's policy, which can change. It is the general lesson: whichever RPC endpoint handles your wallet's requests is in a position to see your IP address next to your wallet address, and what happens to that pairing afterward depends entirely on that provider's own practices, which you usually have not read.
Switching providers changes who sees it, not whether someone does
A natural reaction is to look for a way to hide this entirely. That is not really on offer. An RPC endpoint has to know where to send its response, so your IP address is visible to whichever endpoint you are using, full stop. Moving from one provider to another does not remove the exposure, it relocates it to a different company with a different policy.
A few of the more practical, proportionate options:
- Check which RPC your wallet is actually using. Most wallets show this in network settings. It is usually a sensible default, run either by the Base project itself or by an established node provider, rather than something you need to worry about.
- Read a provider's privacy policy before switching to it on purpose, the way you would before using any other service that touches your data. A provider's documented retention policy tells you more than its reputation does.
- A VPN reduces what your IP address reveals about your location, which is a separate layer from wallet privacy, but it addresses the same underlying concern of not wanting every request tied to your real network identity.
- Running your own node is the only way to remove a third party from the picture entirely, since you become the operator seeing your own requests. This is realistic for technically inclined users and infrastructure operators, not something most casual users need to set up.
- Treat "connect wallet" prompts on unfamiliar sites with the same caution either way. A dapp you connect to can also see your address and whatever RPC it chooses to route through, which is part of why our guide on connecting your wallet to a dapp safely is worth pairing with this one.
Why this is a reasonable thing to know, not a reason to panic
None of this changes how safe your funds are. An RPC endpoint can see that you asked a question or sent a signed transaction, it cannot sign anything on your behalf or move anything without your private key. The exposure here is about who can tie your network identity to your on-chain identity, which matters most to people who have specific reasons to keep those two things separate, and matters only a little to everyday use.
It is also worth keeping in proportion against the exposure described in our on-chain privacy piece. Your transaction history is already public forever to anyone who finds your address. An RPC provider seeing your IP address alongside that same address is an additional data point, not a new category of risk on top of a previously private system.
The calm summary
Your wallet relies on an RPC endpoint to talk to Base, and whoever operates that endpoint can see your IP address paired with the requests your wallet makes, including the address you are using. This is normal, it is how the plumbing works, and it is distinct from the public, permanent exposure of on-chain activity covered elsewhere. If it matters to you, the useful levers are knowing which provider you are using, checking its policy, and, for the most privacy conscious users, running your own node. For most people, understanding that the exposure exists is enough to use a wallet with realistic expectations rather than a false sense of total anonymity.
Sources: Infura Collecting MetaMask Users' IP, Ethereum Addresses After Privacy Policy Update, Decrypt, ConsenSys says it collects IP addresses of MetaMask users via Infura, The Block, Connecting to Base, Base Documentation