MetaMask Patches Privacy Flaw That Kept External Servers Connected After Users Opted Out

Running Snaps Stayed Online

A privacy flaw in MetaMask let external server connections continue after users switched off the wallet's data-sharing features, and the developers published a fix to GitHub on Nov 12. The problem centered on Basic Functionality, the toggle that governs whether MetaMask reaches outside servers for prices, balances and similar information. Users who want fewer outbound calls can turn it off. The code change that MetaMask posted states the outcome directly: even with Basic Functionality disabled, some external servers were still being contacted.

The fault traces to Snaps, MetaMask's extension framework, which lets the wallet run programs that add support for other blockchains, Bitcoin and Stellar among them. Under the old behavior, switching Basic Functionality off blocked new requests from Snaps but left programs that were already running in place, and those kept communicating with their own endpoints. That split is what let the flaw persist: the switch governed new activity, while processes already in memory answered to no one. Servers that connect to the Bitcoin network and servers that supply digital asset price data stayed reachable. A user who had set the wallet to privacy mode was, in practice, still generating connections to exactly the services the setting was supposed to cut.

The revised code ends that. When Basic Functionality is switched off, MetaMask now halts running Snaps and terminates their external connections rather than letting them continue. The patch therefore moves the kill switch one layer down: blocking new Snaps is no longer enough, because the programs already in memory are the ones holding the open connections. Developers reproduced the error in testing four times before the change; the unwanted connections appeared on all four runs. After the fix, all four runs behaved correctly, with the connections cut the moment the toggle went off.

An Earlier Disclosure in October

This is not the first failure of the same promise. On Oct 29, MetaMask disclosed that with Basic Functionality switched off, requests were still being sent to several external servers, an earlier case of the wallet phoning out after a user had opted out. The company published that episode itself, which is how it entered the record. The Nov 12 code change addresses the Snaps behavior specifically, and MetaMask has not said whether it resolves every error raised in the October disclosure. That gap is the open part of this story. A user reading the earlier announcement has no confirmation that the patch closes the cases described there, only that the reproduced Snaps failure now tests clean.

The episode lands on a wallet that did not originally speak to Bitcoin at all. MetaMask began life as an Ethereum wallet, and Snaps are the mechanism by which it reaches other chains, Bitcoin and Stellar among them. Self-custody of Bitcoin inside an Ethereum-native wallet historically ran through wrapped Bitcoin, a tokenized stand-in issued on a different chain, and Snaps widen that to direct support for additional networks. That crossover once drew resistance from adherents of Bitcoin maximalism, the position that Bitcoin should stand apart, and it now places Bitcoin network traffic inside a wallet many Bitcoin holders never installed. Snaps also carry the wallet's entry into Bitcoin DeFi, the set of lending, trading and yield services built on Bitcoin rather than on Ethereum's stack, which is why the framework keeps running processes that reach outside servers in the first place.

For the affected users, the practical meaning is narrow but concrete. The setting continued to read as an off switch while the wallet held connections to Bitcoin network infrastructure and price servers. The disclosure documents a connectivity fault rather than a movement of funds; what the record shows is traffic that persisted against the setting, not balances at risk.

What the Patch Does Not Say

Our reading starts from the primary record: a code change in MetaMask's own repository, which specifies that disabling Basic Functionality now stops running Snaps and closes their connections, and which passed four reproductions in the developers' tests. What the disclosure does not confirm is whether the October cases are covered, and that silence is the load-bearing fact for anyone relying on the setting. Unwanted server calls do not move funds the way an exploit or a replay attack can; the damage here is to a privacy control users believed was engaged. The observation that would turn this back into a live story is a statement from MetaMask that the patch closes every outstanding case. That statement has not been made.