Why the tracker you pick is mostly a security decision
If you hold assets across two or three chains, plus a few centralized exchange accounts, a portfolio tracker looks like a quality-of-life upgrade. Connect your wallets, connect your exchange read-only API keys, and suddenly you have a single dashboard showing total net worth, allocation, and performance. Most review sites treat this as a comparison of charts, alerts, and tax exports. That framing misses the point.
A portfolio tracker is a third party that, by definition, gains visibility into the addresses and accounts you care about most. Thefts, phishing campaigns, and drainer malware over the last few years have repeatedly shown that the weakest link in crypto is rarely the blockchain itself. It is the off-chain services people trust with read access, signing capability, or worse, custody. A tracker that asks for more than it needs can become a single point of failure across your entire position.
This is why the most useful way to evaluate a tracker is as a security review disguised as a feature comparison. Every checkbox you tick, including alerts, DeFi position tracking, and tax reports, also expands what the vendor can see and what happens if the vendor is compromised. Treat the rest of this article as a checklist, but treat the security questions as non-negotiable.
Read-only access versus the permissions that quietly drain wallets
The single most important distinction in this space is between true read-only access and the many flavors of wallet connection that look read-only but are not. A legitimate read-only connection works in one of two ways. For a self-custodial wallet, the tracker either watches the public address you paste in, or it uses a wallet signature that proves you control the address without granting any on-chain authority. For an exchange account, you create an API key with read permissions only, no trade, no withdraw.
Anything beyond that is a red flag. Specifically, watch for three patterns.
- Seed phrase or private key requests. No legitimate tracker needs these. If a tool asks, close the tab. Tools that demand seed phrases are almost always scams or, at best, custodial wallets disguised as trackers.
- Sign-in with Wallet prompts that include token approvals. Wallet-based login (often labeled Sign in with Ethereum or similar) usually produces a signature that proves address ownership and does nothing else. A malicious version will bundle an ERC-20 approval or a setApprovalForAll call into the same flow, granting the dApp permission to move specific tokens or NFTs. Read the signature request line by line before signing.
- Exchange API keys with withdraw enabled. Even on legitimate exchanges, when you create an API key you usually see toggles for read, trade, and withdraw. The only correct setting for a tracker is read. Withdraw should be off, and ideally the key should be IP-restricted to the tracker's servers if the exchange supports that.
Reputable trackers make the read-only nature of the connection explicit in their docs. If you cannot find a clear statement of what the connection can and cannot do, that is itself a signal. Trust is earned by documentation as much as by code.
How trackers price your assets, and why two trackers can disagree by 10%
Once a tracker has your balances, it has to convert them into a number you recognize. There are three common approaches, and they each have failure modes you should know about.
CEX API pricing. The tracker pulls prices from major centralized exchanges such as Coinbase or Binance. This is simple and usually accurate for top tokens like BTC and ETH, but it inherits the exchange's quirks: thin order books, regional restrictions, and the occasional delisted or relisted token. A tracker that relies on a single CEX for pricing will occasionally show stale or distorted values for less liquid assets.
On-chain pricing. Some trackers read prices directly from on-chain sources such as Uniswap pools or oracle feeds like Chainlink. This is appealing because it does not depend on a centralized venue, but DeFi pools can be manipulated or thinly traded, especially around new token launches. A token whose price is fetched from a low-liquidity pool can move 20% on a single swap, which will then show up as a phantom gain or loss in your portfolio.
Manual override. The better trackers let you mark a token as illiquid, lock in a custom price, or exclude it from the totals entirely. This is not a cosmetic feature. If you hold tokens with broken liquidity or locked vesting, automatic pricing will routinely mislead you. Manual override is the difference between a portfolio number you can defend and one you cannot.
Two trackers showing different net worth for the same wallet is not a bug. It is the predictable result of different pricing sources, different refresh intervals, and different rules for handling unpriced assets. The right question is not which number is right, but which method matches how you actually think about your positions.
Data export, lock-in, and what happens if the tracker shuts down
Every SaaS company eventually has a bad quarter. Tracking tools, especially free ones, are particularly vulnerable because the unit economics of pulling on-chain data across dozens of chains are not kind. When a tracker shuts down or pivots, your data should not disappear with it.
Before connecting anything, check what export options the tracker provides. The gold standard is CSV plus a documented API. CSV is universal, works with spreadsheets, and is easy to migrate into another tool. API access is more powerful but matters mostly if you plan to build your own dashboards.
The realistic spectrum looks like this.
- Full CSV and API export. Tools like Rotki and Koinly are strong here. Rotki, in particular, stores everything in a local SQLite database by default, so you always have your own copy.
- CSV only, sometimes partial. Common among mid-tier trackers. Acceptable, but check whether the CSV includes cost basis, transaction history, and historical valuations, not just current balances.
- No export at all, or export behind a paid tier. A clear warning sign. If the data is only usable inside the product, the product is effectively holding your financial history hostage.
Lock-in is a quiet risk. If a tracker is your only source of historical performance and tax records, switching costs become painful even if the service degrades. Treating export quality as a top-three criterion, alongside permissions and pricing, is the boring but correct move.
The 2023 CoinStats breach, and what it teaches every tracker user
In June 2023, CoinStats, one of the more widely used portfolio trackers, disclosed a security incident that ended up being one of the more serious tracker breaches on record. Attackers compromised a CoinStats employee's account, then used that access to push a malicious version of the application that was capable of exfiltrating wallet data from roughly 1.5 million users. Around 1,600 wallets were drained in the follow-on attack, with reported losses in the millions of dollars.
The incident is worth dwelling on because it illustrates several lessons that apply regardless of which tracker you use.
- Trust lives at the application layer. A read-only architecture did not save affected users because the breach happened upstream, in the vendor's own build pipeline. Signing a message into a malicious version of the client is functionally identical to signing a message into a phishing site.
- Hot wallets exposed to a tracker are a larger blast radius than cold wallets. Users whose loss was limited to a hardware wallet or funds on a centralized exchange had very different outcomes from those who had connected a hot wallet used for active trading.
- Concentration is risk. Many users had connected every wallet and exchange account to a single tracker for convenience. The breach turned a one-account compromise into a portfolio-wide event.
CoinStats responded, improved its security posture, and continues to operate. The point is not to single out any one vendor. The point is that any tracker, including the most reputable ones, can be the vector for a compromise you did not directly enable. The defensive move is to limit what any single tracker can see, segment hot and cold balances, and assume that any third-party tool you connect to will eventually be breached.
Side-by-side: Zerion, DeBank, CoinStats, Rotki, and Koinly
None of the tools below is universally best. Each is built around a different trade-off, and your portfolio size, your tolerance for hosting your own software, and your tax situation should drive the choice.
Zerion. A wallet-and-portfolio combo with strong DeFi coverage across EVM chains and Solana. Connect via wallet signature, no seed phrase needed. Pricing leans on on-chain sources, so it is generally accurate for liquid tokens but can drift on long-tail assets. Export is available but lighter than dedicated tax tools. Best for users who live mostly in DeFi and want a single UI for swapping, bridging, and tracking.
DeBank. Similar surface area to Zerion, with a particularly clean view of multi-chain holdings and social features. Permissions are read-only via wallet signature. Pricing sources are similar. DeBank is well-suited for users holding positions across many smaller chains and protocols where its coverage tends to be broader than the alternatives.
CoinStats. A generalist tracker with broad CEX support and a polished mobile app. Connects via wallet signature or read-only exchange API. Has the deepest breach history on this list (see above), so users with material balances should weigh that history carefully against the convenience.
Rotki. The self-hosted option. Rotki runs locally on your machine, pulls data from public blockchain nodes and the APIs you configure, and stores everything in a local database. No third party ever sees your addresses unless you choose to share. The trade-off is that you maintain it yourself, syncs take longer, and initial setup is heavier. For users holding more than they would trust to any free SaaS tracker, Rotki is the serious answer.
Koinly. Tax-first. Koinly is optimized for generating capital gains reports across dozens of jurisdictions, with broad exchange and chain integration and strong CSV import for users who do not want to grant API access. Less of a daily dashboard, more of a year-end workhorse.
Practical checklist before you connect any tracker
Use this as a short, opinionated pre-flight before you paste an address or generate an API key anywhere.
- Confirm the connection is truly read-only. Wallet connection should be a signature only, with no bundled token approvals. Exchange API keys should have withdraw disabled and ideally IP-restricted.
- Check the pricing model. Understand whether prices come from CEX order books, on-chain pools, or both. Decide whether you need manual override for illiquid tokens.
- Test export before you commit. Generate a small export, open it, and confirm it contains cost basis, transaction history, and historical valuations. Do not wait until year-end to discover that export is locked behind a paid tier.
- Review the vendor's incident history. A clean track record does not guarantee future safety, but a known breach is a real signal about how the vendor handles security.
- Segment your exposure. Connect a hot wallet for trading, but consider leaving your main hardware wallet or long-term holdings off any tracker at all. If the tracker is breached, you want the blast radius to be small.
- Revoke unused access periodically. Exchange API keys, wallet signatures, and token approvals should be reviewed and pruned on a schedule, ideally once per quarter.
Following this list will not make any tracker perfectly safe. Nothing connected to the internet is. It will, however, give you a structured way to choose a tracker that matches how much you actually hold and how much you would lose if the worst happened.
Stay ahead of portfolio tracker risks with sharper market signals
Security incidents in the tracking layer move fast, and so do the exploits that follow them. A new wallet drainer, a tracker vendor breach, or a change in how a popular tool handles permissions can all affect your holdings overnight. Tracking these signals manually across X, Discord, GitHub, and a dozen crypto news outlets is a losing game. Zippfeed surfaces portfolio tracker headlines and broader crypto security news with sentiment scoring (bullish, neutral, or bearish) and an importance rating, so you can react to real threats before they reach your wallets.
