Portfolio Trackers That Do Not Require Your Keys
A tracker needs read access, not spending access. Several ask for more than they need, and one category should be avoided entirely.
Tracking what you hold across wallets and venues is genuinely useful, particularly for tax records. The tools vary enormously in what they ask for, and the difference matters.
The access levels, from safest to worst
Manual entry. You type what you hold. No access to anything. Tedious and completely safe.
Public address monitoring. You provide wallet addresses, which are public. The tracker reads balances from the chain. Gives away privacy, since the tracker now associates your addresses with each other and with you, and gives away nothing else.
Read-only exchange API keys. Most venues issue keys with permissions you select. A key with read permission only cannot trade or withdraw. This is the correct level for a tracker.
Trading-enabled API keys. Some trackers request these to offer rebalancing features. A compromised key can trade your balance, including at prices that transfer value to an attacker through a thin market.
Withdrawal-enabled keys or credentials. No tracker needs these. Any tool requesting them should be closed immediately.
Seed phrase. Never. No exceptions. A tracker requesting a recovery phrase is a theft in progress.
What to check before connecting anything
Does the venue let you restrict the key? Permissions, and where supported, an IP allowlist. A key restricted to read-only and to the tracker’s IP range is a small exposure.
Can you revoke it easily? Know where the key management page is before you create the key.
Where is the data stored? A tracker holding your complete portfolio and transaction history is a valuable target. Several have been breached, and the leaked data is exactly what an attacker needs for targeted phishing.
Is there a local option? Tools that run on your own machine and store data locally remove the breach risk entirely, at the cost of convenience.
The privacy consequence people underestimate
Connecting several wallet addresses to one tracker account creates a link between them that did not previously exist on-chain.
If that tracker is breached, or sells data, or is compelled to disclose, the link is available to whoever obtains it. For anyone who had deliberately separated addresses, this undoes the separation.
What I actually use
A spreadsheet as the source of truth, updated at the time of each transaction, and a tracker with read-only keys for convenience.
The spreadsheet exists because I have had imports be wrong twice, both times in ways I only caught because I had my own record. The tracker exists because reconciling twelve months of activity by hand is unpleasant.
For tax purposes the spreadsheet is what I would produce. The tracker is a convenience layer over it.
The fields worth recording yourself
Date and time, type, asset out and amount, asset in and amount, value in local currency at the time, fee, platform.
Ten seconds per transaction. Venues that publish a complete downloadable history make reconciliation straightforward, and having your own record makes it possible to notice when an export is incomplete.
Products covered here are bought at full retail price and used for real transactions before anything is written. There are no affiliate links on this site, no sponsored placements and no review units. If that ever changes, it will be disclosed at the top of the article.