How a swap service can link my trades together without a login

05 September 2026

It links them by fingerprinting your device, network, and behaviour, then storing that profile under a pseudonymous identifier. You never type a name, but the service still sees a consistent "you" across separate visits.

The trick is that a login is only one way to identify someone. It is the explicit way. A swap site that skips registration does not stop tracking you; it just tracks you differently. The first thing it notices is your IP address. That alone can connect two sessions made from the same connection. But IPs change, and people share them, so the site layers other signals on top.

Your browser fingerprint is the strongest layer. The combination of operating system, screen resolution, installed fonts, timezone, language, and browser version is often unique enough to pick you out of a crowd. Two visits from the same browser will match on enough of these fields that the site can treat them as one entity. This works even if you clear cookies, because a fingerprint is not stored on your machine; it is computed from what your browser sends in every request.

Cookies are the simpler method. A no-account swap can drop a persistent cookie on your first visit, then read it on your second. The cookie contains a random ID, not your name. That ID becomes your de facto account, living on your device rather than on the site's server. If you clear cookies, the link breaks, but the site can rebuild it with a fingerprint.

Then there is the network layer. Your browser sends headers, your device sends TCP/IP packets, and the site can correlate timing patterns. The way you pause between clicks, the order you visit pages, the speed you scroll - all of that forms a behavioural signature. It is less precise than a fingerprint, but it does not require any stored data. A swap service can also match you across visits by the fact that you consistently use the same wallet address, even if you never log in. That address is a permanent label, and the site can tie every trade from it to one profile.

Why would a service bother? Because linking trades lets it do several things. It can flag repeat users who behave like fraudsters, block users who previously tried to cheat, and enforce rate limits. It can also build a history of your typical swap sizes and use that to spot anomalies. None of this requires your consent or your name. The profile is just a row in a database with a hashed ID instead of a username.

The practical consequence is that "no login" does not mean "no memory." If you swap twice from the same browser and IP, the site can know it is the same person. If you swap once from home and once from a café, it might guess correctly that both are you, based on the same device fingerprint. It cannot verify that guess, but it does not need to. For risk scoring, a probabilistic link is enough.

You can reduce the linking by using a different browser, a VPN, and a fresh wallet for each swap. That raises the cost of tracking and makes the links weaker. It does not make them impossible. The site can still correlate on timing or on the fact that both swaps arrive from the same autonomous system number. Perfect anonymity is not a property of any public network.

The deeper point is that identification is a spectrum. A login gives you a strong, explicit identity. A fingerprint gives a weak, implicit one. Both let the service connect your trades. The difference is that the weak one is deniable and harder for you to control. You cannot log out of your device fingerprint.

If you want to understand how the whole process fits together, the hub page on swapping crypto without an account covers the broader mechanics of these services. That page explains why a no-registration swap still needs some way to recognise you, even if it never asks your name.

Back to crypto scams