Does connecting a wallet expose my tokens or just my address?

Ordinary wallet connection lets an application learn selected public account information and request interactions. It is not, by itself, a standard token approval. Read the actual connection request because some wallet flows can also request additional permissions.

MetaMask’s connection documentation describes selected accounts and networks and notes that proposed transactions still require approval. This should not be generalized to every advanced delegation or session-key system.

Public information remains public

Once an application knows your address, it can inspect public chain activity without your wallet staying connected. Disconnecting does not erase its knowledge or the blockchain history.

Separate the next prompts

A connection followed by an approval is two decisions. A connection followed by a signature may authorize authentication, an order or token movement depending on the message. Do not treat all subsequent prompts as part of a harmless login.

Existing approvals also matter: a spender may already have access under earlier permissions even though this new connection did not create them.

Use a bounded interpretation

If you only connected to a suspicious site and signed nothing, do not immediately assume your private key leaked. Disconnect, inspect activity and review what permissions the wallet says were granted.

If you approved, signed or entered secrets, investigate that action specifically. A statement such as “connecting is safe” is too broad when it hides the more important question of what the interface asked you to authorize afterward.