· 2 min

Antidetect Browser Data Breaches and Why Local Storage Matters

The Dolphin{anty} 2022 breach and the AdsPower 2025 supply-chain attack, and where each antidetect browser stores your profiles.

An antidetect browser profile holds cookies, logged-in sessions, proxy credentials and sometimes crypto wallets. When profiles live on a vendor server, one breach exposes many users at once. Two incidents show the risk.

Dolphin{anty}, July 2022

Attackers got into Dolphin{anty} cloud profile storage. About 15% of profiles were exposed. Those profiles held the session data that users paid to keep separate. Dolphin{anty} still stores profiles in the cloud.

AdsPower, 21–24 January 2025

This was a supply-chain attack. For four days, wallet extensions delivered through AdsPower were replaced with backdoored builds. Users who opened profiles with those extensions lost funds. About $4.7M was stolen. The attack did not need to break any one user’s machine. It went through the vendor’s own distribution.

What the two incidents teach

Risk Cloud storage Local storage
Vendor server breach All stored profiles exposed Profiles not on the server
Account takeover Profiles readable from anywhere Attacker also needs your device
Vendor shuts down Profiles may be lost Profiles stay on disk
Malicious update Exposed Exposed

Local storage does not fix everything. A malicious update reaches local apps too. That is where open source helps: anyone can read the code and the build. Local plus open is the strongest position.

Where each browser stores profiles

Browser Storage Account required Open source Known incident
Donut Browser Local + optional E2E-encrypted cloud No App (AGPL-3.0) None known
Camoufox Local No Yes (MPL-2.0) None known
Kameleo Local + cloud Yes No None known
Multilogin Local + cloud Yes No None known
Undetectable Local + cloud Yes No None known
GoLogin Cloud Yes No None known
MoreLogin Cloud Yes No None known
Octo Browser Cloud Yes No None known
Incogniton Cloud Yes No None known
Dolphin{anty} Cloud Yes No July 2022 breach
AdsPower Cloud Yes No January 2025 supply-chain attack

How we score this

Local-first privacy is 18% of the total score in our methodology. It covers storage, account requirements, telemetry and breach history. Donut Browser and Camoufox score 10. Dolphin{anty} and AdsPower score 2.

Donut Browser keeps profiles on your machine by default and needs no account. Sync is optional, end-to-end encrypted and self-hostable. That is why it leads this criterion and the overall ranking.

If you use a cloud tool now