A blockchain is public. Knowing the address, anyone can see ins and outs. Knowing the seed, they can make the outs.

So a portfolio tracker that “just shows the total” has no business asking for a seed. An address is enough. For an exchange — an API key without withdrawal rights.

Watch-only is normal

That is how sane accounting works: the address in MetaMask, the same address in the tracker. The tracker does not sign. The wallet does not have to stay open.

If a service wants “full access so DeFi is more accurate”, that is already a custodian or a dangerous mix-up. DeFi is read from the address and the contracts, not from a seed.

Exchanges

A key with trade/withdraw rights does not go in a tracker. Read only. If the exchange cannot issue that, we do not create a key. See an exchange wallet.

Add an address: open Crypto360. If the total looks wrong after a buy — why it does not match.