A new Coinspect wallet-security warning has put dormant crypto addresses back under scrutiny after attackers began exploiting a flaw in wallet generation to drain funds from addresses created as far back as 2018.
The warning is serious because the affected wallets do not need to be recently active. A dormant address can still be drained if the original wallet generation process produced weak, predictable or otherwise compromised keys. That changes the normal risk model for users who assumed an old wallet was safe because it had not interacted with DeFi apps, signed recent transactions or connected to suspicious websites.
The strongest immediate guidance is direct: unexplained missing funds should be treated as a possible recovery phrase or private-key compromise. Users should not only revoke approvals or change passwords. They should move any remaining funds to a newly generated wallet with a new recovery phrase and then stop using the old wallet entirely.
That step matters across every supported network. A single recovery phrase can generate addresses on Ethereum, Bitcoin, Solana, BNB Chain, Polygon, Arbitrum, Base, Avalanche and other chains. If the phrase or key material is compromised, attackers can scan multiple networks and drain assets chain by chain.
Dormant Wallets Can Still Be Exposed
The latest warning highlights one of the hardest parts of self-custody security: old wallets can carry invisible risk for years.
A user may have generated a wallet in 2018, stored the seed phrase offline, stopped using the address and later assumed the account was cold. If the wallet’s original randomness, key-generation flow or implementation was flawed, the attacker may not need a new phishing signature or malicious token approval. The weak key itself can become the attack path.
That is different from the typical wallet-drainer model, where users are tricked into signing a bad transaction. Here, the concern is closer to seed or private-key compromise. Once attackers can reconstruct or guess the key material, they can move assets without permission prompts, wallet pop-ups or approval transactions.
The same risk also explains why users should check all chains, not only the chain where missing funds first appeared. Modern wallet software often shows only selected networks by default, while the same seed may control balances, NFTs, staked assets, LP positions, claimable rewards and dust across many chains.
Revoking Approvals Is Not Enough
Token approval cleanup is still useful for normal DeFi hygiene, but it does not solve a compromised recovery phrase.
Old approvals let smart contracts spend certain tokens from a wallet. A compromised seed gives the attacker full signing control over the wallet itself. That means the attacker can move native assets, tokens, NFTs and other balances without relying on an existing approval.
This is why the safer response is wallet migration. Users who suspect exposure should create a brand-new wallet, write down a new recovery phrase offline, send a small test transaction first, then move remaining funds to the new address. The old wallet should be treated as burned after the migration.
Users should also avoid sending fresh gas funds into a suspected compromised wallet unless they understand the risk. Automated sweeper bots can monitor compromised addresses and instantly steal newly deposited ETH, SOL, BNB or other gas tokens before the victim can move assets out. High-value cases may require careful rescue coordination, separate funding methods or professional help.
Wallet Hygiene Becomes A Bigger Security Layer
The Coinspect warning lands after several recent wallet-security stories pushed users to rethink self-custody habits. Crypto users recently began revoking wallet approvals after Claude Mythos rumors, while separate campaigns have used fake crypto job interviews to deliver wallet-stealing malware.
The wallet-risk conversation has also expanded beyond seed phrases alone. Rabby Wallet recently faced privacy criticism over pre-password tracking claims, showing how browser wallets are now judged on telemetry, metadata, extension behavior and onboarding design as well as transaction signing.
The latest drain warning brings the focus back to the foundation: wallet generation. A recovery phrase is only as strong as the process that created it. If that process was weak years ago, inactivity does not fix the problem.
The practical checklist is simple. Check every chain tied to old wallets. Move remaining assets to a new wallet and new recovery phrase if anything looks unexplained. Retire the old phrase. Avoid reusing it in another app. Keep the new backup offline. For larger balances, separate long-term storage from daily DeFi wallets and use hardware signing or multisig where possible.
Attackers do not need a wallet to be active if the keys behind it are weak. That makes old dormant wallets a live security issue, not an archive.
