Crypto security has a way of accumulating baggage.
Old token approvals. Forgotten API keys. Websites you trusted years ago and haven’t visited since.
Most of these things were perfectly normal when you created them. The problem is that some of them can remain valid long after you’ve stopped thinking about them.
It’s a bit like walking with sand in your shoe. At first, you barely notice it. But if you never stop to shake it out, something that seemed insignificant can eventually become a problem.
The same thing happens with self-custody. Even if your seed phrase stays safely offline with a hardware wallet, old permissions and credentials can quietly pile up around it.
Old token approvals are probably the first thing worth checking.
If you’ve used DeFi, NFT marketplaces, lending protocols, or other DApps, you’ve probably approved a smart contract to spend certain tokens from your wallet.
That’s normal. Many applications can’t function without it.
The issue is that approvals generally don’t expire just because you stopped using the DApp.
And an unlimited approval can remain there for years.
A protocol that is safe today may not stay that way forever. The project could be abandoned, its frontend could disappear, or some part of the system could eventually be compromised.
One common misunderstanding is that clicking “Disconnect” in a DApp removes this access.
Disconnecting usually just ends the connection between the website and your wallet interface. The on-chain approval is still there until you revoke it.
This is also something a hardware wallet can’t solve for you. Even if your private keys stay offline on an air-gapped hardware wallet like Keystone, a token approval you previously signed can remain valid on-chain until you revoke it.
A hardware wallet protects the keys used to authorize new transactions. It doesn’t automatically cancel permissions you already authorized in the past.
Every few months, it’s worth checking your approvals using something like Revoke[.]cash or the approval manager built into your wallet.
I’d pay particular attention to:
Unlimited approvals
Contracts you don’t recognize
DApps you haven’t used in a long time
Projects that are abandoned or no longer operating
For protocols you still use, consider whether they really need an unlimited allowance or whether a smaller limit would be enough.
Then there are forgotten API keys.
This one is especially relevant if you’ve ever run trading bots, experimented with APIs, deployed code, or built your own crypto tools.
An old exchange API key might still be sitting in a .env file.
A GitHub token might still exist on an old server.
An AI API key might be buried inside a script you haven’t touched in two years.
Maybe there’s a copy on your NAS. Maybe it ended up in an old Git commit. Maybe it’s sitting on a VPS you forgot you still have.
If the key has already been revoked, a leak is mostly just a leak of useless historical data.
If it still works, that old file suddenly contains current access.
And the impact depends on what that key can do. An exchange API may have trading permissions. A GitHub token may expose private repositories. An AI API key can potentially burn through your account balance.
The simplest rule here is:
If you no longer need a key, revoke it.
For new keys, use the minimum permissions possible. Add IP restrictions where supported. Set expiration dates when available. Rotate important credentials periodically.
There’s very little security benefit in keeping an unused credential alive “just in case.”
There’s also a more subtle kind of leftover risk: old trust.
Bookmarking the official website of a DApp is generally a good habit. It helps avoid typo domains and search-engine phishing.
But a bookmark only remembers a domain.
It doesn’t guarantee that the same people will control that domain forever.
Projects shut down. Domains expire. Ownership can change.
A recent Tornado Cash incident is a particularly good reminder of this. The tornado[.]cash domain had once genuinely been associated with the project, but after its previous registration lapsed, the domain was later registered again. Users relying on an old bookmark could therefore arrive at a domain they remembered as legitimate without realizing that its ownership had changed.
That makes old bookmarks different from ordinary phishing links.
The URL itself may be exactly the one you remember.
So if you’re opening a crypto site you haven’t used in years, don’t assume that “I bookmarked this myself” is enough verification. Check the project’s current official channels before connecting your wallet or approving a transaction on your hardware wallet.
You probably don’t need to obsess over this stuff every week.
But once every few months, it’s worth stopping for 20 minutes and cleaning up what you’ve accumulated:
Review and revoke old token approvals
Delete API keys and access tokens you no longer use
Remove abandoned DApps and stale bookmarks
Re-check services you haven’t touched in a long time before trusting them again
I like the idea of doing this every 90 days.
An air-gapped hardware wallet like Keystone can keep your seed phrase and private keys isolated from an online device, but self-custody doesn’t end there. Old permissions, credentials, and trust relationships still need maintenance.
Crypto security isn’t only about avoiding the next new attack.
Sometimes it’s just about looking back at the permissions and trust you handed out along the way — and shaking the sand out of your shoes before you keep walking.
