More than $713 million in cryptocurrency was stolen directly from personal wallets in 2025, according to Chainalysis's 2026 Crypto Crime Report, marking a dramatic shift in how attackers now target individual holders. The theft came from 158,000 incidents affecting roughly 80,000 victims, averaging $4,500 per loss. What makes this year different is not just the scale, but the strategy: attackers are no longer chasing the biggest scores. Instead, they're hunting for wallets that nobody is watching anymore.

The data reveals a troubling trend. Personal wallets made up just 7.3% of stolen crypto value in 2022. By 2024, that share had jumped to 44%. While it settled near 20% in 2025 due to one large exchange hack skewing the annual total, the underlying pattern remains clear: individual wallet compromises are becoming the preferred target.

Why Are Forgotten Wallets the New Vulnerability?

Most people who lose funds don't get hacked through their main wallet. They lose it through a test wallet created two years ago, a browser profile they forgot existed, or an exchange-linked address they never revisited. Attackers understand this weakness and exploit it ruthlessly. Forgotten wallets are exactly what drainer contracts target, because nobody is watching them.

The problem extends beyond old wallets. Many users have created addresses inside game clients, NFT marketplaces, or browser-based mobile apps without realizing that a real private key now exists on that device. These wallets often accumulate long histories of token approvals and interactions over time, creating multiple entry points for attackers. MetaMask's June 2026 security report adds another data point: its partner Blockaid flagged 65.4 million address-poisoning attempts since January 2025, which is why MetaMask shipped live address-poisoning detection this year.

How to Audit and Protect Your Wallet Inventory

• Create a Complete Inventory: Open a spreadsheet and list every address you control, including the blockchain, approximate balance, what it's used for, and how old the seed phrase is. Include software wallets on your phone, browser extensions on every device, any exchange sub-accounts, and hardware wallets sitting in a drawer. Flag anything you haven't touched in six months.
• Identify High-Risk Addresses: Pay particular attention to any wallet connected to a centralized exchange for withdrawals, since those addresses tend to accumulate a long history of approvals and interactions. Also check for wallets created inside game clients, NFT marketplaces, or browser-based mobile apps, since these often generate a seed automatically on first launch.
• Prioritize Migration: If you find a wallet holding meaningful funds that you can't account for in terms of backup or hardware protection, treat migrating it as priority work rather than something to handle eventually. Forgotten wallets with real balances are exactly what attackers are hunting for right now.

The scale of wallet-drainer losses has shifted in an interesting way. Scam Sniffer tracked $83.85 million in wallet-drainer losses across 106,106 victims in 2025, down 83% from roughly $494 million the year before. This works out to about $790 per victim. The pattern suggests attackers are moving away from targeting a few massive scores and instead running campaigns that hit many smaller accounts.

What Does a Secure Wallet Structure Actually Look Like?

Security experts recommend splitting holdings into three tiers based on how often you need to sign transactions with each one. A single wallet holding your spending money, your DeFi positions, and your long-term savings is the most common structural mistake in self-custody. One phishing click and everything is gone at once.

The hot wallet is the one you connect to unfamiliar sites, so treat any loss there as a cost of doing business, not a catastrophe. Keep it under $500 and use a browser wallet with a software-only seed. The warm wallet signs through a hardware device but stays connected to DeFi protocols you actually use, holding no more than 10% of your net crypto holdings. The cold wallet almost never touches a decentralized application (dApp) and can hold your long-term savings with no practical ceiling on balance.

When setting up a hardware wallet, buy the device directly from Ledger or Trezor, not from a marketplace listing or a reseller you don't recognize. Devices bought secondhand or through unofficial channels have shown up pre-tampered in documented cases, and there's no reliable way to verify a used unit wasn't modified before it reached you. When the device arrives, run the manufacturer's genuine-check inside Ledger Live or Trezor Suite before you generate a seed.

Never import a seed phrase that was ever displayed on a phone, laptop, or website, since that seed is already compromised the moment it touched an internet-connected screen. Instead, generate a brand-new seed on the device itself. Set a PIN of at least eight digits rather than the minimum the device allows, and if your hardware wallet supports a passphrase, enable it for cold storage specifically. A passphrase creates an entirely separate hidden wallet from the same seed, so someone who finds your metal backup or forces you to unlock the device under duress still can't reach funds protected behind a passphrase they don't know.

The shift toward targeting personal wallets reflects a broader change in the threat landscape. While exchange hacks and bridge exploits grab headlines, the real money is now flowing through thousands of smaller compromises. Attackers have learned that patient, distributed campaigns against individual holders generate more total theft than waiting for the next big institutional target. For anyone holding cryptocurrency in self-custody, the message is clear: your oldest, most forgotten wallet is now your biggest liability.