Wallet-recovery and wallet-cleanup tools ask users to connect an active crypto wallet in order to identify dust balances, abandoned tokens, or forgotten positions. That connection step is exactly where privacy and security risk concentrates, so it's worth understanding what a trustworthy tool should and should not ask for, independent of any specific product.
What a wallet connection should never require
- Your seed phrase or mnemonic recovery words, under any circumstance.
- Your private key, in raw or exported form.
- A blank signature or an unlimited token approval with no visible transaction details.
Any tool that asks for the items above is not a wallet connection — it is asking to take custody of your funds. Legitimate non-custodial tools use wallet-connection standards where the wallet itself (a browser extension or mobile app you already trust) prompts you to approve each specific action.
What a wallet connection typically does involve
- A public address read. The tool reads your wallet's public address and on-chain balances, which is inherently public information on most chains.
- Per-transaction signing. Any action that moves or consolidates funds should present a specific transaction for you to review and sign in your own wallet interface, not the tool's.
- Scoped token approvals. Where a token approval is required (common on EVM chains), it should be scoped to a specific amount and contract, not an unlimited allowance, and should be revocable afterward through a wallet or a token-approval checker.
Questions worth asking before connecting a wallet to any tool
- Does the interface clearly show what each transaction will do before you sign it?
- Can you revoke any approval afterward, and does the tool explain how?
- Does the tool's own privacy policy state what wallet address data it retains, and for how long?
- Is the site served over HTTPS with no mixed content, and does its domain match what you expect?
- Does the tool ever ask for information beyond a public address and transaction signatures?
Dust, airdrops, and phishing
A specific risk worth naming: some "dust" tokens sent to wallets are themselves phishing bait — interacting with them (even just viewing them in certain wallet interfaces, or attempting to swap or transfer them) can trigger a malicious contract. A cleanup tool that surfaces these balances should clearly separate "tokens with real, tradeable value" from "unverified or suspicious tokens," rather than encouraging blanket interaction with everything found in a wallet.
This is general guidance, not a description of how any specific NomadRex product is implemented. See NomadRex Recovery Rx for what that product states about itself, and independently verify non-custodial behavior before connecting any wallet to any tool.
Related reading: Building trustworthy blockchain tools.