With the increase in the Bitcoin price, and hacking attempts on the internet becoming ever more sophisticated, we are writing a special, and once again bring up the subject on protecting your holdings of Bitcoin. There are many ways you can protect your holdings, some are more effective than others. This is long winded, but we ask that you read and take it seriously.
WARNING: Not storing coins safely is done at your own risk, storing large amounts of coin must be done securely, if you do not there is no recourse if they are stolen. We take no responsibility for the advice provided and it is provided on an as-is basis. I am technology literate enough and understand the internal workings enough that these measures are NEEDED, and it will help stop hackers getting hands on YOUR hard-earned money.
Before we continue, we will note that you are only the true owner of your coins if you are the only one who has control over the private keys. This means for anything more than daily change, do not under any circumstances use any online or exchange wallet for storage. Many like Bitcoin as it is not controlled by any bank. This is fair enough, but responsibility of storing your private keys falls entirely into your lap, so you must know the risks and how to mitigate them. The Mt Gox and Cryptsy exchanges going bust took many users wallets with it. Also avoid Bitcoin Vanity address websites, some of these have been known to keep copies of the private keys they generate, and can be risky. Generate them on your own machine only or use one which uses a split key generation service.
Bitcoins can be stolen by malware which steals wallet files and captures encryption passphrases, can swipe private keys upon wallet decryption and can lie dormant until that time. An example here and here shows the risk.
The exception to the rule of online wallets, are the Coinbase ‘MultiSig Vault’, this has three keys, one you print on paper, one coinbase holds, and one key you both hold encrypted by a passphrase only you know and it is decrypted on your machine when you try and spend coins, plus there is a 48 hour window with repeated notifications sent to your email where you can cancel the withdrawal.
This provides some protection from Keylogger hacks. If you forget your passphrase, you give coinbase the printed ‘user key’ to restore access. If coinbase goes bust, you can use the encrypted shared key (with your passphrase) and the ‘user’ key to move your coins. If coinbase go bust and you forget your passphrase (which is an unlikely mix), you are out of luck however.
This is the only online wallet you should ever store anything more than daily change or money you are instantly going to exchange. No other online wallet is truly as safe as this, and you can keep multiple copies of the paper backup say in a safe and a safe deposit box, and it is useless with the user key alone without the passphrase or coinbase’ key.
For anything with day to day spending, Electrum or the Bitcoin-QT wallet (encrypted with a passphrase) is enough, combined with a good firewall / security software such as Kaspersky. Electrum (supports both Bitcoin and Litecoin) is easier to use and with the 12 word seed you can safely restore your wallet and as it is deterministic, you need not make regular backups as the seed or wallet file can be used to restore, unlike with QT wallet which can over time create new addresses not in the Backup. Save multiple seed copies. If you forget your passphrase or loose all copies of your wallet file, you will NEED IT. With Electrum for Bitcoin you can have the same seed on your phone and desktop or other device to streamline your access to your funds and it provides a backup in and of itself.
Now for anyone storing more than say, 0.1 BTC on their PC should take the next step of security. This is called a hardware wallet. These wallets carry out transaction signing inside them, and can be used even on an infected computer without risks to your coins. These wallets upon initial set up give you a 12 or 24 word seed. KEEP THIS SEED SAFE IN MULTIPLE PLACES, this is why. If the wallets are lost or stolen, you will need it to restore. Treat it as you would a paper wallet and can act as a defacto paper wallet. You can load the same seed onto multiple hardware wallets.
TREZOR is the most well known of these, with a screen showing the sending address and a button to confirm or deny on the device itself.
You can check if the address is the one you intended to send coins to in case malware tried to change it. This is costly, at $99 USD but has the ultimate security. It is PIN protected and is useless to any thief as it wipes the device after a few incorrect attempts.
LEDGER do a basic hardware wallet, the ledger HW1, this can be had for as little as $25 USD and has a PIN code, wiping it after 3 incorrect attempts. This one is highly secure and can use a mobile phone as a second factor screen to verify wallet addresses or the security card. This has a very high level of security, as good as TREZOR with the mobile phone option.
These wallets however MUST be set up on a secure PC; the TREZOR shows the initial seed on it’s screen where the ledger shows it on the host PC during initial set up and asks you to type it in to verify it, this is the only chance you get to write it down. Once set up it can be used on an untrusted PC, and the ledger application can be used without admin access on chrome. You can use these wallets with Electrum too. The ledger nano S solves the trusted PC setup vulnerability and has a little screen on it too and can be had for $70 USD.
Do not buy hardware wallets sold by Black Arrow, this company swindled many customers out of money, some posts about it here and later in this thread.
If you do not send transactions often from the wallet, add a hardware wallet’s address as a contact in Electrum or even as a watch only address on any provider, coins are safe and you can send money to them without needing to plug them in, they only need plugging in to send funds/sign a transaction or message.
Electurm offers an option for 2FA, which uses a form of multi signature wallet (two or more private keys needed to sign) and this can also be reasonably secure as well. You can keep a third key safe off your machine which you can use to sign the transactions without the provider, this is free to set up.
To sum it up:
- use a hardware wallet for large storage of funds. Here is why. Set up a ledger on a secure machine.
- Next best thing, an electrum 2FA multisig wallet.
- Coinbase Multisig Vaults are secure when used properly but with less privacy to US authorities.
- DO NOT USE ONLINE OR EXCHANGE WALLETS FOR STORAGE OF MORE THAN DAILY CHANGE
- DO NOT USE ONLINE VANITY ADDRESS GENERATORS OR ANYTHING WHERE YOUR WALLETS ARE GENERATED ONLINE. Examples of why, here and here and here.
- USE 2FA ON EXCHANGE ACCOUNTS OR WIREX ACCOUNTS, in fact on ALL online accounts.
- USE GOOD SECURITY SOFTWARE SUCH AS KASPERSKY. Worth the money.
- Keep a paper backup of all 2FA keys.
- STORE SEEDS OR WALLET BACKUPS SAFELY IN MULTIPLE* LOCATIONS!
- Do NOT store seeds on your PC! Here is why.
- Maybe consider keeping holdings in more than one wallet/place.
- A slightly different point, use trusted escrow when buying stuff with large quantities of Bitcoin or other cryptocurrency from an online seller. Ognasty, or PsychoticBoy from BitcoinTalk.org are two such people who can be trusted. Contact them directly yourself when setting up escrow.
- Even if you use a standard QT or Electrum or other wallet for small change, encrypt it with a password.
The above cannot be emphasized enough. This is written from the bottom of our hearts, USE HARDWARE WALLETS FOR STORAGE OF LARGE FUNDS OR A COINBASE MULTISIG VAULT. For day to day change, Electrum encrypted with a passphrase, for a little more than Day-To-Day change, Electrum 2FA.
Backup, backup and backup. Your writer Jacob Mayes was prevented loosing over £1000 GBP, after a virus which attempted to steal funds in his small QT wallet, and while infected had signed transactions using his hardware wallets, and his funds were safe. It had captured passwords, but the use of 2FA stopped the theft of live coins ready to be exchanged. Don’t think just because your careful online that this cannot happen to you.
Hardware wallets rarely fail. Mine randomly corrupted (ledger HW1, a firmware bug which was fixed). Having the seed stored safely saved my bacon. Someone lost several million USD of Bitcoin when he had not backed up his private keys (he threw away his hard drive)
You have been warned, stay safe folks, the internal transaction signing of hardware wallets means that your funds are safe even on an infected PC. Use them! We have the tools to mitigate these attacks, and we must do it, sending out a strong deterrent! We may be our own bank, but in doing so we must take responsibility.