Web3 is all about digital freedom. But with freedom comes responsibility. In today’s digital world it is important to keep your digital assets safe. Most of the assurances and protections provided in the real world when transacting with real companies are non-existent in the crypto world.
In crypto, you are your own bank. Because of this, YOU are responsible for the security of your own assets. You assume all of the risks when choosing to transact with crypto. If anything happens to the assets in your wallet, there is no customer support to call, no built-in fraud protections, and no third-party entity insuring your assets. You must be vigilant in maintaining your operational security. Security is not a one-time activity, it is a constant routine. This article provides tips on how to secure your crypto assets. Many of the tips here do not only apply to crypto; they can be used to secure your digital life in general.
General Tips
- NEVER GIVE OUT YOUR SEED WORDS TO ANYONE!
- Use a hardware wallet to secure the bulk of your assets. Minimize holdings on centralized exchanges and software wallets such as MetaMask.
- Only buy hardware wallets from trusted sources such as Trezor.io and Shop.Ledger.com. Try to go directly to the manufacturer’s websites if you can. Amazon or any website that allows third-party sellers to sell on their platform are NOT trusted sources. With third-party sellers, you run the risk of purchasing a hardware wallet device that has been tampered with in some way that may allow a hacker to steal your funds.
- Likewise, only download software wallets such as MetaMask from the software manufacturer’s website. Never download it from a third-party website.
- Educate your trusted family members about crypto and how to access your assets in case anything happens to you.
Computer Security
- It is a good habit to get into to lock your computer every time you walk away from it. This prevents prying eyes from seeing what you are working on and provides an access barrier to anyone who might be in close proximately. Use Window + L on a Windows machine, Command + Control + Q on a Mac. Many people think that closing the lid on a laptop is sufficient. This does not always put the computer onto the lock screen. Test this out yourself by closing your laptop lid and waiting about 30 seconds before opening it again. If not presented with the lock screen when opening the lid, go to your computer’s settings and enable this.
- If you are done using your computer for the day, completely shut it down. Not only does this save on energy but it prevents the possibility of your computer being seen by a potential hacker.
- Keep your computer’s operating system up-to-date by enabling automatic updates. It can be set to either prompt you to install at a time that is convenient for you or automatically install it for you. Security updates include patches to potential security holes which hackers can exploit. Ensuring your system is up-to-date minimizes your attack surface.
- Install anti-virus and anti-malware software on your computer to detect and remove any potential viruses or malware that might be on your system.
- When not performing crypto transactions disconnect your hardware wallet device and store it in a secure location, not within close proximity to your computer. While it is less convenient it is safer and also reduces your risk of FOMO and making a bad uninformed decision.
- Do not perform crypto transactions on a shared computer. Use a dedicated computer, protected with a login, and do not let anyone else use it. Get your kids their own device.
- Don’t store seed words in a photo, document, or file of any type on your computer or in any kind of cloud storage such as Google Drive, DropBox, or OneDrive.
Wi-Fi Networks
- Get familiar with your wi-fi network and take steps to secure it. Most routers obtained from your internet service provider come with a default password printed on the back of the device. Hackers know these passwords and will try to use them to connect to your network. Change this password. Consult your modem manufacturer or internet provider documentation about how to do this. This also protects your wifi network from window peepers and anyone who enters your home that might have ill intent.
- Hide your wi-fi network’s SSID (Service Set Identifier). An SSID is basically the name that shows up when searching for wi-fi networks to connect to. If yours is hidden, it will not show up in the list of networks to connect to. A hacker would not see that it exists and would need to know the SSID name of your network in order to attempt to find it. Consult your modem manufacturer or internet provider documentation about how to hide your SSID.
- Use a VPN (Virtual Private Network) to encrypt your internet traffic and hide your computer’s IP (Internet Presence) address. I recommend using this at all times but it is especially important to use when connecting to public wi-fi networks such as coffee shops, airports, etc.
- If you can avoid it, don’t access crypto, banking, or other financial websites that require you to log in while connected to public wi-fi networks.
Online Safety
- Use strong passwords for anything that holds your financial or personal data. Strong passwords should include a mix of uppercase and lowercase letters, numbers, and special characters. The longer the password the better. Some people like to use passphrases as they are often easier to remember. Never use the same password for multiple sites. If you are worried about remembering long complex passwords, don’t try to remember them. Instead, use a password manager such as LastPassor 1Password.
- Use two-factor authentication (2FA) on all financial websites and your Gmail. Though the SMS method is convenient, it can easily be circumvented by a sim swap attack. If you do need to use SMS, sign up for a free Google Voice number that forwards calls and texts to your mobile phone. Then use that Google Voice number as the 2FA number on all websites. Since Google Voice numbers are virtual they can not be sim swapped.
- Using a different 2FA method altogether like an authenticator app such as Google Authenticator or a security key such as YubiKey is recommended. Securing your Gmail or another email account with 2FA prevents a hacker from easily accessing your email account in order to retrieve a password reset email.
- Don’t store seed words in a photo, document, or file of any type on your computer or in any kind of cloud storage such as Google Drive, DropBox, or OneDrive.
- Be cautious about what you post on social media or any public-facing forum. Never divulge your holdings.
Mobile Security
- Keep your mobile device up-to-date by enabling automatic updates. Security updates include patches to potential security holes which hackers can exploit. Ensuring your mobile device is up-to-date minimizes your attack surface.
- Use a mobile VPN if possible, especially if you need to connect to public wi-fi networks such as those in coffee shops, airports, etc. If you use a VPN on your computer, the manufacturer may make a mobile version as well that you can install and use on your mobile device for no additional charge.
- Don’t access crypto, banking, or financial websites on your phone while connected to unsecured public networks.
- Don’t store seed words in a photo, document, or file of any type on your computer or in any kind of cloud storage such as Google Drive, DropBox, or OneDrive. If it sounds like I have said this three times now, I have. Protecting your seed words is perhaps the most important thing.
- In November of 2021, a Hexican by the name of Hex19 was the victim of a sim swap attack. As a result of the sim swap attack, the hacker was able to access Hex19’s seed words that were stored on cloud storage and got away with multi-millions of dollars of Hex. Again, using a different 2FA method altogether like an authenticator app such as Google Authenticator or a security key such as YubiKey is recommended.
Physical Security
- Do not leave your hardware wallet device laying on the desk, in an unlocked drawer, or anywhere in close proximity to your computer. Lock it up. A fireproof and waterproof lockbox or a safe are good options.
- While it is convenient to keep your hardware wallet device handy in a place that is easy to find and access, it is not very secure to do so. It’s like leaving your credit cards laying out for anyone to grab. You should treat your hardware wallet device with greater care than you would for your credit cards.
- If you store your seed words on paper, make two copies and store them in separate locations. Since paper can degrade over time Since paper can degrade over time a titanium engraved plate is a solution that prevents degradation. Both Trezor and Ledger sell them. Securely lock up all these items.
- Store your hardware wallet device in a separate location from your seed words. If someone steals your hardware wallet device it is useless to them without your seed words.
Sending Crypto
- When sending crypto from an exchange to your non-custodial wallet, or from one wallet to another be sure you are doing so on the correct network. If you send crypto from one network that is not compatible with another network you risk losing it.
- If you are ever unsure of where or what you are sending send only a small amount as a test. Check the block explorer to see what happened. If all goes well you can simply repeat the process to send your desired amount.
Common Scams
- Anyone that asks you to send crypto and they will send you more back is scamming you. Never send crypto to anyone promising to send you something back. They never will.
- Be on the lookout for fake Twitter and other social media accounts. Scammers like to create new profiles with the same name and profile photo of a known user. However, they can not have the same username as an existing account. Verify the username.
- Ignore chat messages from people you don’t know, claiming to be crypto tech support. There is NO crypto tech support. You are your own bank and your own tech support. When getting into new projects be sure to research what you are getting into and read any and all provided documentation to be sure you fully understand what you are getting into.
- Be wary of paid shillers. There are many streamers in the crypto space and many of them get paid to shill crypto projects. Often these streamers just take the money and don’t bother researching what they are shilling. Don’t get into anything just cause an influencer you follow shills it to you. DO YOUR OWN RESEARCH!