Topic: How to Secure Our Wallet to Prevent Being Hacked! (Read 639 times)

I just wanna add one point to this security mechanism for securing the wallets. A chain is as strong as its weakest link and in cyber world this weakest link is human. Trust me nothing can happen to your wallets unless you do something that is prohibited. We are missing one key aspect of hacking here i.e. social engineering. Hackers these days are mixing hacking tools with social engineering for there and I m saying this since it happened with me. Never download a file sent to you by stranger.

Previously im just using with an executable file with the electrum and well its a good thing because before I don't have a hardware wallet most of the people suggest storing your seed phrase into a piece of paper it's an ideal too but its better if we store it with multiple copies and we know the physical texture of the paper so it's better to find some more ideal to write it not easily damage. Now I'm using with a hardware wallet which is more reliable than using a google extension or browser extension this feels make more safe.

I have my mew wallet created on 2018 and during the time I am using it is that I don't have any problems with. It is true that paper wallet like mew, metamask important files, private key or mnemonic phrase is not stored online though it is generated through the extension or mew website/app online. Didn't try generating offline yet on metamask but on mew tried many times already and works good on website (did not try app offline).

My bad, that is true. The idea of paper wallet is the fact that the private key is not online but offline and is written on a paper. The idea of generating a HD wallet on an airgapped device and having the seed phrase properly backup on paper should truly makes it a paper wallet too, while many addresses can be saved and be used for transaction.

A paper wallet is whatever you want it to be, you are not forced to print a single private key (WIF) on paper, you can simply generate a mnemonic and write that down on a piece of paper which makes it your HD-paper-wallet so you can generate as many keys as you want.

If I may add, we should also be very careful to not download a random application even if it's listed on google play, cause it may consist of malware or virus too. Second, many people save their private keys on cellular notes, cloud, or other media. It's still has a chance to be hacked. Third, always double-check some popular websites or sites that are frequently being used like mew, etherscan, other explorers cause some people to try to input phishing links, and sometimes it's difficult to differentiate it. Don't just google it and immediately click the site on the very top, cause it's not always the right one, better to bookmark the real site like you've said.

Why did you prefer paper wallet exactly over hardware wallet? If you know how to operate hardware wallet, it can give convenience while you can still decide to have both. Paper wallet only generate one private key, unlike the hardware wallets which are HD wallets generating several keys and addresses which can also help you in maintaining privacy if other ways to privacy are considered. It is your choice, paper wallet is also safe as the key is also offline.

Even if it is updated it could still be compromised, so you shouldn't assume because your up to date in the latest software that you aren't a potential target. Although, what your saying is possible, its much more likely that the hacker will look at the unencrypted information you are entering on the WIFI, and therefore look for passwords, rather than actually compromising your machine itself.

Security is important, but we tend to put emphasis on hackers like they are geniuses, when in reality most hackers are using well known exploits, or using someone else's script. There's not too many hackers which are adept enough to code their own sophisticated attacks, especially since their opponent is either Apple, Microsoft or Linux, which constantly monitor the space, and make improvements.

Any extension that you have installed which isn't open sourced, and hasn't been verified by either yourself or others has the potential of compromising your data. Therefore, you shouldn't just install any extension, plus personally I don't see the need to install several extensions at a time. Honestly, I could only recommend security/privacy open sourced extensions such as Ublock Origin, potentially a No Script extension if that suits your purposes.

Thanks for the cautions especially that of not using free WiFi,most times people become too gullible that they jump into any free WiFi they see,not knowing it has some hazardous effects,by giving hackers access into personal and financial information on their phone

In addition to the fact that the Chrome browser itself is not completely secure, all its extensions often collect information about users contrary to privacy rules. Recently, there was a story on reddit.com where users complained that an installed Chrome extension was accused of stealing cryptocurrencies.

https://www.reddit.com/r/Metamask/comments/mvtdbe/2_different_friends_have_been_hacked_someone_got/

I do not know how true this information is, but any browser hung with various add-ons will always pose a danger to the owner.

I totally disagree with this. Dont install any browser extension. It is not always clear what kind of information it collects. Even if you use browser extensions, go through them and check for old/rarely used and delete them.

When you export your browsers settings, these extensions like to migrate with you. Sometimes old extensions are being sold or bought on purpose by hackers and their code is being modded. Next time when your old "neat old browser theme" asks for update, think twice before you update it. Because behind it you might get a bot, keylogger and other crap.

Only addresses can be used to check balance, electrum can be used for this ourpose in a way you will import the addreses on electrum, this will sychronize with the blockchain that will result to the balance that will show up. This is more secure because nobody can spend from such wallet which are called watch only wallet but only used to track transactions. But seed phrase can be used to check balance too if it is imported into a bitcoin supported wallet, in this case, someone will be able to spend from the wallet. But this should not make someone confused and input the seed phrase on a site that requested for it, any site that requested for your seed phrase only want to scam you.

Im confused what that person means here.  They say you could enter your btc address to check balance right?  The way this person phrased it was like you could enter your wallet seed into it and check it.

You are not wrong, many wallet hack is as a result of people themselves which are careless, carelessness is one of the reasons for some of the hack. But having offline wallets still reduced the chances of the carelessness, using mobile or desktop wallet is also still better but yet vulnerable as they are both online wallets. Web wallets are just the most vulnerable, and they are not recommendable in case of safety, it makes people to be more vulnerable to their carelessness. But, yet, people need to be very careful and protect their wallet perfectly.

Yes, this is the second step but we're not fully safe on the internet and for this reason this method can help us to secure our wallet.
Actually it can help us to find real website on the internet. Obviously we should avoid malicious extensions but sometimes, chrome extension is worthy enough. For high security in this respect, anyone can clear browser cashe, cookies and history.

[moderator's note: consecutive posts merged]

1. If your wallet is a add-on like metamask make sure you don't use the browser to browse online at all, dedicate the browser for metamask only, in fact I prefer using the mobile app instead

2. Avoid clicking on links either online or through emails

3. Safeguide your recovery seed and private keys, they should never be shared with anyone and make sure you don't store them in places where it's easier to people to reach

Sometimes the storage of the seed or private key is ignored and has no security. this is what will become a gap to be stolen and hacked. Hacking of personal wallets is indeed due to the recklessness of the wallet choosers.

Being exposed to phishing is also the reason why personal wallets are hacked. Because the phishing page will ask to enter a private key. this needs to be paid attention to, make sure the page used is a genuine page and not phishing.

Like the metamask extension wallet, from the past until now there are fake extensions created by scammers. Make sure everything is original and you should pay attention to it.

It is very important to protect our wallets from hacking, by choosing strong passwords, activating more than one protection method to enter the wallet, such as a PIN code and fingerprint, and to avoid sending our private keys to any unknown person or website.

Even then, there's a small chance that you could be compromised since you have to connect to the internet before you connect to the wifi. If you can, its better to use a cellular data connection, connect to the VPN, and then connect to the free wifi. Cellular data connections are secured differently, and generally are more secure than wifi connections, which see a lot of traffic throughout the day. 

Yes, was talking aboug BEP20  (BSC)
I know you guys are talking about normal Bitcoin but you aaid " Metamask and myetherwallet wallet do not support bitcoin (correct me if wrong)" which is the reason why I point out the features of introduced by the Binance Smart Chain.

Be 💯 serious with your crypto wallet like your life depends on it or treat them like you would treat your bank accounts, believe me crypto wallets are banks on a whole new level, no one will have a clue about what your worth is, isn't that cool?

Many blame wallets hacks on the wallet but honestly most times this happens because of mistakes and carelessness on the users, the only crypto wallets that aren't safe are the centralised wallets but others that gives seed or private keys and still got hacked is due to users fault

For a normal user who is not going to have in millions can make use of the electrum wallet which is very convenient for long term storage as well as day to day transactions but keeping the private key in a secure place is the key no matter what kind of wallet you are using.

I moved to electrum for bitcoin storage for years now where I am not having any issues yet but I am not having any mod apps in my smartphone and also I am always aware of malicious links and trojans.

2FA is literally not going to save you from hacks as long as the scammer managed to get your private keys, it just a useful feature on exchanges but not really useful on a wallet.

For bitcoin, you don't have to provide your private key to check your balance. You can set up a watching-only wallet by using your public address. This way, you don't expose your private keys to the Internet.

You only need your seed/private key to access your wallet. Any wallet software that has 2FA feature is a custodial wallet which are not safe and you should not use them if you care about the security of your funds. A better alternative for 2FA is to set up a 2of2 multisig wallet and keep each co-signing private key/seed on a different device.

If you have no other option but to connect to a public WIFI, then at least connect to it with a reliable and secure VPN.

BEP2:- Binance Chain
BEP20:- Binance Smart Chain (BSC)

I believe you meant BSC (BEP20)

But the normal bitcoin we meant is the one that its addresses starts from 1, 3 or bc1 which makes use of bitcoin blockchain for its storage and ledger, not a smart contract.

Metamask does support Bitcoin but it require some technical elaboration and it done through BEP2.0 (BSC) integration.
About myerherwallet have once seen a buying Bitcoin option on it but I never try it out so I don't if support it or not.

Been careless is not outsmart, it's true that some people are so freaking careless, even if they use hardware wallet they can still lose their assets in many different ways, there are crypto mobile wallets users that never lost their assets for many years you know

I agree. In addition to all the rules that were advised above, do not forget about your behavior on the network. You shouldn't tell anyone about the amount of your cryptocurrency, thereby stirring up interest in your funds among hackers.
In addition, your systems must be constantly updated.  Your applications must be up to date. And of course, don't turn your back on antivirus software. I would not spare money to purchase a licensed antivirus that regularly updates its antivirus databases.
Your mail should only be used for specific purposes. You shouldn't use it for every need. Likewise, passwords must be complex and have the correct storage.
As for the Chrome browser, its store is full of extensions that have been caught spying on users, which can lead to further loss of funds. I prefer the Firefox browser.
And these are just some ways to keep your wallets safe. It is always necessary to remember that only you are responsible for the safety of your wallets. And how you feel about it will be an indicator of your safety.

Try to read the post very well, having a cold wallet offline generating digital signatures for transactions and watch only wallet for tracking the transactions and balance is very safe, it is even one of the safest ways to make use of online wallet in an offline way.

Ledger nano is not a paper wallet. How can someone outsmart himself while using paper wallet? That is not clear at all.

Hardware wallet is the most secure and recommended way to store your crypto right now. Even a newbie can use hardware wallet like ledger nano.

---

I have made similar topic about how to keep your bitcoin secure sometime ago. Maybe it will give people more references on how to secure their crypto. Check it out https://bitcointalksearch.org/topic/m.56528845

Paperwallet, written seeds on stainless steel, backup inside mail or buying hardware wallet, all these doesn't mean your coins are safe because it still depends on the users themselves, you can't be careless and using a crypto wallet you will eventually do the most stupid thing on day, you can to be a disciplined person to handle your wallet

It is very difficult and difficult to do in reality. If you have this level of knowledge, you must have a hardware wallet. Otherwise you will be robbed

The paper wallet has many disadvantages too. There is a great risk of outsmarting yourself. That is, lose your keys or make them inoperable.
People manage to lose coins from the ledger...

Although, some people do think paper wallet are only the wallet generated from sites like bitaddress, some sites like that have even been turned scam in the past, which increase the risk of generating such paper wallet, but although bitaddress remains one of the legit ones as of the time I post this. But, paper wallet in my opinion have gone beyond that, if I have an offline or airgapped phone, downloaded electrum wallet, transferred to the offline or airgapped phone, and I open the wallet to generate seed phrase. Having like five addresses with me, and I deleted the wallet after I backup the seed phrase on paper, I think that is still a paper wallet which you pretty have good knowledge about. But people only think of sites like bitaddress when thinking of creating a paper wallet.

True. It's just that a very very small minority(probably sub 1%) has the knowledge to create a paper wallet correctly. Though I'd like to think of myself as a decently(definitely not an expert-level) technical person, I still don't have THAT much of a confidence to create one correctly.

I agree, its usually not a requirement for everyone. However, theoretically it is more secure to create a offline paper wallet, or a offline wallet than use something like a hardware wallet. Despite, them being pretty good, and pretty sound they still have a way of attack. Whereas, paper wallets, and offline wallets are only ever compromised through user mistakes, usually upon creating them or losing the credentials.

So, although I do agree, it entirely depends on the needs of the person. If you are storing large amounts, then a offline could be the better solution. Its goal specific as with anything.

If you own two devices, you can initiate a transaction without your keys being exposed to an internet connection.
One device would hold the actual wallet; this should be an airgapped device.
The other would contain the watch only wallet, this does not have to be airgapped.

If you initiate a transaction on the watch only wallet, you can copy or scan the raw transaction into the other device for signing and then send it back to the watch only to be broadcasted.

You would of course still need to be extra cautious when making transactions, but the potential risk is reduced.

The hardware wallet has a distinct advantage: this forms a transaction within itself. Your keys never enter the PC's memory. Any other wallet will require you to enter your keys / phrase / password into your PC. And it can be intercepted.
The recipient's address can also be swapped. Viruses have become so wiser that they choose a visually similar address that will be swapped. If you are not careful, you can send crypto to someone else's address. The hardware wallet offers a check on the display. If you are attentive, it excludes the swap.

No. Chrome extensions are why people are getting hacked.

Please DO NOT key your private key into any website.

Storing your private keys offline doesn't make anything more secure. You'll probably be looking at making an air-gapped wallet in this case.

2FA is not perfectly bulletproof against malware attacks. There are many variants of malwares which seeks to exploit the user differently and the most common one is a clipboard malware which your 2FA won't protect unless you double check your transactions.

I don't want to use wallet extensions and if I have other wallets to use, I will not install any extension on my browsers.

Perhaps I am too paranoid about risks and I admit that I don't have skills to verify any extension. Consequently, I would prefer to make prevention as it is better than cure.

I have a fam that use metamask to store some BTC and he lost it all when using in crime browser, for someone who actually know about phishing and spywares he was so careful, well the fact is using wallet in browser add-on can never be 100% safe, when you start using that browser to go into different websites anything is possible

Fully agree.

I think paper wallets are very dangerous for newcomers. A lot people will just unplug the computer and generate their keys in some random website.
I have seen a lot of people here talking about losing their coins using paper wallets and asking for help here.

Hardware wallets are safe. They are not 100%, but you only lose your coins if you store your seed in your Gmail or something idiot like that. The vulnerabilities are ridiculous, like the "evil hacker maid", and will only happen in movies.

There are far too much more attack vectors in a paper wallet generation than in a hardware wallet.

Paper wallets are safe only if you know exactly what you are doing and make a lot of research before doing it. Hardware wallets are expensive now, they are not as cheap as they used to be (at least in my country) but they are the best option imo.

True. I think we should kinda stop mass recommending paper wallets to literally everyone though. Creating a paper wallet sure is easy as heck, but creating a paper wallet correctly and securely most probably isn't especially for those who barely know anything about security. Hardware wallets are still the better sort of 'mass recommendation' option in my opinion.

Making use of hardware wallet keeps the private key offline, but paper wallet and wallet on airgapped devices also keep private key offline. For convenience and frequently transactions, hardware wallet can be used. To hodl, paper wallet or airgapped wallet can be used, also hardware wallet is still highly recommendable for holding as well.

Chrome itself is a broswer, and online, chrome extension wallets like matamask wallet and myetherwallet wallet do not support bitcoin (correct me if wrong), also they are just web wallets, web wallets are most vulnerable in design, and private key is online.

Why checking balance on blockchain explorer? To even sum up the whole total balance, master public key will be required, inputting that on a website that can track your IP address or other such things will not be recommended, why not just check your balance on your wallet directly. Also, I have not seen how private key will be so necessary to check balance when you can do that on your wallet directly, or making use of watch-only wallet for the purpose.

Noncustododial wallet most likely not requiring 2fa like custodial wallets and exchanges. The noncustododial wallets that support 2fa (which is not compulsory) is also a way to protect the wallet in case, but there are other three ways to create a wallet on electrum that do not require 2fa, viz: standard wallet, multisig and cold electrum wallet with its watch-only. 2fa can help in security and safety, but reading the feeassociated with it is very important.

We store our valuable cryptocurrencies in various wallets. In this case, it is important to ensure the security of our wallet. I have come up with some points that can help you to secure your wallet:

1. Hardware Wallet
It is better to use hardware wallet because it is more secure than software wallet. Yes, we have to pay for this but if you think about safety of your assets, you'll be ready to buy hardware wallet like Ledger Nano S/ TREZOR.

2. Install/ Download Chrome Extension
We can prevent being hacked if we download and install chrome extension. Mew chrome extension and MetaMask chrome extension are available to install.

3. Bookmark Original Website
We can bookmark all the important/legit websites that we have to access regularly. We can use those bookmarked website safely without input manually.

4. Check Balance
It is not necessary to check our balance everytime by entering our private key. We can easily be able to check our balance and transaction from:

(a) https://etherscan.io/
(b) https://bscscan.com/
(c) https://tronscan.org/
(d) https://www.blockchain.com/explorer

At the time of transaction, we can use our private key. If possible, store private key offline.

5. Don't Trust SSL Only
Just because a website uses an SSL certificate does not mean that the website is completely secure. Buying an SSL certificate is not a complicated matter. We should double check the website before entering private key.

6. Don't Click on Attractive Offers
At the time of browsing, we see many interesting offers that we should not click on because no one will give you free money without doing anything. Sometimes we get such kind of shit offers on gmail/social media. Also, we should more conscious about downloading any app or file.

7. Enable 2FA
It is important to enable 2fa if our wallet serve this feature. We can use google authenticator, mobile number and gmail as 2fa method.

8. Free Wifi
We shouldn't use free wifi at all and by using free wifi, we can lose valuable personal data. Hackers can collect those data for entering your wallet.

Lastly, we should use our brain. Awareness can keep us safe on the internet.

"I might be wrong, please pardon my mistakes."