How you can avoid attacks on your crypto wallets.

[r_victory]

I enable as many security features as possible, 2FA, email confirmation (if available), long password with a mix of characters, numbers, and letters. Nowadays, attacks are becoming more and more sophisticated, and we need to be prepared for this.

[kontroll]

Usually a good idea to make ones thread model explicit in conversations like these. Are we only concerning ourselves with fund-loss incidents (obviously a primary concern either way) or also with privacy and for example not having our identity tracked and correlated with account addresses?

For privacy-conscious folks, I think it's a great idea to look into what your wallet is actually doing and what data it's sharing with whom. A lot of reputable wallets send out a lot more data than you'd think! This can also give you heads up when wallets are dynamically updating and loading code online outside of expected app updates (which is a what we call "supply-chain security risk" and relevant for your funds being SAFU).


For browser wallets

• You can open Developer Tools (Ctrl+Shift+J or F12) and look under the Network tab to inspect network activity
• Note that it's not guaranteed that all connections show up here. There are somewhat obscure channels extensions can use to have network activity not obviously show up here
• For browser extensions, you can open the inspector via the Debugging section of either Chrome or Firefox

For any reasonable wallet

• Any non-browser wallet should have a way to configure a proxy. You can set it up to proxy all requests via tools like mitmproxy or burpsuite to get a full insight into network activity
• The same approach works for browser wallets and is more certain to capture all requests
• If the wallet does not have any way to configure proxy for network connections, that should be a major red flag in itself
• If you're comfortable reading code or like a challenge, try to inspect and verify the source code. Source code not being available or readable are also red flags.

For unreasonable wallets

• First off, again, try to avoid wallets that give you trouble with the above approaches
• You could use a DNS server like pihole (or whatever "VPN DNS" app is good for mobile these days). Will not work if the app is sneaky using DoT/DoH
• You could force-use a transparent proxy and even intercept TLS connections if you roll up your h4x0r sleeves

Would also recommend checking out Konkret Wallet, if you're on the lookout for a safe browser wallet for Ethereum/EVM/ERC tokens.

[ZAINmalik75]

What do you mean by reset? Are you referring to the factory reset or reinstalling Windows whenever a virus is found? I do think that can be a solution if the virus is located in our OS drive, but I don't think it will prevent a virus from putting itself on another drive, and if we're reckless, we open it after we install a new Windows, which means we get infected again. Obviously, this is just a simplification and there are many ways to prevent this.

Checking the start-up list is a good thing to do once in a while; I agree with that. Especially if you regularly install or download new files.

Most of the people involved in crypto watch or use pirated movies and softwares they somehow click on spam links and some windows just opens automatically and download some files that's not new and later a small bug like a clipboard virus that changes copy paste item in clipboard.

I thought viruses like these which are easy to kill can be dealt if we reinstall our window or reset it, both are same, only the softwares will be removed but the media files will remain safe. If virus is in those media files then it won't solve the problem.

[Z-tight]

I enable as many security features as possible, 2FA, email confirmation (if available), long password with a mix of characters, numbers, and letters. Nowadays, attacks are becoming more and more sophisticated, and we need to be prepared for this.

Your methods are not bad, but take note that a password only protects your wallet locally and not from online attacks, that is why the most recommended way to avoid attack is to store your funds in cold storage. By cold storage i mean off the internet, either in an airgapped wallet or a hardware wallet.

[Faisal2202]

In this crypto world, ensuring wallet security is essential for cryptocurrency users. Therefore, we should protect our private keys and use strong passwords. Also, 2FA, and following proper backup methods are very important. All the points you have raised are important but there are many more techniques that if followed will always keep your wallet safe. Personally I don't like to use vpb because using it requires giving device access which can be dangerous for you.

I used Kaspersky antivirus for my laptop in the past, but I lost quite a few important files. Besides, I use my personal gmail very seriously and always delete unnecessary gmail and do not enter the links there. I use extra disk to make my wallet more secure. The most secure way to use a hardware wallet is if you want.

You are right, we should keep our keys and seed phrases save, the best way is to encrypt our keys and seed phrases using any encryption method and store it in safe place but all of the crypto bros suggests not to store keys on computer at all.

Which is a good approach but I think keys are more safer in devices then they are on paper because if we store it by encrypting on usb or memory card we can still recover data from it even it damages but if paper damages it will be hard to recover. Speaking of anti viruses, they are not good imo, I just use defender in my windows.

[Forsyth Jones]

You are right, we should keep our keys and seed phrases save, the best way is to encrypt our keys and seed phrases using any encryption method and store it in safe place but all of the crypto bros suggests not to store keys on computer at all.

Which is a good approach but I think keys are more safer in devices then they are on paper because if we store it by encrypting on usb or memory card we can still recover data from it even it damages but if paper damages it will be hard to recover. Speaking of anti viruses, they are not good imo, I just use defender in my windows.

I agree with what you said in part, it's known that removable media can be damaged in the same way as paper and either it becomes completely useless or the data saved on it becomes corrupted.

A good approach is to have both encrypted backups and paper backups (preferably also encrypted or with your funds stored in a hidden wallet with bip39-passphrase).

Bottom line: do both, any digital backup should be done in an environment, preferably offline to prevent potential malware from capturing sensitive information.

[bayu7adi]

I enable as many security features as possible, 2FA, email confirmation (if available), long password with a mix of characters, numbers, and letters. Nowadays, attacks are becoming more and more sophisticated, and we need to be prepared for this.

but unfortunately, to hack your crypto wallet... the malware only needs a copy of the private key... as long as you store this private key in a careless place, even viruses that automatically copy paste data will easily hack your wallet without knowledge of your security layer....

the solution is, as little as possible do not involve the internet on the device you use to store the private key... the less internet you use, the less likely the hacking will occur through malware... because basically the way malware works remotely is because of the availability of an internet network...

If it is for data security cases from forum accounts, social media accounts or other accounts, the method above is the maximum security that I also apply.

[Aanuoluwatofunmi]

To avoid being under attack with the kind of wallet we are using in cryptocurrency, we must be able to follow on some safety tips for maximum security of our assets.

1. Avoid centralized exchange wallets.
2. Use a non custodial wallet.
3. Don't leave your private keys open to third parties.
4. Don't post your wallet address anyhow online.
5. Store your seeds in a private place only accessible to you.

[bayu7adi]

1. Avoid centralized exchange wallets.
2. Use a non custodial wallet.

I know this is strange, but my security mechanism is actually very weak when storing assets in a non-custodial wallet, because maybe I'm the one who has a security problem here... I don't justify storing money in an exchange wallet, because there is also a risk of loss there... however, for someone who is not even confident in their ability to store private keys safely, maybe using an exchange wallet is not bad either... they also have a security system, right?

Or if you want to keep storing in a personal wallet, my recommendation is to use several wallets to store the crypto assets you have... this is to minimize the occurrence of hacking on one large bucket that contains the largest balance....

3. Don't leave your private keys open to third parties.
4. Don't post your wallet address anyhow online.
5. Store your seeds in a private place only accessible to you.

Keep the private key connected to your wallet away from the internet, it is a fairly effective practice... considering that all hacking via malware (which often happens) is sending data online... that way when any of our data has been leaked and there is an active internet network that can send the data to someone we don't know, that's the end of our story...

[Faisal2202]

I agree with what you said in part, it's known that removable media can be damaged in the same way as paper and either it becomes completely useless or the data saved on it becomes corrupted.

A good approach is to have both encrypted backups and paper backups (preferably also encrypted or with your funds stored in a hidden wallet with bip39-passphrase).

Bottom line: do both, any digital backup should be done in an environment, preferably offline to prevent potential malware from capturing sensitive information.

TBH I did stored my phrase on paper but don't know why even after storing it away in a locker safe, I felt unsafe, while I stored it in my phone, I only felt unsafe whenever I take it outside, or travel. But it is just the feeling the reality is storing on paper is better but if we don't want other to easily read the content we should do encryption, we should not use third party tools to do the encryption, because to mix the words we can use any simple encryption method, which we can do by using our mind, pencil and paper.

Because sometimes these third party tools also stores our data, so if we are giving our words to it, to encrypt, it is like giving away our words. Better to be on the safe side everytime, as we know usually people lost their funds by being more careful.

[Cryptsafe]

OP, I appreciate your efforts in putting this writing together, and I must commend your research insight as it is very educative but I would say that VPN has nothing to with crypto wallet safety, you can talk of VPN for location safety which I would agree but to say it prevents attack on your wallet, that is what I am yet to understand from your point because I am very sure of that.

I will say that the majority of the attacks on wallets are as a result of data breaches through links and apps downloaded from sites we have no idea and knowledge of. We just ought to limit the way we click links and ads sent to us, and discard unwanted and unsolicited messages in our inbox. Blocking websites and contacts that send us such messages would help minimize the rate at which we get exposed to these unwanted messages that are potential threats to our wallets and personal information.

[Report]

My experience when playing in airdrop is that there are a lot of wallet and platform application installations so that there is a possibility of malware in each airdrop project.
I have a trick that may be a bit complicated to do because it requires 2, 3 or even more devices to install the airdrop application.

The first device is for storing cryptocurrency assets.
The second device is for installing various airdrop applications.
The third device is for real work, etc.

[bitbit97]

I have a following question, what will be your actions if you suspect you were hacked, expect to be hacked, or you have already noticed that funds from one of your wallets are stolen ?

1. How to get passwords from password manager, if there is a chance that key stealer is installed? Once you login to import passwords, you become 100% vulnerable.
2. How to access wallet, if locked wallet was only thing that hold hacker from making a transaction? Once you unlock wallet, funds will be send instantly.
3. How to reinstall system without losing everything?
4. How to import information without importing third party software with it?

[Roseline492]

I enable as many security features as possible, 2FA, email confirmation (if available), long password with a mix of characters, numbers, and letters. Nowadays, attacks are becoming more and more sophisticated, and we need to be prepared for this.

2FA is one in a million security I don't joke with having because it gives a good security system that third party cannot in a anyway hacked the account of the user, except the person lost the smartphone that has the 2FA because having the smartphone is also applicable to having access to the 2FA so there is another security after the installation of the 2FA which is protection of the phone to avoid theft. Another security I usually use is the cellphone verification that requires the use of code before being authorized on the account.

[SamReomo]

The best approach to avoid crypto wallet attacks is to save your crypto on offline and air gapped systems and go for cold wallets. That is the safest way to keep crypto currencies. However, If someone wants to keep crypto currencies in a system which gets online and needs those crypto for trading or for something else then that person should never ever install any software and that person should consider moving to open source operating system like Linux.