I want to set up a website that needs an online bitcoin wallet (able to deposit and withdraw at any time). Would it be better to use the blockchain.info's infrastructure through API commands or should I set up bitcoind on my own server?

The problem with using blockchain.info's API is that I can't use commands (such as withdrawing) while having 2FA enabled or other security measures (please correct me if Im wrong).

How can I make the website as safe as possible with blockchain.info's api?

In short: I prefer not to store the private keys myself. On the other hand I also dont want to provide all credentials to blockchain.info in a file on the server that can't be encrypted.

1 Answer 1


Both options, bitcoind and blockchain.info API are equally vulnerable.

When the attacker gains to access to your server, they can empty the hot wallet through an API call, regardless if they or your server has access to the private keys. This API call can be blockchain.info API call or bitcoind JSON-RPC API call.

The best practices to strengthen a bitcoin service against server compromising attacks

  • Use separate hot and cold wallets, only manually top up hot wallet from the cold wallet. You will lose the ability to withdraw everything at any time, without manual interaction from the team, but this is the only way to prevent losing everything at once.

  • Encrypt your server and use bare metal servers, so that your server is protected against physical attacks and malicious hosting provider attacks. You can only put relevant config files containing the API tokens to the encrypted partition and symlink the config file to the right location after manually decrypting the server on boot. This way anybody gaining the physical or service port access to the server is less likely to gain withdraw ability.

Here are some other best practices for operations security.

  • Thanks a lot for taking the time to answer my question. I have enough information to make a decision. Nov 18, 2014 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.