How can I safely store and trade Bitcoin and other crypto currencies?

Question

How can I safely store Bitcoin?

Exchanges require me to deposit to trade, is this safe? If I can't trust exchanges, what is the best way to safely store my cryptocurrency and transact it?

Answer 1

There are several ways to store cryptocurrencies, so let's break them down by use-case and safety-level.

Exchanges

There are, broadly speaking, two types of exchanges. Centralized exchanges, such as Bitfinex, Bittrex, Kucoin, etc., and decentralized exchanges such as Etherdelta and Switcheo.

Trading on a centralized exchange requires you to deposit cryptocurrencies before you can trade them. In this regard, they function as custodial services, and thus come with a very high level of risk. If the exchange operators steal your coins, or if the exchange gets hacked, your funds may disappear, and there may be very little you can do to get them back.

In general, one should only store coins that they are actively trading on an exchange. To reduce the risk of loss via theft or fraud, balances that are not being actively traded should be withdrawn to one of the wallets described below.

Decentralized exchanges are less risky, as they allow you to deposit coins as part of your trade, and the proceeds from a trade will typically go directly to your wallet. However, certain risks still exist, such as:

• The site acting as the front of the decentralized exchanges could be compromised, and work to steal your keys
• perhaps the contract is a scam and will take your incoming coins, and not pay out the proceeds of the trade.

These risks can be reduced by:

• Using a temporary wallet for trades
• Only storing coins you are trading in that wallet
• Ensuring that you are using the correct decentralized exchange (check the domain, check the contract address).

Personal Wallets

Personal wallets also come in a number of flavours. We will break them down into three broad categories:

1. Hosted Wallets
2. Local Hot wallets
3. Cold storage, or offline wallets

Hosted Wallets

Hosted wallets, such as exchange wallets, do not give you direct access to your keys. If the service is down, compromised, or shuts down permanently, you can no longer access your coins. Do not use a hosted wallet unless you are using another service offered by that company, such as trading. Ensure you withdraw your funds to a more secure wallet when you complete your exchange business.

Local hot wallets

Hot wallets, in general, refer to wallets where the keys are stored on an Internet-connected computer. They are designed to quickly process outgoing transactions. Many services offer a hybrid hosted-hot-wallet, such as btc.com and blockchain.info. The provider of a hosted-hot-wallet will provide you seed words or private keys which can be used to recover your coins if the service goes down. Hosted-hot-wallet services also offer ways to easily access your wallet, such as a regular email/username/password account system, mobile apps, 2FA, etc.

Hosted Hot wallets come with several risks. You must trust that:

• the initial key generation is not backdoored.
• they are not storing unencrypted copies of your keys.
• they will not steal your funds when you are using their web interface/mobile apps, which would naturally need access to your keys to make any transactions.

You are also vulnerable to phishing attacks for the account credentials, domain takeovers, and hacks of their systems, which may be compromised and made to serve malicious versions of their apps that would steal your keys or otherwise drain your accounts.

Many people use these services for their ease-of-use, and a number of (so far) reliable ones exist. Always be careful when using such a service, and follow basic security measures such as ensuring you use strong passwords, enable 2FA, confirm the website address is correct, use a trusted computer to access the service, etc.

Some hot wallets, such as Bitcoin-qt, Electrum, etc., allow you to run them locally on your own computer. These wallets generate and store keys on your computer, and will typically only require a password to unlock the wallet. They do not rely on centralized servers, and instead may either connect directly to the bitcoin P2P network (or the network of your altcoin), or to second layer P2P networks such as Electrum servers. While generally more secure than a host hot wallet, these have risks such as :

• your computer being compromised and the keys stolen
• downloading a malicious version of the wallet client that gives you non-random keys, or steals keys after generating or importing them.

To avoid such attacks, you should only use a trusted computer, and verify the signature and hashes of the wallet client software after downloading it.

Cold storage

Cold storage refers to the most secure type of wallet where the keys are not stored on an Internet-connected computer. There are essentially two types of cost storage wallet; paper, and hardware.

Paper wallets usually just consist of a private key and public address printed out or otherwise stored on a physical medium that is not connected to a computer or the internet. Creating the private key and public address, in an ideal scenario, would use a peer-reviewed, vetted bitcoin address generator on an air-gapped, recently formatted, trusted computer with a cryptographic-quality random number generator. These requirements are occasionally difficult to meet, but are doable by most people given enough effort. Once generated, coins can be transferred to the address, and the private key can be stored on a piece of paper or a flash drive, or inscribed in a metal sheet, and then stored somewhere physically safe, such as a bank vault, home safe, or even split up into pieces and stored in multiple locations.

These wallets are typically extremely safe, since if generated correctly, they are impossible to compromise without physically compromising the location where the private key is stored. However, they are cumbersome to use, as the key must be physically retrieved and imported into a software wallet before a transaction can be signed. The signing itself can be done on an offline computer to minimize risk, with the signed transaction verified and broadcast by a separate, online computer.

Offline wallets are typically used to store coins for a long time, without the intention of regularly spending them. Coins can be sent to the paper wallet at any time without retrieving or using the private key.

Hardware wallets, such as the Ledger and Trezor, are newer takes on cold storage. These are essentially tiny computers than generate and store the private keys, and sign transactions on the device itself. You use them by connecting them to a computer, which then passes an unsigned transaction to the device. The device will then display the amount and destination, and attach the signature after you confirm the details are correct. The signed transaction is then sent back to the computer, and the private keys never leave the device.

The attack vectors here are limited to:

• a device flaw
• stealing the device + pin
• stealing the seed words for the device (make sure you keep these very safe)
• tricking someone into signing a transaction without verifying the outputs.

The wallet devices themselves are currently considered quite safe (although an attack was recently demonstrated and patched by Ledger). Provided you choose a strong PIN and store the seed words safely, hardware wallets are the safest, most user-friendly way to store cryptocurrencies, offering a large advantage over hot wallets and exchanges, and even paper wallets in terms of ease of use. However, hardware wallets currently do not support all cryptocurrencies, and one may have to resort to paperwallets + hardware wallets to cover their entire portfolio.

General Advice

This advice applies no matter what wallet you opt for, and extends to general computer security as well

1. Use a trusted computer - Make sure you don't install any untrusted programs that may contain keyloggers or other malware. If paranoid, get a separate computer for crypto use, and format it regularly.
2. Verify the hashes and signatures of any clients you download. All trustworthy crypto software comes with known-good hashes published on the website along with the download links, and often with signatures from trusted developers/community members. Verifying these hashes and signatures helps ensure the program you downloaded was not been tampered with.
3. Check where you are downloading a program from - Make sure it is the official site, as many phishing clones exist. Check the domain for character swaps (l instead of i, etc.), check the extension, make sure it uses https, and use a computer you trust.
4. Use strong, random passwords/PINs for wallets and accounts - Get a password manager, no other way to say it really.
5. Enable 2FA everywhere you can. Ideally, use time-based 2FA where available, instead of SMS-based ones, and use a device you trust for saving the 2FA codes.
6. Always verify the transaction address and amount before sending. Malware exists that will silently change a crypto address after you copy it, and before you paste it into the wallet. Verify the address before sending. Many wallets, such as hardware wallets, Bitcoin-qt, Electrum etc. offer a preview function before signing or broadcasting the transaction. Use this feature to ensure the address and amount matches what you entered.
7. 99.999999% of the time, anything that offers you free BTC, offers to mine BTC for you, offers to double your coins, etc. is a scam - Don't fall for it.
8. Make backups of your seed words/wallet files and verify them. Computers or hardware wallets can break, and having a backup is essential. Hierarchical Deterministic wallets, aka HD Wallets, allow you create a long-lived backup that can restore addresses and keys generated after the backup was taken. Non-HD Wallets, such as bitcoin-qt in non-HD mode, must be backed up every time you generate a new address. If you restore an old backup from a non-hd wallet, you will lose the value of cryptocurrencies received after the backup was created.

Answer 2

Go read Raghav's answer.

Here's a shorter answer that amounts to the same but may be more readable if you are in a hurry.

Exchanges require me to deposit to trade, is this safe?

No, you should

• minimise the quantity of cryptocurrency you put in their hands
• minimise the time it is in their hands

If I can't trust exchanges

They occasionally get hacked, go out of business, abscond or fail in a variety of ways.

what is the best way to safely store my cryptocurrency

In cold storage or an offline wallet.

and transact it?

To exchange some amount of cryptocurrency into some other currency you are probably safest using a large reputable exchange - but I wouldn't store anything there any longer than is needed to perform the transaction.

For other types of transaction, a hardware wallet is probably best.

Answer 3

Your wallet stores the secret (or private) key and your public address to interact with the blockchain securely. There are two kinds of wallets for storing keys:

Cold Wallet (wallet which is not connected to internet):

Cold wallet is an offline wallet provided for storing bitcoins. With cold storage, the digital wallet is stored on a platform that is not connected to the internet, thereby, protecting the wallet from unauthorized access, cyber hacks, and other vulnerabilities that a system connected to the internet is susceptible to.

The most basic form of cold storage is paper wallet. A paper wallet is simply a document that has the public and private keys written on it. The document is printed from the bitcoin paper wallet tool online with an offline printer. The paper wallet or document usually has a QR code embedded on it so that it can easily be scanned and signed to make a transaction. The drawback to this medium is that if the paper is lost or destroyed, the user will never be able to access his address where his funds are.

Another form of cold storage is a hardware wallet which uses an offline device or smartcard to generate private keys offline. The device looks and functions like a USB, and a computer and chrome-based app are required to store the private keys offline. Like a paper wallet, it is essential to store this USB device and smartcard in a safe place, as any damage or loss could terminate access to the user’s bitcoins. Two popular hardware wallets are TREZOR and KeepKey. These are expensive to buy.

Another form of cold storage is offline software wallets on desktop or mobile. They are mostly offline and pretty secure as long as your computer is not hacked. Electrum, Exodus and Armory are often quoted as the best offline software wallets in this category.

Hot Wallet(wallet that is connected to internet):

Private keys stored on a hot wallet are connected to the internet are vulnerable to network-based theft. These wallets are known as hot wallets. Here all the functions required to complete a transaction are made from online device. The wallet generates and stores private keys; digitally signs transactions using private keys; and broadcasts the signed transaction to the network.

It is considered "unsafe" because hackers have easier access to this than a cold wallet. So a minimal amount is stored on a hot wallet. The exchanges are the type of hot wallets. Examples: Coinbase and Blockchain.info

Generally as a rule of thumb you should only leave as much money on your hot wallet as you would with a leather wallet that you’d keep in your pocket. Think of it this way, if you were held at gunpoint while holding a leather wallet, then you’d only lose that money in your pocket, and not your entire bank account. If you keep all your money in Coinbase it’s as if you are walking around town with all your money in your pocket.