5 essential crypto security tips

1 - The first rule of crypto security, is you don’t talk about your crypto

It's hard to believe the film Fight Club (and the book on which it is based) is over 20 years old, yet its mantra is still so widely used. That’s because it makes a lot of sense. 

If you had a secret fight club, and you wanted it to remain that way, you wouldn't talk about it. The same is true of your crypto, if you want to protect it, don’t talk about it.

You might be tempted to post your wins on social media, for example, but stop and think about what good can come of it, other than a few likes? If you value your crypto, and consider that its future value will be even greater, why advertise your wealth?

Crypto is designed to enable trustless transfer of wealth, without sharing personal information, so you are not only shooting yourself in the foot by making your ownership public, you are also potentially putting a big target on your back.

If that didn’t convince you, take a look at this log of physical crypto attacks.

2 - Think of your crypto security as a chain. What is the weakest link?

If a business wants to know how tight their IT Security is, they can call in what is known as a Penetration Tester. The Pen Tester aims to find areas of vulnerability that have simply not been considered, to take an Ocean’s Eleven approach to gaining access by any means.

Though the stakes may not be quite as high, you need to think about your crypto security with a Pen Tester’s mindset and consider all links in your security chain, and how secure they are. 

Let’s say, for example, that you keep your crypto with a custodial service. This means they control the keys, and grant you access to your funds by familiar access credentials - username and password. Not ideal. NGRAVE recommends choosing a crypto hardware wallet for storage, but we appreciate it is a very common approach.

If you are comfortable using custodial services you should employ all available account security options, which means:

• Employing a really strong password that isn’t used anywhere else
• Enabling Two Factor Authentication (2FA) - Not SMS which is vulnerable to Sim Swaps
• Employing an Email Passphrase - this tells you email comms are authentic
• Whitelist your withdrawal addresses - this will guard against unauthorised withdrawals

Those four steps put up a pretty good first line of defense, but you undo all that good work if your thinking stops there, as your security chain extends further.

Ensure you keep a copy of your 2FA backup secured offline

When you set up your 2FA you are prompted to download back-up codes or a secret key. These will enable you to gain access if you lose your phone. If someone gets access to this information, they are one step away from accessing your account.

Use an encrypted email address like Protonmail that is just for crypto

Weak security on the email address associated with your account could allow hackers to access it, and social engineer access to your custodial account. It would also give them access to any cloud storage, and whatever you might store there.

Employ good security on your mobile phone

If like most people you live your life through your phone, then you’ll access your crypto that way. But if you aren’t thinking about the security of your phone, then it is the weakest link in your security chain, as it is likely that everything a hacker might need to access your custodial account: your email, 2FA, cloud storage, password manager - are all on that phone.

You can mitigate the security issues that come with custodial services like centralised exchange by being in control of your Seed, using a crypto hardware wallet - like the NGRAVE ZERO - but even then, the risks don’t fall to zero, as where you store your Seed becomes your biggest point of failure. 

Where is your Seed Phrase stored? 

If it is online, your security chain has a potentially fatal flaw. So the golden rule of Seed Phrase security is to store it offline.

You may then think ‘I have it covered, I wrote it on a piece of paper’ - but how secure is that? Paper lacks the durability for something that important and is easily spoiled by damp, mice or sunlight, let alone fire risk. 

Think about a more durable way of storing your Seed phrase, such as engraving it in a stainless steel plate. NGRAVE GRAPHENE uses a revolutionary two part system for engraving your Seed Phrase on stainless steel, which reveals it only when both parts are combined. That might sound extreme, but what price do you put on your crypto’s security? 

A Pen Tester thinks like a hacker - that is often where they are recruited - and that is how you need to think about your crypto security. 

This is, in fact, great general advice for the Internet of Things (IOT) world in which we live, where everything from your doorbell to your fridge is online, and therefore presents a potential threat to everything you keep online, from wealth to your identity.

3 - Don’t treat crypto like regular money; Invest in a Crypto Hardware Wallet

One of the best crypto security tips is to avoid the mistake of treating it like regular money - it isn’t. Only by taking the time to understand the differences between regular money (fiat money) and crypto, will you appreciate the fundamental value of being in control.

Banks custody your fiat money; they look after it, and grant your privileged access. This trust-based relationship is at the core of modern centralised money, and what crypto - with a decentralised model - was created to fix. 

The NGRAVE Academy is a great place to learn more about this, but it boils down to one key phrase: Not your keys, not your coins. This means that the safest way to store your crypto is by being in possession of the information that ultimately enables it to be spent - Private Keys, represented in most modern wallets by a Seed; a collection of 12-24 unique words.

The ultimate way of exercising that control in a secure and convenient way, is by using a crypto hardware wallet like the NGRAVE ZERO.  

That fundamental logic should be enough to convince you to approach crypto security in an entirely different way to managing regular money, but there are good reasons to retune your thinking.

Banks Insure Funds, Exchanges Don’t

Traditional money functions with a trust model. That trust extends to regulation and compliance, which includes measures to compensate for theft of funds, up to a maximum amount, depending on your location. 

This isn’t the case with custodial crypto services - like exchanges or wallets - or non-custodial Defi protocols. There is no safety net. Some exchanges maintain an insurance fund, to cover losses from hacks, but that isn’t compulsory. Your funds are at risk.

Cryptocurrency Transactions Aren’t Reversible

The introduction to the Bitcoin Whitepaper - its blueprint - states its objective is to address the Double Spend problem associated with centralized money. Double Spend refers to the risk that funds can be spent twice, which happens when card transactions are reversed. 

Bitcoin provides ultimate settlement finality; even if a transaction is known to be fraudulent, it cannot be reversed. Having that understanding at the front of your mind should help you treat your crypto with the appropriate care and ensure security is a priority.

4 - Don’t treat your crypto security like a box-ticking exercise

Security of any kind is like an insurance policy. It is there to prevent something unlikely, but potentially very expensive. A good example is a house fire, which thankfully, most people will never experience in their lifetime, but will still devastate lives. 

Because the outcome is hard to imagine, it is too easy to become complacent and see fire safety as a box-ticking exercise, because hey, what are the chances?

It is a very common mistake to regard your crypto security - and by association general internet security - in the same way; ticking a box and moving on. 

Unfortunately, your internet and crypto security are a moving target, which needs regular review. We’re not suggesting that it dominates your every waking moment, there should be a sensible middle ground. Here are some suggestions:

• Don’t use stale passwords; it is good practice to update them periodically.
• Check sites like Have I Been Pwned to see if your details are in a data breach.
• In the same way, browsers like Chrome will indicate if login details have been compromised and suggest password updates.
• Make sure that you are running the most secure version of your operating systems & software, patching any vulnerabilities; the same with virus software.
• Think about how/where you’ve saved your Seed Phrase; has anything changed in the intervening time that might make it less secure?

5 - Never, ever, share your Seed Phrase

Last, and by no means least, is the most important yet simplest piece of crypto security advice. Never, under any circumstances, share your Seed Phrase. There is absolutely no legitimate reason for you to share it with any service. No ifs or buts.

Hackers are sophisticated at both a technical and psychological level. Scams are designed to suspend your critical thinking, with a combination of incentives, urgency and fake legitimacy, to exploit weaknesses in how our brains are wired, known as Heuristics. (See this report from the UK Office of Fair Trading for light bedtime reading: The Psychology of Scams: Provoking and committing errors of judgement).

Scammers will try to catch you off guard, and like a door-to-door salesman, get a foot in the door, in order to disarm any suspicion.

The best defense against sophisticated attempts to con you out of your crypto is zero tolerance. Never share your Seed - period. If you are asked for your Seed, it is a scam.

Owning cryptocurrency is empowering, but you can’t take full responsibility for your wealth, without being fully accountable for its security. Though our list of essential crypto security tips might have left you feeling a little fearful, good crypto security is not about fear, but peace of mind.