You are reading an excerpt from our free but shortened abridged report! While still packed with incredible research and data, for just $40/month you can upgrade to our FULL library of 60+ reports (including this one) and complete industry-leading analysis on the top crypto assets. 

Becoming a Premium member means enjoying all the perks of a Basic membership PLUS:

• Full-length CORE Reports: More technical, in-depth research, actionable insights, and potential market alpha for serious crypto users
• Early access to future CORE ratings: Being early is sometimes just as important as being right!
• Premium Member CORE+ Reports: Coverage on the top issues pertaining to crypto users like bridge security, layer two solutions, DeFi plays, and more
• CORE report Audio playback: Don’t want to read? No problem! Listen on the go.

Intro

The world of cryptocurrency attracts a broad array of participants, from seasoned experts in security encryption to novices captivated by tales of rapid financial gains. Regardless of one's background, the volatility of digital wealth underscores a critical need: securing one's assets. Below, we explore essential security practices tailored for cryptocurrency users and investors, aimed at mitigating risks and enhancing asset safety.

Mistake #1: Opting for Custodial Wallets

In the realm of cryptocurrency wallets, a fundamental decision lies between custodial and non-custodial options. Non-custodial wallets grant users sole ownership of their private keys, which are crucial for accessing their assets. This model affords greater security and privacy as it eliminates reliance on third parties to manage these keys. Conversely, custodial wallets, while convenient, pose significant security risks. If the third-party provider suffers a security breach, users' assets could be compromised. Moreover, custodial solutions often impose restrictions on fund access, potentially leading to loss or limited availability.

Recommendation: Prioritize non-custodial wallets to retain full control over your private keys, ensuring that only you can access your funds.

Mistake #2: Maintaining Wallets on Internet-Connected Devices

Online wallets provide convenience but open numerous security vulnerabilities. Devices connected to the internet, such as smartphones or laptops, are susceptible to malware, viruses, and phishing attacks. These risks can compromise wallet security and lead to potential losses.

Hot wallet attack vectors

• Computer hacks
  • Copy + paste bug
  • Screen tracking
  • Keyboard tracking
• Malware from plug-ins
  • Phishing (email and Twitter)
  • Give-away scams (typically Twitter)
• Fake URL/website
• Social engineering 
  • Exploiting customer help to obtain personal information or bypass security
  • SIM swapping

Recommendation: Minimize the use of online-connected wallets and consider alternatives like hardware wallets, which offer offline security for your assets.

Mistake #3: Inadequate Seed Phrase Security

The seed phrase, a critical element for wallet recovery, must be securely backed up. Common but insecure methods include screenshots, clipboard storage, or use in common notes apps, all of which are vulnerable to security breaches.

Recommendation: The suggestions below are a bit advanced. A huge percentage of “lost crypto” is due to the owner simply being phished or key mismanagement (losing your seed phrase). In both scenarios, THE OWNER is the issue. Not some thief with a wrench. Be honest with yourself about your own operational security, how reliable you are as a steward of the keys, and the lengths you’re willing to go to protect YOUR money. 

Many will be too lazy or say, “Well, it’s just X amount of dollars. It’s not that much and worth all this hassle.” However, you should protect your crypto now as if it were worth 20x its current value because that has happened repeatedly. That $10,000 turns into $200,000+ and is secured by a binder in a closet next to old receipts. 

Once your crypto stack becomes large enough that you would be upset if it all disappeared, you’ve waited too long! It’s now time to take measures to protect your stack.

• ​Keep duplicates- there’s a saying in some industries, “One is none. Two is too few. Three is key.” For incredibly important things, like a seed phrase/private key, always have duplicates to remove any single points of failure.
• Diversify
  • Now that you have multiple copies of a seed phrase, you need different locations to store them. Storing them all under your bed accomplishes nothing. Try to have two very different and distinct locations. A safety deposit box at a bank is a decent 2nd location.
  • Buy hardware wallets from different companies in case one goes bankrupt, gets exploited, or acts maliciously
  • Seed phrase storage - Do not label your seed phrase “Joe’s Crypto Password.” Be discreet. Do not make it obvious to anyone should they get access to it.
• Durable - Your storage locations need to be resistant to fires, floods, kids, pets, natural disasters, etc. Don’t just write it on a piece of paper and keep it in a drawer. People have lost tens of millions of dollars due to simple floods and pets. Securely back up your seed phrase by engraving it onto a durable medium such as stainless steel, which offers resilience against physical damage and environmental factors.
• Secret - This is a matter of personal preference (and well, really, all of this is) but keeping a low profile is better than not. Social media, your friends, people on Tinder, etc. do not need to know “when you got into Bitcoin” or “how much crypto you have.” It puts a target on your back, and you will be surprised how many people come reaching out after the next BTC all-time high. 
• Back-up plan - If you die, fall down a well, get divorced, etc. Private key custody is hard. Succession/inheritance plans are another wrinkle. Look into plans that fit your needs. Some services specialize in exactly this. 

Additional Safety Measures and Crypto Security

Most of these below, as well as much, much more, can be found here.

• Use 2FA (not SMS-based): 2-Factor Authentication (2FA) is used to ensure accounts are protected by more than a password but need an additional randomly generated code or device to grant access.
  1. How to Set Up Google Authenticator
  2. How to restore access to your accounts if you lose/destroy your device w/ Google Authenticator (2FA)
• Whitelisting of addresses is often used by businesses to ensure funds can only be sent to previously approved addresses. This forces a hacker to gain access to both the wallet and the mechanism that manages this list.
• Bookmark your favorite/most frequented sites
• Use a password manager
• Use burner wallets/addresses, especially when interacting with a new protocol for the first time
• Geographical distribution of these keys and/or participants to protect against physical attacks
• Cold storage
• A crypto vault has a built-in, predetermined delay when you try to move funds. This is also known as a timelock. It prevents cryptocurrency from being moved until a certain amount of time has passed.
• Yubi keys or other security hardware
• What to do if you signed a scam transaction
• Don’t link a device to your home address
  1. Buy with cash if possible
• Use separate email
• Have “crypto computer”
  1. Use a VPN 
  2. Use Brave or Firefox Browser
  3. Be mindful when you give a website or extension permission to access things like your camera, location, plugins, etc., in the future.
  4. Audit your Chrome Extensions: Remove extensions you don’t use, don’t need, don’t trust. 

Concluding Thoughts

For cryptocurrency investors, the integrity of security practices directly correlates with the safety of their investments. By choosing non-custodial wallets, avoiding cloud backups for sensitive information, reducing reliance on internet-connected storage, and securing physical backups of seed phrases, users can significantly enhance their digital asset security.

These steps, while requiring more effort than less secure methods, provide a foundation for maintaining and growing digital wealth with confidence. Each investor's approach should be tailored to their specific circumstances and risk tolerance, always considering the evolving landscape of cryptocurrency security challenges.