Wallet Security
Complete Guide to Crypto Wallet Security
A crypto wallet is not a place where you “store” cryptocurrencies, they always exist on the blockchain. A wallet is a tool that holds your private keys, the passwords that prove your ownership and allow you to sign transactions. Whoever controls the private keys controls the funds.
Hot vs Cold Wallets
Hot Wallets (Online)
Connected to the internet, suitable for everyday use:
- MetaMask, the most popular Ethereum browser extension wallet; supports all EVM chains
- Trust Wallet, a mobile wallet, supports 70+ blockchains, owned by Binance
- Phantom, Solana ecosystem, extension and mobile version
- Rainbow, Ethereum, user-friendly, excellent UX experience
Risks: Private keys are on a device that is online. Vulnerable to: malware, keyloggers, phishing, compromised browser extensions, and browser exploit attacks.
Cold Wallets (Offline)
Private keys never leave the offline device:
- Ledger Nano X / S Plus, industry standard, supports 5,500+ cryptocurrencies
- Trezor Model T / Model One, fully open-source, no closed-source chipset risks
- Keystone Pro, air-gapped device, communicates exclusively via QR codes
- Coldcard Mk4, Bitcoin-only, for users who want maximum security
Air-gapped solutions (Keystone, Coldcard) never establish a direct connection with a computer, transactions are transferred via QR codes or microSD cards. This eliminates the USB attack vector.
Hardware Wallet Comparison
| Feature | Ledger Nano X | Trezor Model T | Coldcard Mk4 |
|---|---|---|---|
| Price | ~€149 | ~€179 | ~$150 |
| Open Source Firmware | Partially | Yes (fully) | Yes |
| Supported Cryptocurrencies | 5,500+ | 8,000+ | Bitcoin only |
| Bluetooth | Yes | No | No |
| Air-gapped Option | No | No | Yes (microSD) |
Seed Phrase: Golden Rules
The seed phrase (mnemonic) is a list of 12 or 24 words that represent your master key. From it, every private key for every cryptocurrency on every chain can be regenerated.
Storing the seed phrase:
- Never digitally, not in emails, photos, cloud storage, or text files
- Physical copy on paper or metal (Cryptosteel Capsule, Bilodeau Bilodeal)
- Minimum of two physical copies in different locations
- Optional passphrase (25th word) for an additional layer of protection, stored separately from the seed phrase
- Never enter the seed phrase online except during initial hardware wallet configuration
Multi-Signature Setups
A multi-sig wallet requires signatures from M of N keys to execute a transaction. Typical setups:
- 2-of-3: 3 keys, 2 required for a transaction, losing one key is not fatal
- 3-of-5: For larger institutional amounts, 5 keys distributed across different locations
Tools: Gnosis Safe (Ethereum EVM), Specter Wallet (Bitcoin), Caravan (Bitcoin, desktop).
Phishing and Social Engineering Attacks on Wallet Users
The Ledger data breach in 2020 exposed the personal data of 272,000 customers. This data was used for targeted phishing: users received emails that looked like official Ledger communication, asking them to “update firmware” or “verify seed phrase.” Ledger never asks for your seed phrase.
Rules for phishing protection:
- Never enter your seed phrase on any website
- Never install firmware outside official channels (Ledger Live, Trezor Suite)
- Double-check the URL before any interaction with your wallet
- Use bookmarks for crypto sites, never click links from emails
Your seed phrase is the only thing standing between an attacker and your funds. Guard it as your greatest secret.