How to protect your crypto from hacks

What has intensified investor pain further is the unabated cyber-theft that has drained billions of dollars from crypto holders’ accounts. Since crypto transactions are usually irreversible, stolen coins are nearly impossible to reclaim.

Cybercriminals pilfered roughly $4.5 billion worth of digital currency in 2021, more than twice the 2020 total. In the first half of this year alone, nearly $2 billion worth of crypto has been lost to hacking, clocking a 60% jump in such instances.

Crypto theft remains a growing problem. As more investors turn to digital assets for wealth creation or to diversify their portfolios, learning how to protect crypto holdings has become a crucial part of investing. Here’s your essential guide to keeping your crypto safe.

What makes crypto vulnerable to hackers?

Cryptocurrencies live on the blockchain, a form of digital transaction ledger. Since crypto transactions are decentralized, there are no intermediaries to supervise them. Motivated hackers with sophisticated knowledge of blockchain technology can exploit that by finding weaknesses in the safety mechanisms of crypto exchanges and online crypto trading platforms, as well as investors’ often poor understanding and implementation of safety tactics.

“Crypto vulnerabilities could be caused due to lack of security awareness or failure to employ security standards such as multi-factor authentication,” says Joe McGill, an investigator at TRM Labs, a blockchain intelligence company that helps governments and financial institutions to fight fraud, money laundering and financial crime.

Malicious links and software can also make crypto vulnerable. If clicked or installed, they could compromise sensitive information, notes McGill, who is a former U.S. Secret Service and Postal Investigator.

Phishing is a leading cause of theft in the crypto industry, just as it is in the traditional finance world. “Scammers post fake websites posing as popular brands in an effort to trick users into connecting to malicious contracts or steal personal financial information,” say McGill.

More recently, account takeover, or ATO, attacks have grown increasingly popular. An ATO is an automated scam in which criminals gain access to online accounts via bot-driven hacking techniques, such as credential stuffing or credential cracking.

Over the last six months, “more than 100 NFT projects have been targeted, resulting in the loss of millions of dollars in crypto assets,” says McGill. “The goal of the ATO attack is to completely control accounts of popular brands and redirect users to fake websites to either drain crypto in wallets or steal seed phrases.” 

A seed phrase, or recovery phrase, is a list of 12 to 24 words that can be used to access stored crypto—more about that later.

What’s the best way to store crypto?

Crypto investors have a few options for storing their coins and private keys (the alphanumeric access keys to your wallet addresses, or accounts). These options include custodial wallets, cold wallets and hot wallets.

• Custodial wallets are, for many investors, the default storage option. These wallets are held by third parties, like crypto exchanges. “Those exchanges control the private keys to the account and require trust between the users and a third party,” explains McGill.
• Cold wallets are offline hardware wallets. They’re considered one of the safest ways to hold cryptocurrency. A cold wallet is an external storage device, like a USB drive, and it is not connected to the internet.
• Hot wallets, on the other hand, are available as desktop, mobile and web-based apps, and they’re connected to the internet.

“With non-custodial wallets, users have full control over their crypto,” notes McGill. “There is no third party that has access to a user’s account information unless specifically granted by the user.”

Or if your account information has been misplaced and ended up in the wrong hands.

How to keep your crypto secure

Offline crypto storage is widely regarded as they safest option, used both by individuals and exchange platforms to secure their crypto. Since your crypto is stored offline, it’s out of reach for hackers and thieves.

Whether your coins are held privately or on a crypto platform, the following measures are key to keeping crypto criminals at bay:

• Switch to multi-factor authentication: McGill recommends disabling SMS text messaging for two-factor authentication. Security experts argue that text messages are vulnerable to hijacking. In a research project, security researchers showed how hackers can exploit the flaws in the cell network to intercept people’s text messages, then use that information to reset the password to the Gmail account associated with their crypto account—effectively gaining control of the account holder’s wallet and the cryptocurrency stored within. McGill also advises crypto holders to instead “utilize multi-factor authentication [MFA] tools such as Google Authentication or a physical key such as Yubikey [a hardware authentication device].”
• Keep your seed phrase a secret: Your seed phrase is an access key to your crypto wallet; it allows you to access your blockchain assets even if you lose the hardware that holds your private keys. Never store your seed phrase or personal information on your computer or take screenshots on phones, since both devices can be accessed by skilled hackers, says McGill. The seed phrase—a unique list of words generated by your crypto wallet—is the most vital piece of the security of your cryptocurrency. Sharing your seed phrase with others, accidentally or intentionally, is akin to handing someone your debit card and PIN code. Using your seed phrase, a crypto thief can gain access to your crypto assets and drain your account. The best way to protect your seed phrase is to write it down on a piece of paper and keep it somewhere safe.
• Quit reusing passwords: A common-sense, but frequently ignored, approach is to not recycle passwords or use the same password for multiple accounts. McGill recommends using a password manager, which is an encrypted digital vault—accessible via your web browser or an app—that securely stores login information for apps and accounts. Password managers also generate long, unique, hard-to-crack passwords.
• Use different email addresses: “Consider using a fresh email address for each crypto exchange account,” says McGill. “Your email accounts should also have multi-factor authentication set up and use separate passwords from any crypto accounts.” 
• Choose your crypto companies carefully: McGill recommends extensive due diligence while choosing a crypto exchange to buy and store assets. “The most secure cryptocurrency exchanges enable capabilities such as MFA, allow listing of withdrawal addresses, physical keys required to log into accounts, and cold storage options,” says McGill. Other details to look for: Is the exchange registered with securities regulators where you live? Does it comply with Canadian privacy laws? Does it offer 24/7 customer service? You want the answers to these questions to be a capitalized YES!

The bottom line

Now that you know more about crypto storage and security, choose a wallet not just for your investing and trading needs, but also one that will keep your assets safe. Unlike fiat currency, digital coins don’t have the traditional protection measures used by banks and other financial institutions—so crypto storage is your responsibility.

“Nothing is 100% theft-proof,” says McGill, “but users can take multiple steps to ensure their accounts are most secure.”

Video: Is crypto a good investment?

Read more about crypto:

• Are we in a crypto bear market?
• Which cryptos will survive in the long term?
• Watch: Should you invest in ethereum?
• How does crypto work? A guide to investing in bitcoin, ethereum and more