Recently I became a victim of a metamask hack. After giving some time to myself and getting back in control, I decided to do a lot of introspection on the mistakes I made and some of the must-follow security practices when storing your crypto safely.
I had a pretty straightforward setup, a browser used exclusively when I needed to do any crypto transaction. Nothing else, not even google was to be opened in this browser. In this case, I was relying on a hot wallet, metamask, and this was my first mistake.
I am generally super cautious about my online activity. These practices include, never opening any unknown link on my PC, only doing that if needed inside a sandbox. Never keeping the browser with the metamask opened if not needed, never experimenting or connecting my wallet to any suspicious site. Even when opening a dapp, I never used google, only relied on the link in the official Twitter handle of that particular dapp. The above practices in general should be followed anyway, whether you are into crypto or not, your privacy and data are always crucial.
What is a Hot and Cold Wallet?
Hot Wallet: Web-based wallets, mobile wallets, and desktop wallets are all typically hot wallets. Any wallet which is on a device connected to the internet lies in this category. These are the most vulnerable. These wallets are easy-to-use. Because they are always online, there’s no need to transition between offline and online to make a cryptocurrency transaction, you don't have to go around connecting an offline wallet every time to interact with your funds.
Cold Wallet: These wallets are one of the most secure solutions out there. Stealing from a cold wallet usually would require physical possession of or access to the cold wallet, as well as any associated PINs or passwords that must be used to access the funds. Examples of these time of wallets include the likes of Ledger Nano S, Trezor Hardware wallet, etc. These wallets are not always online, and the private key is not exposed to the internet in any way. Hardware wallets are designed to be immune to hacking. Even when a hardware wallet is plugged into your computer or connected via Bluetooth, depending on the storage method, the funds stored on the drive are difficult or even impossible to steal. All transaction signing is also done “in-device”.
Always use a cold wallet over a hot wallet.
Don’t be Lazy. It's your precious money, and it's your responsibility to safeguard it. Do the hard work of relying on a hardware wallet instead of taking the easier route.
Some of the security recommendations to follow :
- Do the hard work. Don’t be lazy and compromise on your fund's security.
- Always use a hardware wallet.
- If possible, try to keep a separate computer for interacting with your wallet. Don’t use your daily driver machine.
- Never ever do any transaction, exposing your wallet, to an insecure network. Always make sure the network at your home/workspace is WPA3 secure. Never connect to any public wifi, especially the device that you use for your financial transactions.
- Never ever sign with the same nonce twice, there is a very simple relationship in public-key cryptography using which your private key can be extracted if you do so.
- An additional level of security can be achieved by relying on multisig. If you have crypto you just keep in store and don't invest or interact with, move them to a multi-sig, and secure it using multiple private keys. Always a good idea to keep these private keys as different hardware wallet devices. The owner of these multiple devices can be just you, or you and your trusted family members, up to you totally. The advantage of this is gonna be that your funds are secure even if one of the hardware wallets gets compromised by getting stolen or anything.
- Monitor your wallet frequently to make sure everything is perfectly aligned.
- Don’t keep everything in one basket. One of the biggest lessons I learned :). Decide an upper limit, for eg. one wallet, will not have more than 10K USD worth of funds. Diversify as much as you can.
- Never store your backup phrase or private key on any device connected to the internet, even if encrypted. Always store them offline.
- And of course, never share your seed phrase or private key with anyone.
If you have been a victim of any hack/leak, try to take out some time for yourself. Talk to family, and friends to calm yourself. Talk to experts with experience in these fields, those experiences they share and insights are always gonna be invaluable lessons learned. It’s gonna be a hard road ahead for you, but life has to move on… :).
Lastly, if you wanna connect, you can reach out to me on Twitter.
