this article about maintaining your online security will set you straight<\/a>.)<\/p>\n\n\n\nI’ll admit though, it’s not particularly easy or intuitive. I wrote this article to get it all straight in my own head, and it might help you too.<\/p>\n\n\n\n
(General-purpose warning: There are bits in here that are sort-of-wrong-but-right-enough for the purposes of keeping it easy to understand, and there may be other bits that are wrong without me realising. If you’re dealing with meaningful amounts of Bitcoin, you can start here but you should read MUCH more widely to develop a full understanding.)<\/em><\/p>\n\n\n\nConvenience over security<\/h2>\n\n\n\n
The easiest way to deal with Bitcoin is to buy it on an exchange (like Coinbase \u2013 not a recommendation), then keep<\/em> it on that exchange. <\/p>\n\n\n\nAn exchange is just a website, like your bank’s website, which you’ll log into with a username and password. You can create an account, swap your fiat currency for Bitcoin (by linking your bank account or debit card), then leave the Bitcoin sitting there.<\/p>\n\n\n\n
For most people, this is the best way to get started with Bitcoin: there’s so much to get to grips with anyway, there’s nothing wrong with buying it and holding it in the simplest way possible.<\/p>\n\n\n\n
However, leaving your Bitcoin sitting on an exchange is not secure<\/strong>. Why? Because exchanges are vulnerable:<\/p>\n\n\n\n- They can be hacked, and customers’ Bitcoin stolen<\/li>
- The owners of the exchange could run off with it<\/li>
- Regulators could shut the exchange down and seize all the Bitcoin<\/li><\/ul>\n\n\n\n
How likely are any of these things to happen? If you stick to one of the major exchanges, not very.<\/p>\n\n\n\n
But still, the whole beauty of Bitcoin is you don’t need to trust anyone other than yourself<\/em> \u2013 including an exchange — to keep your assets safe. So by sticking to exchanges, you’re not taking full advantage of the technology.<\/p>\n\n\n\nWhat’s more, using an exchange makes it possible to take a “relaxed” attitude to security. Typically you’ll sign up using your email address and password. Forget your password? You can reset it via your email address. But what if a few years go by, and you’ve lost access to that email address too? It happens.<\/p>\n\n\n\n
Storing your Bitcoin yourself \u2013 away from exchanges \u2013 involves more effort, but that’s a good thing because it forces you to take it seriously. Do you have enough coins that you’d be upset for more than a day if you lost them completely? Then I’d recommend moving to self-custody.<\/strong><\/p>\n\n\n\nBasic Bitcoin principles<\/h2>\n\n\n\n
You’ll hear about Bitcoin being stored in wallets<\/strong>. The term “wallet” is slightly misleading, because it implies that you possess the bitcoins in a physical location<\/em>. In reality, bitcoins never exist anywhere except on the Blockchain<\/strong>.<\/p>\n\n\n\nIt might help to think of the blockchain as a giant spreadsheet that keeps track of who owns what. When someone sends bitcoin to someone else, a new line is added to the spreadsheet to record the transaction and update the balance of everyone’s wallets.<\/p>\n\n\n\n
This spreadsheet \u2013 a “ledger” in Bitcoin terms \u2013 is all that exists. Coins are never “sent” between people or “withdrawn” to a physical location: all that ever happens is updates to the ledger.<\/p>\n\n\n\n
Private and public keys<\/h3>\n\n\n\n
To make a transaction on the blockchain, you need two things: a public key<\/strong> and a private key<\/strong>.<\/p>\n\n\n\nThe public key<\/strong> is like your bank account number, which you give to someone if you want them to send you bitcoin. Just like with your bank account number, it’s harmless for your public key to be public knowledge \u2013 because all someone can do with it is send<\/em> you money (which would be a bonus!), and it doesn’t allow them to spend money from your account.<\/p>\n\n\n\nYour private key<\/strong> is like your password or security code to your bank account. Just like if someone had the security code for your bank account they could send money to anyone they wanted, anyone who knows your private key has full control over your coins.<\/p>\n\n\n\nUnlike with a bank, there’s no “backdoor” to this private key. If you forget it, there’s no “password reset” process to get it back. If someone else finds out what it is, there’s no “second factor” (like sending you a text) to prevent them from using it maliciously.<\/p>\n\n\n\n
Another metaphor for your private key would be the combination to a safe. If you know the combination, you can open the safe. If someone else sees the combination written down somewhere, they<\/em> can open the safe. And if you forget the combination, whatever is inside the safe is forever locked away from you and everyone else.<\/p>\n\n\n\nWallets<\/h3>\n\n\n\n
Back to wallets, then. A wallet is just an application that allows you to manage public keys <\/strong>and private keys<\/strong>, and make transactions. In other words, you interact with the blockchain via your wallet.<\/p>\n\n\n\nWhen you open a new wallet, it randomly creates a new public\/private key pair for you. It keeps track of how much bitcoin you’ve got in your wallet, and has functionality to make it easy for you to send and receive payments.<\/p>\n\n\n\n
If you keep your bitcoin on an exchange, the exchange creates a wallet for you and holds your private key. However, as we’ve seen, this means you need to put your trust in the exchange: if something goes wrong, it’s out of your control.<\/p>\n\n\n\n
To avoid this, you can move your coins off the exchange and into your own wallet<\/strong> \u2013 for which you control both the public and private keys.<\/p>\n\n\n\nTypes of wallet<\/h2>\n\n\n\n
There are three main types of wallet to be aware of:<\/p>\n\n\n\n
- Software wallets<\/li>
- Hardware wallets<\/li>
- Paper wallets<\/li><\/ul>\n\n\n\n
Paper wallets<\/strong> are strictly for the hardcore only. It means you can store wealth and make transactions using nothing but a pencil and a piece of paper, which I still find mind-blowing \u2013but it’s not going to be practical for most of us.<\/p>\n\n\n\nSoftware wallets<\/strong> are available for mobile or desktop devices. With a good one, you’ll have full control of your private key: it’ll be stored on the device itself, so the maker of the software won’t have any access to it.<\/p>\n\n\n\nYou’ll encrypt the wallet with a password, and if you forget the password you can restore it with a backup seed<\/em>. However \u2013 if you lose both your password and the backup seed, the wallet can’t be unlocked and you’ll lose access to the coins stored inside it forever<\/em>. This is why taking control of your coins is so powerful, but such an important responsibility too.<\/p>\n\n\n\nBecause the private key is stored on the device and no-one else (including the software creator) has access to it, it removes the risks of keeping your coins on an exchange which we talked about earlier. <\/p>\n\n\n\n
However, because your device is connected to the internet, it’s still possible for your your software wallet to be hacked and for someone to steal your private key (and therefore control over your coins). Any kind of malware or virus could technically find a way to expose your private key, or someone could install a malicious “keylogger” that transmits your password to them when you enter it.<\/p>\n\n\n\n
To avoid this possibility and take the next step up in terms of Bitcoin security, you’ll need a hardware wallet<\/strong>.<\/p>\n\n\n\nHardware wallets<\/h2>\n\n\n\n
A hardware wallet<\/strong> stores your private key on a physical device: it’s actually encoded into the physical chip itself, so there’s no way it can be exported. The wallet is always offline (indeed, it has no internet access capability) so no-one can hack into it.<\/p>\n\n\n\nMost hardware wallets look like a USB drive. You can transfer your coins onto one of these devices, put it in a drawer, and there’s absolutely no way anyone can access your coins. (You might wonder what happens if they find the device itself \u2013 we’ll get to that later.)<\/p>\n\n\n\n
You still need to plug it into an internet-connected device like a laptop to actually make a transaction. You might think that this creates a risk, because someone could hack into the wallet while it’s plugged into a device that’s connected to the internet.<\/p>\n\n\n\n
However, the connection between the wallet and the internet-enabled device is encrypted<\/em> and the private key never leaves the hardware wallet.<\/em><\/p>\n\n\n\nIn a nutshell:<\/p>\n\n\n\n
- You initiate a transaction on your laptop, but it’s incomplete<\/li>
- You plug in your hardware wallet, and the transaction gets sent over to it for signing<\/li>
- The wallet uses the private key to sign the transaction, then sends the completed transaction back (without<\/em> the private key going anywhere)<\/li>
- The transaction is now ready to be sent from your laptop off to wherever it’s going<\/li><\/ol>\n\n\n\n
This means you’re totally dependent on your hardware wallet<\/em> for spending your coins. That’s great for security, because it prevents anyone from hacking into your wallet over the internet.<\/p>\n\n\n\nIt does though give rise to two other problems \u2013 both of which can be worked around.<\/p>\n\n\n\n
Someone gets their hands on your hardware wallet<\/h3>\n\n\n\n
If you don’t put any further protection in place, anyone who physically gets their hands on your hardware wallet will have full control over your private key \u2013 and therefore over your coins<\/em>.<\/p>\n\n\n\nIt’s important to recognise that this is still a much lower risk than using a software wallet: rather than any internet user being able to hack into your wallet remotely, your only risk comes from people in physical proximity to you. If you keep your hardware wallet in a safe, there’s absolutely no risk.<\/p>\n\n\n\n
However, it’s common to also protect the wallet with a password or PIN code \u2013 just like you would a mobile phone. This means that even if someone finds your hardware wallet in a desk drawer or steals it from your bag, it’ll be useless to them without knowing your code.<\/p>\n\n\n\n
You lose your hardware wallet<\/h3>\n\n\n\n
Or you lose the PIN for it \u2013 or it gets damaged or destroyed. Then what? If physical access to the device gives control over your coins, does that mean that if you can’t access it anymore your keys are gone forever?<\/p>\n\n\n\n
Well, yes \u2013 unless you’ve got the backup seed phrase<\/strong>.<\/p>\n\n\n\nThe seed phrase is a set of 12 or 24 words that’s derived from the private key. Your hardware wallet will either prompt you to write these words down when you set it up, or give you the option to view them later.<\/p>\n\n\n\n
By entering the seed phrase into any<\/em> other wallet (software or hardware, same manufacturer or different), you’ll be able to recover the private key and get control of your coins \u2013 even if the original hardware wallet is lost and gone forever.<\/p>\n\n\n\nThis means your seed phrase is actually more valuable than the hardware device itself<\/strong>:<\/p>\n\n\n\n- You can lose or break the device and still recover your key \u2013 but if you lose your seed phrase, that’s it forever<\/li>
- If someone gets their hands on your hardware device, they’ll still need your PIN code (if you’ve set one). But if they get your seed phrase, they’ll have full control with no extra layer of security<\/li><\/ul>\n\n\n\n
In a way, this gets you back to the same problem as with the hardware wallet but more extreme: you have a “single point of vulnerability”, so you need to treat this phrase as if it were cash<\/strong>.<\/p>\n\n\n\nJust like anyone could just walk off with \u00a3100,000 if you left a bag full of banknotes lying around, they could walk off with \u00a3100,000 of Bitcoin if you leave your seed phrase lying around. You should therefore keep it in a safe, or somewhere else where it won’t be discovered, destroyed or degraded.<\/p>\n\n\n\n
You should not<\/em> attempt to remember it, store it in digital form anywhere (like in a notes app or password manager), or take a digital photograph of it.<\/p>\n\n\n\nA big responsibility? Yes. More scary than just keeping it in the bank? It seems that way…but as I said earlier, it just means you need to trust yourself<\/em> rather than anyone else. Are you worthy of that trust? That’s for you to decide.<\/p>\n\n\n\nHow to get started<\/h2>\n\n\n\n
I touched on it earlier, but I see Bitcoin security as a journey you’ll go on over time:<\/p>\n\n\n\n
- Start by buying on an exchange, and storing it there<\/li>
- Move to a software wallet, for better security and convenience if you want to spend it<\/li>
- Eventually transition to a hardware wallet for the ultimate security, but more responsibility and effort<\/li><\/ul>\n\n\n\n
Each step along this journey involves a bit more research and work to set it up, and involves putting more trust in yourself and less trust in anyone else. If you only have \u00a3100 in Bitcoin, there’s just no point going to a lot of effort (unless \u00a3100 is a life-alteringly meaningful amount of money to you), but as you accumulate more the extra work becomes more worthwhile.<\/p>\n\n\n\n
Bitcoin.org has a useful tool to help you choose a wallet<\/a> based on your operating system, level of knowledge, and convenience\/security trade-off. <\/p>\n","protected":false},"excerpt":{"rendered":"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here’s how to get started.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"yoast_head":"\n
A beginner's guide to Bitcoin security - Rob Dix<\/title>\n<meta name=\"description\" content=\"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here's how to get started.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/robdix.com\/bitcoin-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A beginner's guide to Bitcoin security - Rob Dix\" \/>\n<meta property=\"og:description\" content=\"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here's how to get started.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/robdix.com\/bitcoin-security\/\" \/>\n<meta property=\"og:site_name\" content=\"Rob Dix\" \/>\n<meta property=\"article:published_time\" content=\"2021-02-15T15:08:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-03-01T12:40:08+00:00\" \/>\n<meta name=\"author\" content=\"Rob\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rob\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/robdix.com\/bitcoin-security\/\",\"url\":\"https:\/\/robdix.com\/bitcoin-security\/\",\"name\":\"A beginner's guide to Bitcoin security - Rob Dix\",\"isPartOf\":{\"@id\":\"https:\/\/robdix.com\/#website\"},\"datePublished\":\"2021-02-15T15:08:00+00:00\",\"dateModified\":\"2021-03-01T12:40:08+00:00\",\"author\":{\"@id\":\"https:\/\/robdix.com\/#\/schema\/person\/8a17b90170244af4aef79432b2dac191\"},\"description\":\"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here's how to get started.\",\"breadcrumb\":{\"@id\":\"https:\/\/robdix.com\/bitcoin-security\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/robdix.com\/bitcoin-security\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/robdix.com\/bitcoin-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/robdix.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A beginner’s guide to Bitcoin security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/robdix.com\/#website\",\"url\":\"https:\/\/robdix.com\/\",\"name\":\"Rob Dix\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/robdix.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/robdix.com\/#\/schema\/person\/8a17b90170244af4aef79432b2dac191\",\"name\":\"Rob\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/robdix.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1dec2d522d3bbde40068a848d288d9c7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1dec2d522d3bbde40068a848d288d9c7?s=96&d=mm&r=g\",\"caption\":\"Rob\"},\"url\":\"https:\/\/robdix.com\/author\/djy7g\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A beginner's guide to Bitcoin security - Rob Dix","description":"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here's how to get started.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/robdix.com\/bitcoin-security\/","og_locale":"en_US","og_type":"article","og_title":"A beginner's guide to Bitcoin security - Rob Dix","og_description":"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here's how to get started.","og_url":"https:\/\/robdix.com\/bitcoin-security\/","og_site_name":"Rob Dix","article_published_time":"2021-02-15T15:08:00+00:00","article_modified_time":"2021-03-01T12:40:08+00:00","author":"Rob","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rob","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/robdix.com\/bitcoin-security\/","url":"https:\/\/robdix.com\/bitcoin-security\/","name":"A beginner's guide to Bitcoin security - Rob Dix","isPartOf":{"@id":"https:\/\/robdix.com\/#website"},"datePublished":"2021-02-15T15:08:00+00:00","dateModified":"2021-03-01T12:40:08+00:00","author":{"@id":"https:\/\/robdix.com\/#\/schema\/person\/8a17b90170244af4aef79432b2dac191"},"description":"With Bitcoin you have complete responsibility for your security \u2013 which is its beauty, but daunting too. Here's how to get started.","breadcrumb":{"@id":"https:\/\/robdix.com\/bitcoin-security\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/robdix.com\/bitcoin-security\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/robdix.com\/bitcoin-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/robdix.com\/"},{"@type":"ListItem","position":2,"name":"A beginner’s guide to Bitcoin security"}]},{"@type":"WebSite","@id":"https:\/\/robdix.com\/#website","url":"https:\/\/robdix.com\/","name":"Rob Dix","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/robdix.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/robdix.com\/#\/schema\/person\/8a17b90170244af4aef79432b2dac191","name":"Rob","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/robdix.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1dec2d522d3bbde40068a848d288d9c7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1dec2d522d3bbde40068a848d288d9c7?s=96&d=mm&r=g","caption":"Rob"},"url":"https:\/\/robdix.com\/author\/djy7g\/"}]}},"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Rob","author_link":"https:\/\/robdix.com\/author\/djy7g\/"},"_links":{"self":[{"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/posts\/940"}],"collection":[{"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/comments?post=940"}],"version-history":[{"count":6,"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/posts\/940\/revisions"}],"predecessor-version":[{"id":962,"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/posts\/940\/revisions\/962"}],"wp:attachment":[{"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/media?parent=940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/categories?post=940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/robdix.com\/wp-json\/wp\/v2\/tags?post=940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}