Your Cart is Empty
TL;DR: ‘Bitcoin Cold Storage’ refers to the practice of keeping Bitcoin secure and untouched for a long period of time.
A good analogy for Bitcoin Cold Storage might be a bank vault or a pirate’s buried treasure. Banks lock up their assets deep underground and surround them with armed guards, cameras, passcodes, and other security measures. Pirates would bury their loot on an island and create a map for how to return.
But what about Bitcoin or other cryptocurrencies?
Bitcoin is the world’s first digital bearer money, a digital asset that users can truly own.
The Bitcoin network itself is actively secured at all times by something called hash power, which is basically the computer processing power of all the miners who are organizing the transactions into blocks in exchange for bitcoin rewards.
Arguably the greatest threat to a user’s Bitcoin is the user.
Here are some examples of how users might lose their crypto:
You can also read an extensive but not exhaustive list of scams people run to get your Bitcoin.
This begs the following questions:
1) What is the right level of security for users who want to hodl bitcoin?
2) What steps should users be taking to secure your bitcoin?
Answers will vary for different users.
Some options are meant for a small percentage of Bitcoin hodlers, some are meant for all users to practice, and some options are meant for zero users (as in, don’t do it, it’s not a good choice).
How to securely hodl Bitcoin can sometimes be a difficult topic to get good advice on.
One reason is because the security experts and veteran hodlers are protective of their methods so as not to give any clues that might become vulnerabilities and attack vectors for would-be thieves.
TL;DR: Don’t tell people you own bitcoin and definitely don’t tell them how much or how it’s kept.
Does this topic really fit under Cold Storage practices? It does, and if you don’t believe me, consider that the most qualified experts practice this advice.
Do not make yourself an easy target for attackers.
Do not talk about how much Bitcoin you own.
Do not talk about how or where it is kept.
If you are on social media talking about your big gains or buying dips and your balance, you increase the probability of becoming a target.
If you’re here to read about Bitcoin Cold Storage, best practices, this is rule number one - Get it in your mind that this is money.
Do you go around talking about how much you have in your bank account?
No, of course not. Don’t do it with Bitcoin holdings either.
TL;DR: Practice your Cold Storage with fake Bitcoin before you try the real deal! It’s sort of like a playground before you enter the real world.
Many users neglect a great tool we have at our disposal: Bitcoin Testnet.
Whichever Cold Storage solutions sound best for your circumstance, take a bit of time to practice them using Testnet coins. Make sure you are comfortable with the security choices you have made and are familiar with how they work.
Create a Testnet wallet.
Send some coins around.
Delete the wallet.
Use a recovery phrase to regain access.
Practice makes perfect!
TL;DR: For the average person to sufficiently secure bitcoin, best practice is probably to just buy a hardware wallet (i.e. a Trezor and/or a ColdCard) and buy a steel wallet (i.e. a Billfodl) to back up your private seed.
That’s the advice Richard Bensberg, organizer of the Beijing Bitcoin meetup, offered to me when I approached him about this article.
And he’s right. New users should not be afraid to try these techniques using the test net - that’s what it’s there for.
Once the fear is gone, you can move to the real deal and implement some of the basic advice in this article and still achieve a very formidable amount of security.
Well known experts and experienced Bitcoiners such as AMERICAN HODL, Andreas Antonopoulos, Jameson Lopp, and others often repeat that theft is not the greatest threat to your Bitcoin.
As Andreas warns:
Most Bitcoin users report losses due to their own negligence, with far fewer losses coming from theft.
That means you are your own worst enemy, and you are the most likely person to cause the loss of your bitcoin.
So it’s important to find the right balance between securing your bitcoin and keeping it simple to recover.
It will always depend on your level of knowledge and familiarity with all things bitcoin.
If this is your first venture into cold storage or securing bitcoin, your very first step (if you already own bitcoin) should be to buy a hardware wallet and then buy a steel wallet.
There is a technical rough consensus that this is an excellent starting point for the majority of new Bitcoin hodlers.
The hardware wallet (i.e. a Ledger, Trezor or ColdCard) is a small device with a screen which you will plug into your computer and enter a pin every time you want to access your bitcoin.
This device protects bitcoin users from the potential threat of computer viruses, malware, and other such attempts to get your bitcoin.
This is why it is the most commonly recommended security solution for all users of cryptocurrency.
If you’re wondering which hardware wallet to buy, there are many choices. However, the three that get the greatest number of recommendations are the Ledger, ColdCard,and the Trezor.
However, there are MANY more choices than just those and, by all means, do your own research in determining which is best for you.
Also, when shopping for a hardware wallet, be aware of manufacturing threats. If possible, always buy from an official source (such as the company’s website). Avoid used items or online auction websites. Be aware of buying from untrusted sources. If the manufacturing process has been compromised, which has been known to happen in China (for example), you could be buying a unit with malware or a backdoor pre-installed. Better safe than sorry.
The steel wallet (i.e. a Billfodl) is your fail safe where you keep your private seed phrase in the event that something happens to your hardware or software wallet and you want access to your bitcoin.
It is like a paper wallet but it’s printed on metal such as steel.
Andreas Antonopoulos recommends writing down a seed phrase and keeping it in multiple places to back up your wallet.
He mentions writing it down on paper, but also states, “Paper is paper. It burns, it gets wet, it gets acidy, it changes colors, it gets torn, whatever.”
So given the risk, having a backup only on paper is not the best option for users interested in cold storage.
That is another reason why experienced bitcoiners such as Michael Flaxman and Andreas Antonopoulos recommend getting a steel wallet (or two).
That will ensure a high degree of security, protecting your backup from fire damage, water damage, and other unexpected troubles.
This is the most user friendly solution and is adequately secure for probably 90%+ of new bitcoin users.
An air gapped machine is a computer or device which is not in any way connected to the internet or another device, either via a cable or any wireless connection (including Bluetooth).
An air gapped machine would preferably not have the ability to wirelessly connect to the internet or another device.
This ensures that no malware or virus could infiltrate the machine through USB and change the settings without the user’s knowledge.
Some experts have recommended using an older machine, pre-2008, for this reason.
However, this may have other risks, so remember to try your setup with Testnet coins, first, and to have your seed phrase backed up before getting into this in case something goes wrong.
You can read more about setting up this system on the Bitcoin Wiki.
Warning: The following security measures are for bitcoin users with special circumstances or who have already become familiar and comfortable with Bitcoin [wallets](/wallets/) and software. Beware that the following options are not recommended for new users, and any new user who attempts to secure bitcoin in the following ways without proper understanding will increase the likelihood of incurring loss of bitcoin rather than increasing security as intended!
You can increase the security of your stored bitcoin by an order of magnitude if using a 2 of 2 multisig setup and securing it with two wallets (preferably hardware wallets) made by different manufacturers, using one signature for each hardware device.
This method is arguably the best option and is described well by Michael Flaxman.
You will want to find a software wallet that you are comfortable using which is capable of creating a multisignature wallet using hardware wallets.
Electrum is a well-known wallet that can do this and can work well for users who know what they’re doing and take all precautions.
You can use coins or dice or other such methods to generate random numbers in order to create your own Bitcoin address.
From there, you can also use BIP39 to create your own mnemonic seed phrase.
If you choose to do this, remember to practice with testnet coins first, and remember not to expose any aspect of your key generation to the view of security cameras, webcams, or internet.
Make sure you you perform this method in a secure location and without using an internet connection AND, if using a computer or electronic device, with an air gapped machine.
Side note: have you ever wondered how many Bitcoin Addresses there are in existence?
Creating a paper wallet (you can read our article specifically about paper wallets HERE) is not an option recommended as a cold storage option, but it’s a pretty darn cool thing that you can do as a bitcoin user.
We only recommend it here as something to do for fun and use on testnet!
Andreas Antonopoulos explains the dangers of using a paper wallet to secure bitcoin.
Every step of the way there are small missteps that will result in the paper wallet creator losing the bitcoin forever.
Some examples are:
- Paper can easily get destroyed, ripped, or lost.
- Printers might be storing data which means that your printed private key
might be compromised by any attacker who has access to the printer.
- The ink can fade.
- It can be difficult to import your paper wallet into a software wallet if you decide to do that.
You may not realize: if you import your paper wallet to a software wallet and spend some bitcoin, all the bitcoin that wasn’t spent might not be returned to the paper wallet but, instead, might be sent to a different ‘change address’
This change address is often created by the software wallet.
Users who are unaware of this behavior may not save access to that newly created ‘change address’ and think their paper wallet naturally has the bitcoin that was not spent.
Many bitcoiners have lost bitcoin using paper wallets. You can read more detailson losing a paper wallet.
You can follow instructions on one of the websites below to try making a paper wallet:
A cryptographer named Adi Shamir created a widely known scheme called “Shamir’s Secret Sharing Scheme” (SSSS) that allows someone to use some secret (such as a private key or a password) and divide it into a chosen number of parts called “shares”.
You would need to have a certain number of these shares in order to reconstruct the secret, similar to a multisig.
For example, you can use cryptography in such a way as to divide your bitcoin private key into 3 shares so that you would need to have any 2 of those 3 in order to recover the private key.
Having just 1 of 3 will not be sufficient to reconstruct the private key.
Gregory Maxwell, CTO of Blockstream and a well-respected cryptographer who contributes mightily to Bitcoin development, is quite critical of using this method, but Michael Flaxman recommends it (for very experienced users who need as much security as they can get).
Ruben Somsen also notes that eventually, when Schnorr Multisig makes its way into Bitcoin Core, then it will be a superior alternative to using SSSS because users will be able to sign transactions with the shares instead of needing to reconstruct the private key from the shares before signing.
If you’re interested in using this scheme,be aware of Greg Maxwell’s warnings, and you can try using it on an air gapped machine by downloading Ian Coleman’s SSSS tool here.
Trezor has also announced that SSSS will be coming to their hardware wallets soon.
Billfodl also offers a steel wallet designed to mimic SSSS without having to use use any software. Instead, the user takes a normal 24 word seed, and breaks it up into 3 mini Billfodls, each supporting 16 words. One shard holds words 1-16, a second holds 9-24, and a third holds 17-24 & 1-8.
You can purchase or take a look at the Billfodl multishard in greater detail.
Glacier Protocol is step-by-step instructions for storing bitcoins with a higher level of security compared to average user practices.
Subzero is an open source “enterprise offline cold storage wallet” developed by Square, the famed payment processing company founded by Twitters Jack Dorsey.
These protocols are professionally developed with advanced security measures. Because of that, Richard Bensberg warns that “Glacier is probably a bit too involved for first-timers.
SubZero uses HSMs, so that’s out for beginners” as well.
Regardless, check them out as you learn more and more.
Some services offer to be one of your signatories in (for example) a 2-of-2 multisig scheme. Blockstream Green is a great example of a user-friendly wallet which provides a service meant to protect newer bitcoin users from losing funds.
There is no way for the service to steal your bitcoin because they only have 1 of 2 or necessary private keys.
Mario Gibney, employee of Blockstream and co-host of the Unhashed Podcast, explains that when you want to make a payment, you sign the transaction and then Blockstream Green auto-signs the same transaction on their end after you have verified with a chosen 2-FA method. After that, an e-mail with the transaction and In addition to that, there is a user-adjustable timelock which Mario explains further.
“After each transaction, our server emails you pre-signed transactions with the aforementioned timelock. you have to use another tool of ours called garecovery with the nlocktimes to claim your funds if [you need to].”
So if you lose one of your keys, the service is able to help you recover access to your bitcoin.
I do not vouch for these services and the benefits and risks of using such a service are outside the scope of this article, but two such paid services are recommended by AMERICAN HODL.
Please do your own research and make an informed choice on whether or not this is the right decision for you.
1. Casa Hodl
2. Unchained Capital’s Multisig Solutions
Why would this popular software wallet not be listed for new bitcoin users?
The reason is because even experienced bitcoin users have complained about the User Interface, although it is always improving.
Not just that, but more importantly, Electrum has become a popular target for phishing hackers to the point where it can be difficult to know whether or not the software you downloaded is infected or not.
This is especially true for new users, but it has also been said by experienced hodlers as well.
You can download Electrum HERE but make sure to get yourself informed about the malware dangers before you jump into it.
You can read more about the malware/phishing troubles HERE.
If you just do a quick search for “Electrum malware”, you’ll discover plenty of victims sharing their stories.
If it’s possible, it is highly recommended that users of Electrum wallet run their own Electrum Personal Server for the best security, ensuring your wallet will not connect to malware.
TL;DR: A Faraday bag blocks all radio frequencies from reaching any electronic devices inside of it.
A Faraday bag is just a nice added touch for security.
Bluetooth, Wifi, RFID, etc; nothing is going to communicate with your hardware wallet.
Using a Faraday bag is just depends on how the user feels about the likelihood of this attack vector on their electronics. It also depends on which hardware wallets are being used.
For example, many hardware wallets can’t be accessed without being powered on, which requires a physical connection to a power supply like a PC or laptop via a USB port.
However, this is changing with wallets like the Ledger Nano X, which not only supports connections over Bluetooth, but also utilizes an internal battery that can be charged.
It is then at least theoretically possible that someone could access the device remotely and communicate with it - though ledger thoroughly maintains that the secure element of the wallet would prevent any would-be attacker from signing transactions from the device.
I argue that the low cost of a Faraday bag makes it worth the extra protection it offers against electromagnetic threats or any potential wireless attacks on devices that support wireless communication.
While such attacks are not common, it’s just such a simple security measure to to take, especially if you have a significant amount of bitcoin or expect the value to keep rising. If you are still not sure about it, read the full article on why it’s recommended.
Richard Bensberg provided such detail in his advice, it’s best to present it in his own words:
1. Use a hot wallet (Samourai)
NOTE: all hot wallets need to know about your transactions in order to process them. Make sure to coinjoin these coins (using Whirlpool with a fresh wallet before moving to your stash) for the same financial privacy you would expect of your bank.
2. Install Samourai ‘hot wallet’ on an offline device then monitor the balances with Samourai’s Sentinel app. Your transactions will be signed safely on the offline device - you will then use QR codes to move the signed transaction to an online device and broadcast. This is a great way to understand what goes on when you make a bitcoin tx! Note - this still violates Rule 1 - but the tools to run your own tracker without leaking any data will be ready soon and one more thing to help you further understand the tech. At this point, you may also want to play with generating private keys manually using coinflips / dice for added fun - but I would recommend sticking with software for securing money.
3. Buy and use a Hardware wallet (Trezor). Make sure you store the wallet seed somewhere safe. To properly secure the device you will need to use a passphrase in addition to the PIN. But this will risk you losing access to the funds if you lose this information. Also you will need to physically protect the seed. A HW wallet is a great way to understand security tradeoffs, and how sophisticated attacks risk compromising the device. One thing people dont think enough about however is how the setup / operate the HW wallet. If you use this in a public place the likelihood is that CCTV will have captured sensitive data. I envisage old CCTV footage (especially from coworking spaces) will be a huge honeypot in future.
4. Dedicated Cold-Storage airgapped machine. Using a pre-2008 laptop, using similar principles to Glacier Protocol**.
I think currently my advice to the [new bitcoin user] would be [if you have] less than a full bitcoin get yourself a Coldcard or a Trezor and make sure you use a passphrase. Engrave your seed on metal and keep your seed and your device separate. More than a full bitcoin?
Go with Casa Gold or Unchained Capitals multisig solutions. Pick the price level you feel is appropriate, but also bear in mind that your coins could legitimately be worth 100x what they are at the time of purchase. So if you bought 10k worth you need a million dollars worth of security.
Watch the full video of his cold storage talk below
For most users, especially new users, just using a hardware wallet is fine. However, for the best security, use a 2 of 2 multisig wallet protected by two different hardware wallets made by different companies.
In doing this, an attacker will need to compromise both hardware devices in order to steal anything, which is extremely difficult.
The additive power of a second signature, \[or even a third, but really I think a second gets you most of the way there,] is so massive, that I would happily take a lousy second signature over my single key signature. And I hope that’s the biggest message that your listeners will take home.
From Episode 97 of the Stephan Livera Podcast (1h17m)
Special thanks to the following people for sparing time to answer questions or share their experienced advice for this article: Richard Bensberg, organizer of the Beijing Bitcoin meetup; AMERICAN HODL, long time stacker of sats; Stephan Livera of the Stephen Livera Podcast (SLP 97 mostly, but also SLP 96 and the end of 62), Leo Weese, president of the Bitcoin Association of Hong Kong, and the Seoul Bitcoin meetup organizers (Ruben Somsen, Ben McDonald, and Calvin Kim).
NOTE: AMERICAN HODL may change twitter accounts, in the future, yet again. Just look for the iconic picture and search the name. You’ll find it.
