Survival Skills in the Cryptocurrency Dark Forest Wallet Security Strategies and Risk Hierarchy Management

Cryptocurrency Dark Forest Survival Wallet Security and Risk Hierarchy Management

Risk classification, asset isolation. It’s not scary to have an occasional asset stolen, what’s scary is when all your assets are gone in one fell swoop.

“Cryptocurrency dark forest, once an endless nightmare for me, but I learned, explored, and broke the chains of security. By adopting encryption technology and formulating a security line, even in the face of dark clouds, I can still defend myself.

Countless attack and defense drills played out in my mind, knowing when I might be vulnerable to a dark invasion. Despite the many challenges, I continue to move forward because I know that the stars are within reach.”

In the world of cryptocurrency, the most tragic thing is to suddenly discover that your assets have been stolen, and all the countless days and nights you worked hard for have suddenly turned into nothing. I used to feel very frightened when I saw similar incidents happening to others, and I deeply doubted whether I had the risk of having my assets stolen, and whether I would wake up one day and find that my bitcoins and ethers were gone.

• The truth hidden in 6,599 blockchain case judgments the verdicts are a mystery, and the execution is even more challenging.
• Why is Bitcoin falling? Analysts point out 5 potential reasons
• Web3 Social (1) Profit is the Essence of Socialization, Financialization of Social Interaction

For a long time, this was almost like a nightmare for me. But over the past few years, through continuous learning in the dark forest of cryptocurrency, I slowly gained the power to combat this sense of insecurity. I adopted the encryption techniques I learned and developed a wallet private key security management strategy that suits my own circumstances, as well as a hierarchical management system for different assets. I have played out countless attack and defense wars in my mind, knowing under what circumstances I may be attacked, how much of my assets I may lose, and what the probability of such an event is. With these understandings, I can finally put my mind at ease and quietly watch the coins in my monitored account, enjoying the benefits that the blockchain world brings me.

My strategy may not be the safest, but it is a process of continuous improvement and continuous learning. This is just my personal opinion, and I welcome fellow enthusiasts who have better risk management methods to share their experiences with me. Here, I would like to recommend the Founder of SlowMist, COS Cosmos (@evilcos)’s “Blockchain Dark Forest Self-Rescue Manual”. It provides a very comprehensive introduction to cryptocurrency security, and can be considered a “blockchain security bible” that every participant in the cryptocurrency market should seriously study.

Getting straight to the point, here are the hardware conditions I use:

Apple MacBook Pro + Trezor or other types of hardware wallets

Try to avoid using Windows computers if possible. Although Apple systems cannot guarantee immunity to computer viruses, the quantity and probability are much lower.

Next is my risk management layered structure for cold and hot wallets:

1. Emptying airdrops (Google account 1 or Computer 1)

As some of the lowest security hot wallets, their purpose is to interact with various potential airdrop projects. They require various chrome wallet plugins or learning, translation, AI, etc. Obviously, I cannot guarantee the security of some of these plugins, so I specifically created a less commonly used Google account and installed these plugins here. Because the wallet I use for airdrops does not have much funds, it is purely for experiencing other wallets or Layer2 interactions, even if it is stolen, it will not affect the overall fund security. For players at the scientist level, there should be another set of more complete risk management methods, which are not discussed in this article.

In addition, if you have entertainment or gaming needs, it is best to do it on another computer to avoid mixing game and wallet interactions on the same computer.

2. Outermost Layer of Transactions (Google Account 2 or Computer 2)

This layer is different from the outermost layer of airdrops. It is a few hot wallets used for serious defi transactions. I use the Metamask Chrome browser plugin myself, and under this Google account, besides Metamask, I only have the necessary password management plugin called 1LianGuaissword. Of course, you can also remove all other plugins to avoid malicious plugins or vulnerabilities attacking the wallet. Therefore, the Chrome browser under this account is very clean and used only for wallet operations.

Asset level %, used for various defi operations, signature authorization, NFT transactions, etc. Put the funds you think can bear the loss in these few hot wallets of the outermost layer of transactions. For unlimited authorization of stablecoins, regularly check and cancel on revoke.cash. The best practice is to never give unlimited authorization. Authorize as much funds as needed, unless it is a particularly trusted defi blue-chip project.

Generally speaking, I also have a risk rating for these few hot wallets. You can have the most fearless risk wallet (of course, I don’t have one), a wallet for high-quality airdrop accounts (the most widely used DEFI projects for interaction), and a wallet that only interacts with large blue-chip DEFI projects, such as Curve, Convex, Uniswap, Liquity, Lido, etc. But no matter what project it is, be wary of phishing websites. I have encountered a phishing website for Rocketpool before. It looks exactly the same, but once you connect your wallet, it automatically asks you to sign the transaction. When carefully examining the transaction details, it was found that all your ETH was transferred away. So every time you sign a transaction, you must carefully check the transaction amount, target address, and other content.

There are many similar details that need to be noted. Please learn by yourself. This article focuses on wallet risk management.

The above two levels are the wallets that you use in 99% of your daily life. However, the amount of funds inside should be within your tolerance. The security points mentioned above are the mistakes made by predecessors, the tears shed, and the massive amount of funds that can never be recovered. You must have a clear understanding. For every security incident and every mistake made by others, we should learn from them and examine whether there are any vulnerabilities in our asset management. Don’t fall into the same trap as others.

Next, let’s move on to the core layer of asset management – cold wallet assets.

3. Outer Layer of Cold Wallet

The so-called cold wallet refers to a wallet whose private key is never connected to the internet. The most primitive forms include paper wallets, brain wallets, steel plate mnemonic phrases, and old mobile phones. Personally, I believe that a combination of hardware wallet + paper wallet or steel plate mnemonic phrase is a relatively secure and convenient method. Pure electronic devices do not have a very long lifespan and may fail at some point, while paper can last for thousands of years if properly preserved, and stainless steel plates can withstand fire for tens of thousands of years.

There has always been a paradox in offline storage of private keys or mnemonic phrases: the more copies you store in different places, the less likely they are to be lost, but they are also the most vulnerable to single-point breaches and leaks.

Faced with this dilemma, cryptographers have invented a cryptographic private key shard backup scheme called Shamir backup. The brilliance of Shamir backup lies in the fact that you can split a single private key into multiple shards and only use a few of them to recover the private key. This is also one of the cryptographic technologies used in recent popular distributed validation technologies (Shamir’s secret sharing), except that the latter shards the validator keys of Ethereum staking.

As far as I know, the only hardware wallet that currently supports Shamir backup is the Trezor model T.

For example, if you want to diversify the geopolitical risks of storing private keys and keep them in 5 different places on the five continents of the world, using Shamir backup, you create 5 shards of the private key. After placing them properly, you can rest assured. Because when you need to recover the private key, you can choose any three shards to complete the recovery. The redundancy of your private key storage is greatly enhanced, because you know that neither thieves breaking into your house nor the use of national forces to forcefully open your bank safe can shake your personal property. Even if you lose or have two of the shards stolen, it does not affect the security of your assets. Of course, you can also use a 2-out-of-3 scheme, a 4-out-of-7 scheme, or even a scheme with up to 16 shards. In short, as long as you still hold the majority of the private key shards, you always maintain control over your assets.

Shamir backup is concise and beautiful, but it greatly enhances the security and reliability of offline storage of private keys. In my opinion, it is an ideal private key management solution.

Trezor’s official website introduces Shamir backup (https://trezor.io/learn/a/what-is-shamir-backup).

The amount of funds at this layer: %

Operation strategy: Only interact with the largest blue-chip DeFi projects, and minimize interactions, without unlimited authorization and NFT interactions.

Why haven’t I put a large amount of funds in it when private key management is already so secure?

On the one hand, it is to prevent the one-in-a-million possibility, such as most of my private key fragments being leaked without my knowledge, which would make the wallet insecure. In addition, there is an attack vector that cannot be prevented, which is the 5 wrench attack.

That is, when someone has already put a knife to your throat and forces you to reveal the hardware wallet PIN code, do you choose your life or money? Of course, it is better to honestly give up the password, so leaving some money inside can be considered as sacrificing wealth to avoid disaster.

In order to avoid such situations, we know how to deal with such crises in normal times. For example,

First, don’t carry your hardware wallet around for no reason. Without this attack point, if the attacker still needs to kidnap you to find the scattered shards around the world, I’m afraid they won’t have the patience and energy to do so.

There is a feature of the Trezor hardware wallet that you may need to know, which is that you can set a WIPE CODE in advance. Once entered, all the data in your hardware wallet will be wiped out, including the recovery seed information. Entering the WIPE CODE does not require you to connect to a computer, as long as you have power, whether it’s a charging station, a car charger, or anything else, you can enter it.

Second, don’t show off how much assets you have. Once the attacker knows your details, the so-called sacrificing wealth to avoid disaster will not be possible. If they don’t squeeze you dry, you will have a hard time escaping their clutches.

3. Middle Layer of Cold Wallet

The outer layer of the cold wallet does not hold your core assets. It is at most a decoy. As long as you ensure the safety of the assets in the outer layer of the cold wallet, it means that your private key is always secure. Even if it is stolen, your losses will not be significant, and you will have time to quickly transfer the assets in the middle layer of the cold wallet.

So what is the difference between the middle and outer cold wallets? That is the use of a hidden wallet based on LianGuaissphrase technology – your hidden wallet. These two official introductions are very detailed and interesting.

https://trezor.io/learn/a/passphrases-and-hidden-wallets

https://blog.trezor.io/passphrase-the-ultimate-protection-for-your-accounts-3a311990925b

LianGuaissphrase can be used not only on Trezor, but also on Ledger. The way to use it is to add a word or any string (including a space) that only you know on the basis of the original 24 mnemonic words (or 12). The maximum length can be 50 characters. This will guide the hardware wallet to derive a brand new address based on the original private key, because this LianGuaissphrase does not exist on any storage medium, and the only medium to keep it is your flesh brain or the brain you tell your family. Neither hackers nor real-life robbers will know it, and this will be the eternal secret between you and your family.

The amount of funds in this layer: ~50%

Asset type: LSD assets, native Ethereum SAAS POS staking.

The Ethereum SAAS staking method has been discussed in my previous article, https://mirror.xyz/darkforest.eth/Y-fvJCbGdJN0aFkAIFWH1vf7j5rRVblVpXERglgfAUg

As for why I will use the SAAS method for staking, it is because this is the true Ethereum staking method that allows you to have control over the withdrawal key and verification key, which means truly controlling your own assets.

Operation strategy: no DEFI interaction, authorization, only transfer with the outer address of the cold wallet (transfer of LSD assets). The only operation done on this wallet is the signature during the Ethereum staking process and the interaction with the Ethereum POS deposit contract. And the withdrawal address of the Ethereum staking is also this address.

Ethereum POS staking also has an interesting feature, which is that you can receive the execution layer rewards with another wallet. This means that as long as you do not unstake in this layer wallet, you will receive staking rewards continuously in the wallet you specified. You can use a hot wallet to receive it and treat this money as your daily spending money, or you can keep the receiving address unchanged and wait for several years to accumulate another 32 ETH staking node.

With this operation strategy, the only way for hackers to break into your assets is 1) to obtain the majority of your private key shards, 2) to know the details of your real assets, 3) to obtain the LianGuaissphrase from your mouth, 4) to find out that you have Ethereum POS staking, 5) to sign and exit the staking sequence, and then wait for 4 to 5 days to unstake. After going through these five steps, they may truly obtain your assets.

In my opinion, the security of the intermediate layer in this cold wallet has reached a new height. Technically speaking, besides the possibility of the Ethereum deposit contract being hacked, I don’t know of any other attack vectors.

Ethereum Proof of Stake (POS) staking, as a secure means of hodling coins, has been brilliantly discussed by 0xdog(@ivanstarbb) in his article, which I personally agree with (https://mirror.xyz/0x26DA4f747dD974f873Be9422918FAf1c3C0049D6/OY-mMHadkGKogrUg4_sDno-7vUOQBA3zS8MDEYqv4XI).

But that’s not all…

4. Cold Wallet Core Layer

Building the core layer of the cold wallet is similar to the intermediate layer, except that the weak point of the intermediate layer is that your LianGuaissphrase may not be strong enough. In the event that a hacker gains direct control of your private key, the time it takes to crack a frequently used LianGuaissphrase with a small number of digits will be very short. That’s why it is necessary to build a deeper layer of security for the cold wallet.

The above table shows the attack cost of cracking passwords using different types and lengths of LianGuaissphrase with the current time and 2030 as two time dimensions.

Seeing this table, I, who was originally confident, began to feel anxious again… Although I know that an attack has preconditions, and the Ethereum you stake in the intermediate layer will not be immediately transferred, giving you time to fight the hacker, I can still do better.

I can further lengthen the LianGuaissphrase1 in the intermediate layer of the cold wallet. Maybe what should be stored in my mind and my family’s mind is not a word, but a… spell?

In addition, if the LSD project is likely to fail, the Ethereum POS deposit contract may also be attacked. There is no code in this world that is inherently secure. So, I simply store native assets in this layer, which are native Bitcoin and Ether. Unless at the end of the universe, private keys can be cracked by quantum computers, then cryptocurrencies will be worthless, and the security of this layer will lose any meaning.

Funds in this layer: ~40%

Asset types: Native Bitcoin and Ether

Operational strategy: Only transfers between wallets.

Summary

Simplicity is the ultimate sophistication. The simplest is the safest. The fewer operations and activities you have, the more secure your wallet will be. Of course, you shouldn’t be too conservative and reject new things and new experiences. What you can do is to follow the description in this article, grade your risks, isolate your assets, and occasional asset theft is not scary. What’s scary is losing all your assets in one go. In a sense, doing so is like going all in every time, and in the long run, you will lose. As long as there is a slight flaw, it’s not certain who will end up with the money you previously earned.

Blockchain technology gives each of us the right to “private property inviolability” and the freedom of unrestricted global capital flow. However, this right and freedom are too heavy for many people, which means unlimited responsibility and commitment. When the security of your assets depends only on your thoughts, everyone involved can only continue to learn, draw from others’ experiences and lessons, and apply them in different situations. Only then can you firmly grasp your own destiny in this bloody and brutal dark forest and be well-prepared for the day when you can eventually reach the free world.

We will continue to update Blocking; if you have any questions or suggestions, please contact us!