Survival Skills in the Cryptocurrency Dark Forest Wallet Security Strategies and Risk Level Management

Wallet Security and Risk Management in Cryptocurrency

Author: darkforest

Risk grading, asset isolation, occasional asset theft is not terrible, what is terrible is that all your assets are wiped out in one go.

“Cryptocurrency dark forest used to be my endless nightmare, but I learned, explored, and cracked the chains of security. Employing encryption technology, formulating a security front line, even in the face of dark clouds, self-defense is still possible.

Countless exercises of attack and defense play out in the brain, knowing when one might be subject to a deep and dark violation. Despite the numerous challenges, one still moves forward courageously because they know that the stars are within reach.”

• FastLane Atlas Protocol Use Case Analysis What is the potential for development?
• Why has friend.tech become popular?
• The Past and Present of OPNX – From Bankruptcy Alliance to Hundredfold Increase

In the world of cryptocurrency, the most tragic thing is to suddenly discover that one’s assets have been stolen in an instant, and all the countless days and nights of hard work have suddenly turned to nothing. I used to often feel very frightened and deeply doubted whether I had the risk of asset theft when I saw similar events happening to others, and whether I would wake up one day to find that my bitcoins and ethers were all gone.

For a long time, this almost became my nightmare. But over the past few years, through continuous learning in the dark forest of cryptocurrency, I slowly gained the power to confront this sense of insecurity. I used the encryption technology I learned and formulated a wallet private key security management strategy that suits my own situation, as well as managing different assets at different levels. Countless battles of attack and defense have been rehearsed in the brain, knowing when one is likely to be attacked and how much assets might be lost, as well as the probability of such an event occurring. With this understanding, I can finally put my mind at ease and quietly watch the coins in my monitored account, enjoying the benefits brought to me by the blockchain world.

My strategy may not be the safest, but it is a process of continuous improvement and continuous learning. This is just my opinion, and I welcome fellow enthusiasts who have better risk management methods to share their experiences with me. Here, I would like to recommend the founder of SlowMist, COS, (@evilcos)’s “Blockchain Dark Forest Self-Rescue Manual”, which provides a very comprehensive introduction to cryptocurrency security. This manual can be called the “Blockchain Security Bible” and every cryptocurrency participant should study it seriously.

Getting straight to the point, the hardware conditions I use are:

Apple laptop MACBOOK PRO + Trezor or other types of hardware wallets.

Try to avoid using Windows computers as much as possible. Although Apple systems cannot guarantee immunity to computer viruses, the quantity and probability are much lower.

Next is my risk management layered structure for cold and hot wallets:

1. Outermost Layer for Airdrops (Google Account 1 or Computer 1)

As some of the least secure hot wallets, their purpose is to interact with various potential airdrop projects. Because they require various Chrome wallet plugins or learning, translation, AI, and other types of plugins, I cannot guarantee the security of some of these plugins. Therefore, I have specifically created a less frequently used Google account and installed these plugins here. Since the wallet for airdrops has no funds, it is purely for experiencing other wallets or Layer2 interactions, and even if it is stolen, it will not affect the overall fund security. For players at the scientist level, there should be another set of more comprehensive risk management methods, which will not be discussed in this article.

In addition, if you have entertainment or gaming needs, it is best to do so on another computer to avoid mixing gaming and wallet interactions on the same computer.

2. Outermost Layer for Transactions (Google Account 2 or Computer 2)

This layer is different from the outermost layer for airdrops. It is a few hot wallets used for serious defi transactions. I personally use the Metamask Chrome browser plugin, and under this Google account, in addition to the Firefox (Metamask), I only have the 1LianGuaissword password management plugin, which is necessary to use. Of course, you can also remove all other plugins to avoid malicious plugins or vulnerabilities attacking the wallet. Therefore, the Chrome browser under this account is very clean and used only for wallet operations.

Asset level %, used for various defi operations, signature authorization, NFT transactions, etc. Put the funds that you think can withstand losses in these few outermost layer hot wallets. For unlimited authorization of stablecoins, regularly check and revoke at revoke.cash. The best practice is to never give unlimited authorization, and authorize only the amount of funds needed, unless it is a particularly trusted defi blue-chip project.

Generally speaking, I also have a risk ranking for these hot wallets. You can have the most fearless risk wallet (of course, I don’t have one), a wallet for high-quality airdrop accounts (the most widely interacted DEFI projects), and a wallet that only interacts with large blue-chip DEFI projects, such as curve, convex, uniswap, liquity, lido, etc., which I personally trust more. However, regardless of the project, be vigilant against phishing websites. I have encountered a phishing website for Rocketpool before, which was exactly the same, but as soon as you connect your wallet, it automatically prompts you to sign the transaction. Upon careful examination of the transaction details, it was found that all your ETH was transferred away. Therefore, it is necessary to carefully review the transaction amount, target address, and other content before signing each transaction.

There are many similar details that need to be noted, please learn on your own. This article focuses on wallet risk management.

The above two levels are the wallets you use in 99% of your daily life. However, it is best to have a fund size within your tolerance. Each security point mentioned above is a mistake made by predecessors, tears shed, and a large amount of funds that can never be recovered. It is necessary to have a clear understanding. For every security incident and mistake made by others, we should learn from it and examine our own asset management for any vulnerabilities. Don’t fall down at the same spot where others have fallen.

Next, we will enter the core layer of asset management – cold wallet assets.

3. Outer Layer of Cold Wallet

A cold wallet refers to a wallet whose private key is never connected to the internet. The most primitive ones are paper wallets, brain wallets, metal mnemonic phrases, and old mobile phones. Personally, I think a combination of a hardware wallet and a paper wallet or metal mnemonic phrase is a relatively secure and convenient way to use. Electronic devices have a limited lifespan and can break down, while paper can last for thousands of years if properly preserved, and stainless steel plates can even withstand fire for tens of thousands of years.

There has always been a paradox in the offline storage of private keys or mnemonic phrases. The more copies you store in different places, the less likely you will lose them, but they are also more vulnerable to single-point breaches and leaks.

In the face of this dilemma, cryptographers have invented a cryptographic private key shard backup scheme – Shamir backup. The amazing thing about Shamir backup is that you can split a private key into several shards and recover the private key by using only a few of them. This is also one of the cryptographic technologies adopted by the recently popular Distributed Validation Technology (DVT), except that the latter shards the validator keys for Ethereum staking.

As far as I know, the only hardware wallet that currently supports Shamir backup is the Trezor Model T.

For example, if you want to diversify the geopolitical risk of storing private keys and store them in 5 different locations on the 5 continents of the world, by using Shamir backup, you can create 5 shards of the private key and securely place them. Because when you need to recover the private key, you can choose any three of them to complete the recovery. The redundancy of your private key storage is greatly enhanced because you know that neither a thief’s break-in nor the use of state force to forcibly open your bank safe can shake your personal property. Even if you lose or have two of them stolen, it does not affect the security of your assets. Of course, you can also use a 2/3 scheme, a 4/7 scheme, or even a scheme with up to 16 shards. In short, as long as you still control most of the private key shards, you will always have control over your assets.

Shamir backup is concise and beautiful, but it greatly enhances the security and reliability of offline storage of private keys. In my opinion, it is an ideal solution for private key management.

Trezor’s official website introduces Shamir backup (https://trezor.io/learn/a/what-is-shamir-backup).

The amount of funds at this layer: %

Operating strategy: Only interact with the largest blue-chip DeFi projects, and try to minimize interactions, no unlimited authorization, and no NFT interactions.

Why haven’t I stored a large amount of funds in private key management when it is already so secure?

On the one hand, it is to prevent the one in ten thousand possibility, such as most of my private key shards leaking without my knowledge, which would make the wallet insecure. In addition, there is an attack vector that cannot be prevented, which is the 5wrench attack.

That is when someone has already put a knife to your throat and forces you to reveal the hardware wallet PIN code, do you value your life or money? Of course, you would honestly give up the password, so leaving some money inside can be considered as a way to minimize the loss.

To avoid this situation, we know how to deal with such crises in our daily lives. For example,

First, don’t carry the hardware wallet around for no reason. Without this attack point, if the attacker still needs to kidnap you to find the scattered shards around the world, they probably don’t have the patience and energy for it.

Trezor hardware wallet has a feature that you may need to know, which is the ability to set a WIPE CODE in advance. Once entered, all data in your hardware wallet will be erased, including the recovery seed information. Entering the WIPE CODE does not require you to connect to a computer. As long as there is power, whether it’s a charging protector, car charger, or anything else, you can enter it.

Second, don’t show off how much assets you have. Once the attacker knows your details, there is no talk of minimizing the loss. They will not stop until they have drained you.

3. Middle Layer of Cold Wallet

The outer layer of the cold wallet does not hold your core assets. It is at most a cover. As long as you keep the assets in the outer layer of the cold wallet safe, it means your private key remains secure. Even if it is stolen, your losses will not be significant, and you will have time to transfer the assets in the middle layer of the cold wallet.

What is the difference between this middle layer and the outer layer of the cold wallet? It uses the hidden wallet based on the LianGuaissphrase technology. These two official introductions are very detailed and interesting.

https://trezor.io/learn/a/passphrases-and-hidden-wallets

https://blog.trezor.io/passphrase-the-ultimate-protection-for-your-accounts-3a311990925b

LianGuais phrase can not only be used in Trezor, but also in Ledger. The way to use it is to add a word or any string (even including a space) that only you know on the basis of the original 24 mnemonic words (or 12 words). The longest can include 50 characters. This will guide the hardware wallet to derive a brand new address based on the original private key, because this LianGuais phrase does not exist in any storage medium, the only medium that keeps it is your own brain or the brain you tell your family, whether it is a hacker or a real-life robber, they have no way of knowing it, this will be the eternal secret between you and your family.

The amount of funds I have in this layer: ~50%

Asset type: LSD asset, native Ethereum SAAS POS pledge.

The Ethereum SAAS pledge method was mentioned in my previous article, https://mirror.xyz/darkforest.eth/Y-fvJCbGdJN0aFkAIFWH1vf7j5rRVblVpXERglgfAUg

As for why I chose to use the SAAS method for pledging, it is because this is the true Ethereum pledge method that allows you to control the withdrawal key and the verification key, which means truly controlling your own assets.

Operation strategy: no DEFI interaction, authorization, only transfer with the outer address of the cold wallet (transfer LSD assets). The only operation done on this wallet is the signature during the Ethereum pledge process and the interaction with the Ethereum POS deposit contract. And the withdrawal address for Ethereum pledge is also this address.

The Ethereum POS pledge also has an interesting feature, which is that you can receive the execution layer rewards with another wallet. This means that as long as you do not release the pledge in this wallet, the specified wallet will receive continuous pledge income every day. You can use a hot wallet to receive it and treat this money as your daily spending money, or you can keep the income address unchanged and wait for several years to accumulate another 32ETH pledge node.

In this operation strategy, the only way for hackers to break in is 1) to get the majority of your private key fragments, 2) to know the details of your real assets, 3) to obtain the LianGuais phrase from your mouth, 4) to learn that you have Ethereum POS pledge, 5) to sign and exit the pledge sequence, and patiently wait for 4-5 days to release the pledge. Only after going through these five steps can they truly obtain your assets.

In my opinion, the security of this intermediate layer of the cold wallet has reached a new height. Technically speaking, except for the possibility of the Ethereum deposit contract being compromised, I don’t know what other attack vectors it may have.

Ethereum Proof of Stake (POS) staking is a secure way to hodl coins. 0xdog (@ivanstarbb) made a wonderful discussion in his article, which I personally agree with (https://mirror.xyz/0x26DA4f747dD974f873Be9422918FAf1c3C0049D6/OY-mMHadkGKogrUg4_sDno-7vUOQBA3zS8MDEYqv4XI).

But that’s not all…

4. Cold Wallet Core Layer

The construction of the cold wallet core layer is similar to the middle layer, except that the weak point of the middle layer is that your LianGuaissphrase may not be strong enough. In the case where hackers directly obtain your private key, it will take a very short time to crack a commonly used LianGuaissphrase with a low number of digits. That’s why we need to build a deeper layer of security for the cold wallet.

The above table shows the cost of hacking passwords using different types and lengths of LianGuaissphrase under the current time dimension and the 2030 time dimension.

Seeing this table, my confidence suddenly turned into anxiety… Although I know that an attack has prerequisites, and the Ethereum you stake in the middle layer of the cold wallet will not be transferred immediately, giving you time to fight against the hacker, I can still do better.

I can further extend the LianGuaissphrase1 in the middle layer of the cold wallet. Perhaps what I and my family should store in our minds is not just a word, but a…spell…?

In addition, if the LSD project is likely to fail and the Ethereum POS deposit contract is also vulnerable to attacks, there is no code in this world that is inherently secure. So, I simply store only native assets in this layer, which are native bitcoins and ethers. Unless private keys can be cracked by quantum computers at the end of the universe, then cryptocurrencies will be worthless, and the security of this layer will lose any meaning.

The scale of funds in this layer: ~40%

Asset types: Native bitcoins and ethers

Operation strategy: Only transfers between wallets.

Summary

The simplest is the safest, as the saying goes. The less you operate and the less you move around, the more secure your wallet will be. Of course, you cannot be too outdated and reject new things or new experiences. What you can do is to follow the description in this article, grade risks, isolate assets, and occasional asset theft is not scary. What’s scary is when all your assets are taken away in one fell swoop. In a sense, doing so is also a gamble where you go all in every time. Long-term gambling will lead to loss. As long as there is a slight flaw, it is uncertain who will ultimately own the money you earned before.

The blockchain technology gives each of us the right to “private property inviolability” and the freedom of unrestricted capital flow globally. However, for many people, these rights and freedoms are too heavy, which means unlimited responsibilities and commitments. When the security of your assets depends solely on your thoughts, everyone involved can only continue to learn and draw from others’ experiences and lessons, make analogies, and then firmly grasp their own destiny in this bloody and brutal dark forest. Be well-prepared for the day when you can eventually enter the free world.

We will continue to update Blocking; if you have any questions or suggestions, please contact us!