Bitcoin Security
Best Practices

How do hackers actually steal Bitcoin?

Here's the uncomfortable truth: most Bitcoin theft isn't some genius hacker breaking encryption. It's humans making mistakes. The cryptography behind Bitcoin has never been cracked. What gets cracked is people.

Phishing attacks

Fake wallet websites, fake customer support accounts on Twitter, fake browser extensions. You Google "Trezor Suite download," click the top sponsored result, and install malware that looks exactly like the real app. In 2023, fake Ledger Live apps on the Microsoft Store stole over $768,000 from users who didn't verify the download source. Always go directly to the manufacturer's website. Bookmark it.

SIM swap attacks

An attacker calls your phone carrier, pretends to be you, and transfers your number to their SIM card. Now they receive your SMS verification codes. If your exchange uses SMS-based 2FA, they're in. In 2019, a 21-year-old used SIM swaps to steal over $5 million in crypto from dozens of victims. This is why SMS 2FA is not real security.

Clipboard malware

You copy a Bitcoin address to send a payment. Malware on your computer silently replaces it with the attacker's address. You paste, check the first few characters (or don't check at all), hit send, and your Bitcoin goes to a stranger. Always verify the full address on your hardware wallet screen before confirming any transaction.

Exchange hacks and failures

Mt. Gox lost 850,000 BTC in 2014. Bitfinex lost 120,000 BTC in 2016. FTX collapsed in 2022 with billions in customer funds missing. These aren't ancient history. Exchange failures keep happening because exchanges are honeypots. They hold massive amounts of Bitcoin in centralized systems, making them prime targets. If your Bitcoin is on an exchange, it's not really yours. It's an IOU.

Social engineering

Someone in a Telegram group offers to "help" you with a wallet issue. A fake Ledger support agent asks for your seed phrase. An email claims your account has been compromised and you need to "verify" by entering your recovery words. No legitimate company, wallet maker, or support team will ever ask for your seed phrase. Ever. If someone does, they're trying to steal your Bitcoin.

What is the safest way to store Bitcoin?

The right storage method depends on how much Bitcoin you hold and how technical you want to get. Here's how to think about it in tiers:

If you hold less than $500, a good software wallet on your phone is fine. Don't overthink it. But the moment your Bitcoin represents money you'd be genuinely upset to lose, get a hardware wallet. It's $70 to $150. That's nothing compared to the peace of mind.

For holdings over $50,000, you should seriously consider multisig. A single hardware wallet is a single point of failure. Multisig spreads that risk across multiple devices and locations.

Need help picking a device? Compare the top hardware wallets for 2026.

How do you back up a seed phrase securely?

Your seed phrase is 12 or 24 words that can restore your entire Bitcoin wallet. Lose it and your hardware wallet breaks? Your Bitcoin is gone forever. Someone finds it? They take everything. This is the most important piece of data in your Bitcoin setup.

Paper vs. metal backup

Writing your seed on paper works, but paper burns, gets wet, and fades over time. Metal backups like Cryptosteel Capsule, Hodlr Swiss, or the Blockplate are fireproof and waterproof. For a $30 to $80 investment, your seed survives house fires, floods, and decades of storage. Worth every dollar.

Where to store it

A fireproof safe at home is the minimum. A bank safe deposit box works well as a second copy in a separate location. Some people split their seed using Shamir's Secret Sharing, but for most users a single metal backup in a good safe does the job. The key is geographic separation. If your house burns down, you still have access from another location.

What NOT to do

Never store your seed phrase in cloud storage (iCloud, Google Drive, Dropbox). Never email it to yourself. Never take a photo of it. Never type it into any website or app that asks for it. Never store it in a password manager. Every one of these methods creates a digital copy that can be hacked, leaked, or accessed by employees at those companies. Your seed phrase should exist only on physical media that you physically control.

The passphrase (25th word)

Most hardware wallets let you add a passphrase on top of your seed. This acts like a "25th word" that creates an entirely separate wallet. Even if someone finds your 24-word seed, they can't access your Bitcoin without the passphrase. It's an excellent extra layer, but if you forget the passphrase, that Bitcoin is gone. Write it down separately from your seed and store it in a different location.

Learn more in our complete guide to seed phrases and backup strategies.

Which hardware wallet is most secure?

There's no single "best" hardware wallet. It depends on your technical comfort level and what features matter to you. Here's a quick breakdown of the top options:

For a full side-by-side comparison with prices, features, and ratings, check our hardware wallet comparison table.

What is multisig and do you actually need it?

Multisig (multi-signature) means you need multiple private keys to authorize a Bitcoin transaction. The most common setup is 2-of-3: you create three keys, store them in different locations (or with different parties), and need any two of the three to sign a transaction.

Why does this matter? Because it eliminates single points of failure. If one key gets stolen, the attacker can't move your Bitcoin without a second key. If one key gets destroyed in a fire, you still have two remaining keys to recover your funds. It's redundancy built into the protocol.

That said, multisig is not for beginners. It adds real complexity to your setup. You need to manage three separate hardware wallets, store three separate seeds in different locations, and keep track of your wallet configuration file (the "wallet descriptor"). Lose the descriptor and two seeds? You might still lose everything.

When does it make sense? If you hold over $100,000 in Bitcoin or you're setting up long-term cold storage that you don't plan to touch for years. Also good for inheritance planning where multiple family members hold different keys.

Tools for multisig: Sparrow Wallet (free, DIY), Unchained Capital (guided, paid), and Casa (managed, subscription). Sparrow gives you full control but requires more technical skill. Unchained and Casa hold one of the three keys and provide support if you need help.

Compare all the options in our multisig wallet comparison.

Does running a Bitcoin node improve security?

Yes, and it's one of the most underrated security upgrades you can make.

When you use a wallet without your own node, you're trusting someone else's server to tell you what's happening on the blockchain. That third-party server could lie to you, censor your transactions, or log your addresses and IP. Running your own node means you verify every transaction yourself. You don't trust. You verify. That's the whole point of Bitcoin.

A full node also improves your privacy. When your wallet connects to your own node, nobody else can see which addresses belong to you. If you connect to a public Electrum server, the server operator knows exactly which addresses you're watching.

You don't need expensive hardware. An old laptop, a Raspberry Pi, or a dedicated node box like Start9 or Umbrel works fine. The Bitcoin blockchain is about 600 GB, so you need at least a 1 TB drive.

Ready to set one up? Our guide walks you through running your own Bitcoin node.

What about Bitcoin privacy and security?

Privacy and security aren't the same thing, but they overlap more than most people realize. Poor privacy directly weakens your security.

Address reuse is the most common privacy mistake. Every time you reuse a Bitcoin address, you make it easier for chain analysis companies to link your transactions together and estimate your total holdings. Use a wallet that generates a new address for every transaction. Sparrow Wallet and most hardware wallet companion apps do this automatically.

KYC data leaks are a growing threat. When you buy Bitcoin on a KYC exchange, your identity gets linked to your purchase. If that exchange gets hacked (and many have), your name, address, and Bitcoin holdings become public. The 2020 Ledger database leak exposed 270,000 customer names and home addresses. Some of those people received physical threats.

Chain analysis companies like Chainalysis work with governments and exchanges to track Bitcoin transactions. They can follow funds across dozens of hops. If you care about financial privacy, you need to think about where you buy, how you transfer, and who can connect your identity to your addresses.

Dig deeper in our Bitcoin privacy guide.

What are the most common Bitcoin security mistakes?

Most Bitcoin losses aren't sophisticated attacks. They're avoidable mistakes that people keep making. Here are the ones I see over and over:

• Reusing Bitcoin addresses. Every time you receive Bitcoin to the same address, you're linking those transactions together on a public ledger. Use a new address for every receive. Your wallet does this automatically if you let it.
• Storing seed phrases digitally. Screenshots, Notes apps, cloud docs, email drafts. All of these are searchable by hackers and accessible to company employees. Seed phrases go on paper or metal. Nothing digital. Period.
• Using an exchange as a wallet. Not your keys, not your coins. This phrase exists because people kept learning it the hard way. Mt. Gox. QuadrigaCX. FTX. Buy on exchanges, withdraw to your own wallet.
• Sharing holdings publicly. Posting your portfolio on Twitter or telling friends how much Bitcoin you own makes you a target for the $5 wrench attack. Criminals don't need to hack your wallet if they can threaten you in person.
• Weak exchange passwords. If your Coinbase password is the same one you use for Netflix, you're one data breach away from losing everything. Use a password manager and generate unique, long passwords for every exchange account.
• No 2FA or SMS-only 2FA. SMS can be intercepted through SIM swaps. Use an authenticator app at minimum, a hardware security key like YubiKey if possible.
• Using public WiFi for transactions. Open networks can be monitored. If you must transact on public WiFi, use a VPN. Better yet, just wait until you're on a trusted network.

Every one of these mistakes is free to fix. There's no excuse for getting lazy with security when the cost of a mistake is permanent loss.

How do Bitcoin security methods compare?

Here's a side-by-side look at the most common ways to secure Bitcoin, from basic to advanced:

The right choice depends on how much Bitcoin you hold and your comfort with technology. Most people should be at the "Hardware Wallet" tier at minimum. If you're reading a security guide, you probably care enough to do it right.

Bitcoin security checklist

Print this out or save it somewhere safe. Go through each item and check it off. If you can tick every box, you're ahead of 95% of Bitcoin holders.

Frequently asked questions about Bitcoin security