NFT, DeFi and crypto hacks abound — Here’s how to double up on wallet security

NFT, DeFi and crypto hacks abound — Here’s how to double up on wallet security

The explosiveness and high dollar value of nonfungible tokens (NFTs) seem to either distract investors from upping their operational security to avoid exploits, or hackers are simply following the money and using very complicate strategies to adventure collectors’ wallets.

at the minimum, this was the case for me way back when after I fell for a typical message sent to me over Discord that caused me to slowly but all too quickly lose my most valuable assets.

Most of the scams on Discord occur in a very similar fact where a hacker takes a list of members on the server and then sends direct messages to them in hopes they will bite at the bait.

BEWARE: Several scams happening on Discord tonight. QUESTION EVERYTHING. Before clicking on links, quadruple check who it’s from and if it’s authentic. Then check 12 more times on Twitter via trusted supplies.

— Farokh (@farokh) October 27, 2021

“It happens to the best of us,” are not the words you want to hear in relation to a hack. Here are the top three things I learned from my experience on how to double-up on security, starting with minimizing the use of a hot wallet and simply ignoring DM’d links

A quick crash course in hardware wallets

After my hack, I was closest reminded and I cannot reiterate it enough, never proportion your seed phrase. No one should be asking for it. I also learned that I could no longer forego security at the privilege of convenience.

Yes, hot wallets are much more seamless and quicker to trade with, but they do not have the additional security of a pin and a passphrase like they do on a hardware, or cold, wallet.

Hot wallets like MetaMask and Coinbase are plugged into the internet, which makes them more unprotected and prone to hacks.

Contrary to hot wallets, cold wallets are applications or devices whereby the user’s private keys are offline and do not connect to the internet. Since they function offline, hardware wallets prevent unauthorized access, hacks and typical vulnerabilities by systems, something which are prone to when they are online.


A hardware based wallet stores the keys off of your main device. Your device that could have malware, meaningful loggers, screen capture devices, file inspectors, that could also be snooping for your keys.

I recommend a Ledger Nano S

— richerd.eth (マ,マ) gm NFT.NYC (@richerd) February 2, 2022

Moreso, hardware wallets allow users to set up a personal pin to unlock their hardware wallet and create a secret passphrase as a bonus inner of security. Now, a hacker not only needs to know one’s recovery phrase and pin but also a passphrase to confirm a transaction.

Pass-phrases are not as spoken about as seed phrases since most users may not use a hardware wallet or be familiar with the mysterious passphrase.

Access to a seed phrase will unlock a set of wallets that corresponds with it, but a passphrase also has the strength to do the same.

How do pass-phrases work?

Passphrases are in many ways an extension of one’s seed phrase since it mixes the randomness of the given seed phrase with the personal input of the user to compute a whole different set of addresses.

Think of passphrases as an ability to unlock a whole set of hidden wallets on top of the ones already generated by the device. There is no such thing as an incorrect passphrase and an infinite amount can be produced. In this way, users can go the additional mile and create decoy wallets as plausible deniability to travel any possible hack from targeting one main wallet.

Recovery seed/passphrase diagram. Source: Trezor

This characterize is advantageous when separating one’s digital assets between accounts but terrible if forgotten. The only way for a user to access the hidden wallets repeatedly is by inputting the exact passphrase, character by character.

Similar to one’s seed phrase, a passphrase should not come in contact with any mobile or online device. Instead, it should be kept on paper and stored somewhere obtain.

How to set up a passphrase on Trezor

Once a hardware wallet is installed, connected and unlocked, users who want to permit the characterize can do so in two ways. If the user is in their Trezor wallet, they will press the “progressive settings” tab, where they will find a box to check off to permit the passphrase characterize.

Trezor wallet landing page. Source: Trezor

Similarly, users can permit the characterize if they are in the Trezor suite, where they can also see if their firmware is up-to-date and their pin installed.

Trezor wallet landing page. Source: Trezor

There are two different Trezor models, Trezor One and Trezor form T, both of which permit users to activate passphrases just in different ways.

The Trezor form One only offers users the option to kind in their passphrase on a web browser which isn’t the most ideal in the event the computer is infected. However, the Trezor form T allows users the option to use the device’s touch screen pad to kind out the passphrase or kind it within the web browser.

Trezor form T / Trezor wallet interface. Source: Trezor

On both models, after the passphrase is entered, it will appear on the device’s screen, awaiting confirmation.

The flip side to security

There are risks to security, although it sounds counterintuitive. What makes the passphrase so strong as a second step of authentication to the seed phrase is exactly what makes it unprotected. If forgotten or lost, the assets are as good as gone.

Sure, these additional layers of security take time and the additional precaution and may seem a bit over the top, but my experience was a hard lesson in taking responsibility to ensure each asset was safe and obtain.

The views and opinions expressed here are solely those of the author and do not necessarily mirror the views of Every investment and trading move involves risk, you should conduct your own research when making a decision.

Click: See details

leave your comment