The Security Hustle: Protecting My Bitcoin From Hackers

Bitcoin, the world’s first and leading cryptocurrency, has proven its mettle in its roughly fifteen years of existence. From 2011 to 2021, it was the world's best-performing asset class in eight of the last eleven years. At the end of 2023, it reemerged as the world's top-performing asset class.

It is also a trillion-dollar asset. BTC's market capitalization is at $1.13 trillion as of this writing. This value is outside the overall crypto market cap and excludes all other crypto coins. From a fledgling currency in 2008, its value has risen from nearly zero to over $73,000, reaching a historical all-time high in 2024.

Bitcoin has minted many new millionaires and several billionaires. Famous founders of multi-billion dollar corporations involved in crypto include Brian Armstrong of Coinbase, Changpeng Zhao (CZ) of Binance, and Michael Saylor of MicroStrategy.

With such a meteoric rise, it's hardly surprising that hackers keep trying to find ways to steal Bitcoin. As a Bitcoin owner, protecting your assets from cyber threats is critical. Here, we explore how BTC holders can protect their coins across platforms and activities.

The Current BTC Security Landscape

Hacks and losses in the crypto sphere are nothing new. In the second quarter of 2024 alone, the crypto ecosystem lost about $572.7 million due to fraudulent attacks and hacks. The figure is up 112 percent compared to the same period last year.

The year's most significant BTC hack so far is that of DMM Bitcoin, a Japanese crypto trading platform. On May 31, 2024, DMM Bitcoin lost around $305 million worth of BTC.

Moreover, the year-to-date (YTD) losses from crypto fraud and hacks have reached $920.9 million—up 24 percent from $720 million the previous year. May and June have seen exceptionally high losses, making up $358.5 million of total crypto incidents. Centralized finance (CeFi) platforms accounted for 70 percent of all losses.

Hacking vs. fraud analysis: Hacks cause 98.5 percent of losses

According to a report by Immunefi, a leading bug bounty platform, hacks are responsible for most crypto losses. As of the second quarter of 2024, hacks remain the predominant cause of losses versus fraud. Fraud accounts for only 1.5 percent of the overall crypto losses in Q2 2024. Hacks, on the other hand, account for 98.5 percent.

Hacks

In Q2 2024, the crypto ecosystem lost $564,238,811 to hacks spread across 53 incidents. This figure represents a 155 percent increase versus Q2 2023 when losses caused by hacks amounted to less than half: $220,522,129.

Fraud

Fraud-related loss in Q2 2024 was $8,450,050, spread across 19 specific incidents. These numbers represent a decrease of 81 percent compared to the same period last year.

Bitcoin hackings you should know about

Despite advancements in blockchain technology and security measures, Bitcoin and other cryptocurrencies remain vulnerable to hacking and security breaches.

To understand how Bitcoin hacks happen, you should understand their progression and history. Here, we examine some of the most significant Bitcoin hacks and analyze what went wrong.

The KuCoin hack

In September 2020, Singapore-based KuCoin, a major cryptocurrency exchange, suffered a security breach. The intrusion resulted in the theft of over $280 million worth of cryptocurrencies, including 1008 Bitcoin. The hackers gained access to the exchange's hot wallets by exploiting weaknesses in its security protocols. According to KuCoin's CEO, its cold wallets were unaffected.

In retrospect, enhanced security audits to identify vulnerabilities could have prevented the hack. It could also have been mitigated by using multi-signature or multisig wallets for the exchange's hot storage and storing the more significant portion of assets in cold storage to minimize the accessible amount.

This Kucoin hack is not the first of it’s kind and certainly not the last. Just in June 2024 Kraken’s chief security officer disclosed “extremely critical” zero-day flaw in Kraken’s platform to steal $3M dollars. Here is how it was described:

The ‘security researcher’ disclosed this bug to two other individuals who they work with who fraudulently generated much larger sums. They ultimately withdrew nearly $3 million from their Kraken accounts… They demanded a call with their business development team (i.e. their sales reps) and have not agreed to return any funds until we provide a speculated $ amount that this bug could have caused if they had not disclosed it. This is not white-hat hacking; it is extortion!

The Coinbase hacks of 2019 and 2021

Coinbase is one of the most trusted platforms in the Bitcoin and crypto ecosystem. It is particularly dominant in the USA. As of this writing, Coinbase handles billions of dollars in transactions and has a market cap of $55.24 billion.

The first significant breach that shook Coinbase and the crypto community occurred in 2019. The hack showed the ingenuity of the attackers. It was also a wake-up call for the whole cryptosphere, as it was more sophisticated than anyone expected.

The attackers accessed Coinbase's internal systems using a sophisticated phishing campaign. They targeted employees with spear-phishing emails carefully crafted to appear legitimate communications from a trusted source.

Over a dozen Coinbase employees initially received an email from Gregory Harris, supposedly a Research Grants Administrator at the University of Cambridge in the UK. The first email was dated May 30, 2019.

According to Coinbase, the email came from the legitimate Cambridge domain. It had no apparent malicious elements, passed spam detection, and appeared from a knowledgeable source, referencing the recipients' backgrounds. Over the two weeks, the address continued sending emails, and nothing seemed amiss.

The attacker sent a follow-up email on June 17. This time, the new email contained a malicious URL. If opened via a Firefox browser, it would install malware that could take over the target user's computer. According to Coinbase's security team, the emails were part of a "sophisticated, highly targeted, thought out" attack.

Upon entering the network, the hackers moved laterally to escalate their access privileges. They exploited a Firefox zero-day vulnerability—an issue that had not yet been patched. Moreover, the attacks used not one but two Firefox zero-days, according to Philip Martin, the company's chief information security officer, in 2019. Coinbase reported the attacks to Mozilla.

The vulnerability enabled the hackers to gain administrative access to the exchange’s backend network and critical systems, including databases for storing user information and private keys. In other words, a successful attack would allow a hacker to steal funds from the exchange. The tactic has been used numerous times and led to gigantic losses in crypto exchanges.

This particular hack was unique because the attackers demonstrated remarkable patience and precision. They chose a more calculated, insidious, and covert approach over a swift and noisy attack.

However, the breach was eventually detected. During a routine security audit, Coinbase's security team noticed unusual patterns of withdrawals. They launched an investigation and discovered the breach. They then acted swiftly to contain the damage. They secured the compromised systems, patched the exploited vulnerabilities, and enhanced their monitoring capabilities.

After the hack, Coinbase publicly disclosed its details and mechanics. They assured users and the broader crypto community that the company's insurance policy covered most of the stolen funds and that no customer funds would be lost.

Nonetheless, the incident had far-reaching implications. It highlighted the vulnerabilities inherent in even the most secure platforms and underscored the need to continuously improve cybersecurity practices.

The Coinbase security team walked back the entire attack, contained it, and reported the zero-day to Firefox.

The second breach that affected Coinbase was in late 2021. It involved the theft of approximately $100 million worth of cryptocurrencies, including BTC. Coinbase detected a platform vulnerability that enabled hackers to exploit a flaw in the crypto transfer process. The vulnerability led to unauthorized transactions and financial losses for some users on the platform.

The Bitfinex hack of 2016

Though it happened further back in the past, the Bitfinex hack is worth mentioning due to its magnitude. Hackers stole 119,756 BTC, valued at around $72 million. Today, based on the BTC price as of this writing, the same amount of BTC would be roughly $6.5 billion.

This particular hack occurred due to vulnerabilities in the multi-signature security system that Bitfinex employed in collaboration with BitGo. It could have been avoided by using advanced authentication protocols, user behavior monitoring, and segregated wallet structures to limit exposure.

BTC Security: Who should care?

Bitcoin security affects large coin holders and average ones alike. Bitcoin is used for different purposes, not just as a plain vanilla investment tool you buy and hold. It can be a payment vehicle or trading instrument.

It can be used as collateral and an underlying asset for various derivatives and derivative-like products. Its value and use cases are expanding as it is now used as the underlying for large-scale ETFs. Thus, you want to ensure your wallet is safe to protect your spending or day-trading money.

According to Chainalysis, the number of unique Bitcoin addresses has ballooned to 460 million. While it is impossible to determine how many people own Bitcoin accurately, we can estimate its popularity based on the number of generated addresses over the years.

We can also gauge active users through the number of wallets with active balances. According to BitInfoCharts, a blockchain analysis firm, over 67 million wallet addresses have a balance of $1 or more. Of these addresses, 40.5 million have a balance between $1 and $100, showing that most Bitcoin holders have a small amount of money invested.

Prominent American entrepreneur Tom Lee predicts that BTC could rally to $150,000 in the coming months. Lee claimed that the asset’s valuation has been negatively affected lately due to the issues related to the now-defunct crypto exchange Mt. Gox.

The Mt. Goz "overhang," as he calls it, brought down the price due to the long overdue payouts from its bankruptcy proceedings, paying back thousands of users up to almost $9 billion in assets. He expects the overhang to disappear sometime in July.

Your small investment could yield appreciable returns if you buy and hold. Because of its long-term potential, security should matter to all BTC holders.

The security of an individual also affects the ecosystem. KYC hacks and leaks affect an individual's privacy and identity, enabling malicious attackers to trace their activities. Such hacks can also be detrimental at the large investor or institutional level, leading to massive losses or draining the funds of individual investors signed up on a platform.

In addition, BTC and crypto losses negatively impact the markets. Therefore, security is a shared responsibility of BTC holders of all sizes.

The Importance of Using Secure Platforms

Given its high price and widespread appeal, BTC remains a target for hackers. If you are invested in Bitcoin, choosing a secure platform for buying and storing Bitcoin is crucial for protecting your investments.

Crypto custody solutions

Crypto custody solutions are businesses providing third-party crypto asset security and storage services. They mainly target accredited investors or institutions with significant Bitcoin or crypto holdings. Such clients include hedge funds, Bitcoin exchange-traded funds (ETFs), and exchanges.

These custody solutions generally combine hot and cold storage. Hot storage keeps you connected, but cold storage ensures your assets are safely offline.

Dealing with crypto custody solutions providers requires understanding various crypto security procedures, hot and cold wallets, multisig solutions, and other best practices to ensure your crypto is safe.

Which platform offers the best BTC storage and security?

The answer to this question depends on your needs as a Bitcoin investor or holder. If you wish to buy BTC, you have several reliable options.

According to investment strategist Lyn Alden, you can use Swan Bitcoin to buy BTC. Beyond a place to make one-time or recurring purchases for dollar-cost averaging (DCA), you should consider it as a Bitcoin accumulation platform. Swan provides Bitcoin IRA services for those investors who are serious about accumulating wealth long term.

Fees for all trades are 0.99 percent of each purchase. They do this without taking a spread on your purchase, too, and the first $10,000 worth of BTC has zero fees.

User-friendly security

Some notable security-related features include free auto-withdrawal to a self-custody address. Keeping your BTC with Swan's custodian is also free, and you can access it through them with the BTC held in your name.

One simple yet ingenious way to use these features is to dollar cost average DCA into Bitcoin utilizing a plan that automatically buys BTC at regular intervals. The platform can also send it to your hardware wallet or another secure custody solution.

According to their website, all Swan data is encrypted with military-grade AES-256 encryption, and traffic on the site is encrypted with industry-standard TLSv1.2 encryption. Moreover, Swan does not have access to nor store private keys for BTC that are stored with its custodial partners.

Currently, Bakkt and Fortress Trust are the custodians of record. BitGo is its cold storage custodian.

Some would consider Swan Bitcoin a Coinbase alternative for buying and storing BTC in the US. While Coinbase is the dominant player in the exchange business, Swan simplifies BTC investment for retail and institutional investors.

Essential Security Tips To Safeguard Your BTC

The persistent attempts to hack BTC are a stark reminder of the ever-present risks lurking in the digital world. For users, it underscores the importance of personal security measures. Among these are enabling two-factor authentication and using hardware wallets for long-term storage of cryptocurrencies.

The following are some concepts and tips that will help you protect your BTC holdings:

Enabling two-factor authentication (2FA)

Two-factor authentication (2FA) provides a second or additional layer of account security by requiring a second form of ownership verification outside your password. It is best defined as a process that increases the likelihood that a person is who they say they are.

Rather than simply using a username and password, the 2FA process requests users to provide two authentication factors before accessing a crypto-related wallet, app, or platform.

Organizations must use 2FA to protect their data and users in the face of a high-risk cybersecurity landscape, specifically in BTC and crypto, wherein you can expect a higher volume of increasingly sophisticated cyberattacks.

One helpful way to frame 2FA is as a process that encourages people and organizations to stop solely relying on passwords to enter applications and websites.

With 2FA, cybercriminals have more difficulty stealing users’ identities or accessing their devices. The measure also helps organizations fend off attackers, even when a password has been stolen from one or several users.

Companies and individuals are using 2FA to prevent common cyber threats. These include phishing attacks that use users' passwords and spoof targets' identities after gaining credentials.

Setting up 2FA for Bitcoin

To set up 2FA for your BTC wallet, download a trustworthy authenticator like Authy, Google Authenticator, or other comparable apps.

Access your BTC account and look for the 2FA section. Click "Enable 2FA". Link your account to the authenticator app by selecting "Scan QR Code" or "Add Account" on Google Authenticator. Afterward, scan the QR code shown on the BTC or crypto platform.

Some systems provide additional backup codes called recovery keys. These codes are vital for account retrieval. You must store these codes in a safe location. If you misplace or lose your device with the corresponding authenticator app, you can use the backup codes to recover your Bitcoin wallet or account access.

To complete your setup, you must enter the time-based one-time password (OTP) generated by the authenticator app when asked by your BTC or crypto platform.

Log out of your account and try to re-access it to test your 2FA setup. This time, the wallet, app, or platform should ask you for an OTP from your authenticator app.

Other 2FA techniques utilize SMS or email verification. While these are better than nothing, they are less safe and vulnerable to more attacks. SMS is susceptible to SIM-swapping attacks. Utilizing an authenticator app is deemed more secure.

Hardware-based 2FA is a more stringent security measure that involves physical devices like YubiKey for verification. However, authenticator apps will do very well for regular everyday use.

Ensure that your authenticator app is up to date and that your recovery keys are kept in a safe place, preferably offline.

Hot vs. cold wallets

As a BTC holder, you must understand the difference between hot and cold crypto wallets. Hot wallets are software that stores your BTC private keys on a device that's online or connected to the Internet. They are convenient and easily accessible via online devices like mobile phones, tablets, or laptops.

Hot wallets often have more activity—they usually handle smaller, more frequent BTC transactions—and are convenient for trading. However, because they are online, they are vulnerable to hacks.

On the other hand, cold wallets aren't connected to other devices or the Internet, making them less vulnerable to hacks and a more secure method of storing BTC private keys.

Cold wallets are usually hardware devices that resemble modified USB sticks or mini plastic cards with buttons and screens. They cost between $50 and about $300, although they could be more expensive. Popular brands include Ledger and Trezor.

Cold wallets like paper or metal wallets that record your private keys can be more straightforward. Their enhanced security is derived from their being offline. To trade funds from a cold wallet, you need to move them to a hot wallet that's connected to a crypto exchange.

When you set up your hardware wallet, remember to write down your recovery seed phrase on paper and store it offline in a highly secure location. Please do not share this information with anyone or store it digitally.

Stay updated with the latest security measures

The Bitcoin and crypto space are continually evolving, and so are the hacking methods that threaten them. Thus, it is crucial to stay abreast of the latest security measures.

Keep all your software updated to protect against newly discovered vulnerabilities. Read reputable sources for updates and security news.

Protecting Your BTC Requires a Proactive Approach

In a dynamic tech and crypto sphere, the only way to stay ahead of hackers is to be proactive about your security. Ensure you have all the basics covered: choosing a secure platform, enabling two-factor authentication, and using cold storage or hardware wallets to protect your BTC wealth.

However, as hacks and exploits become more sophisticated, you can only fully secure your BTC when constantly updated on the latest security news. Also, ensure that your platforms and apps are continually on top of threats. If you are a buy-and-hold investor, ensure that your BTC funds are in cold storage.

Security in BTC can be effectively summarized by the old and oft-quoted adage from the early days of Bitcoin: "Not your keys, not your coins." Make sure you have ultimate control over your private keys. And if you do choose a platform to hold them temporarily or entrust them with custody, understand the nuances of the agreement and infrastructure.

Bitcoin was meant to be decentralized, so the more autonomous you are about managing your keys, the better security you have.

This is a guest post by Ivan Serrano. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.