Bitcoin Cold Storage: How to Protect Your Assets in 2024

With an electronic form of money that exists only in cyberspace, how could we ever be sure our private keys are secure from hacks and bad actors?

TL; DR: While keeping Bitcoin on exchanges offers some protection, it also carries risks like potential hacks or legal issues, as experienced by Mt. Gox and FTX users.

Cold storage is THE most secure method, allowing users to have self-custody of their Bitcoin and control it through private keys, thus mitigating risks associated with exchanges.

• Leaving Bitcoin on an exchange can keep it relatively safe from self-inflicted wounds but poses an entirely new set of risks to savers.

• Exchange hacks like the infamous Mt. Gox or the collapse of FTX could leave you fighting to regain control of your funds for years, only to be left with scraps of your initial stack.

The cold storage solution

Cold storage is the gold standard for Bitcoin security. Its the best way to live a sovereign existence by leveraging Bitcoin’s native properties. As a digital bearer asset, Bitcoin can (and should) be withdrawn from exchanges and secured in self-custody.

That’s all well and good, but what does it actually mean?

Let’s dive into self-custody, cold storage and how they work in 2024.

Cold storage is a type of self-custody where individuals hold their private keys in a manner that keeps them off devices that are connected to the internet. It’s a similar concept to physical two-factor authentication devices like Yubikey.

You can essentially create your own vault in cyberspace, accessible anytime, anywhere, but only unlock it with a physical private key that could be hidden anywhere.

There are several different cold storage solutions. Some of the most popular physical device options include:

• Coldcard

• Passport

• Bitkey

• Blockstream Jade

NOTE: You can score yourself a FREE Blockstream Jade wallet by joining us for Pacific Bitcoin 2024. Details.

• Offline Security:

  • Your private keys are stored offline, eliminating the risk of online hacks.

  • Even if your phone or computer is compromised, bad actors can only view your balances, not move your Bitcoin.

• Physical Security:

  • Offline devices used for signing transactions remain secure.

  • Attackers need physical access to these devices to move your Bitcoin.

• National Security Measures:

  • Bitcoin cold storage is so essential to safeguarding Bitcoin that on March 18th, 2024, El Salvador officially took self-custody of a large portion of its national Bitcoin treasury.

Setting up cold storage can be intimidating… but it is actually quite simple.

The most comprehensive library of instructional videos resides on YouTube, created by Bitcoin Legend BTC Sessions.

Below, we will walk you through a broad overview of the steps involved. 

Once you purchase your hardware wallet, you need to set it up. Devices like Passport come with native apps that give you step-by-step instructions. Others, like the ColdCard, may require a little assistance from BTC Sessions mentioned above, but all have the same general process.

1. Power Up and Create a PIN:

   • Upon power-up, devices will ask users to create a PIN.

   • It’s important to remember the PIN, but it’s not a critical mistake if you forget it.

2. Generate and Secure Your Seed Phrase:

   • After a PIN is created, the device will generate your seed phrase.

   • The seed phrase is a string of 12 or 24 words cryptographically hashed into your public key or receive addresses.

   • The seed phrase is your private key, the secret that allows you to control your Bitcoin.

   • It is recommended that seed phrases be backed up to protect them from fire or water damage.

3. Backup and Confirm Your Seed Phrase:

   • The seed phrase allows you to restore your wallet if you forget your PIN or if the device breaks.

   • Recording and securing your private key properly is the most important step in this process.

   • Devices often allow you to reenter your private key to confirm you recorded it correctly. If optional, take this extra step for another security check.

   • Do not, under any circumstances, enter your private key or seed phrase into any internet-connected device.

4. Export a Public Key:

   • Wallets will allow you to export a public key into Bitcoin wallet software to generate an interface with your wallet. This is often called uploading a “watch-only wallet.”

   • After confirming your key, you can export your extended public key (XPUB) from your device to whatever Bitcoin wallet software you choose.

5. Choose Wallet Software:

   • When you export your XPUB, a new address is generated.

   • Wallets require a signature from your device to send Bitcoin.

   • Popular software options include:

     • Sparrow: A popular desktop option with a lot of functionality.

     • Blue Wallet: A good mobile option for those who want to keep tabs on their Bitcoin on the go.

6. Learn from BTC Sessions:

   • BTC Sessions has helpful demonstrations for both mobile and desktop options.

• Redundancy:

  • Bitcoin exists everywhere all at once; users can upload their XPUBs to multiple software wallet interfaces simultaneously.

  • The same private key can be used on multiple hardware devices for redundancy.

  • However, this is not recommended because it increases your attack surface.

The first step to creating paper wallets is to NOT DO IT. Set up a hardware wallet instead.

• Exposure to Damage:

  • Paper wallets expose you to an increased risk of loss due to fire or water damage.

• Dependency on Websites and Software:

  • Paper wallet generators depend on websites and software downloads.

  • These may contain malware that can steal your private keys.

1. Choose a Reliable Website:

   • Use websites like bitaddress.

2. Disconnect from the Internet:

   • Make sure to disconnect your computer from the internet before generating your keys.

3. Run Virus and Malware Scans:

   • Run virus and malware scans before generating keys.

4. Generate Keys Offline:

   • Access a computer not connected to the internet.

   • Run the software through a USB drive and generate your keys.

   • This will provide you with a public and private key pair, typically presented as two QR codes with strings of hashed data.

5. Print and Secure the Keys:

   • Print the keys on a piece of paper to create your Bitcoin wallet.

   • Ensure you delete all digital copies of the wallet once you’ve printed them out. If they remain cached on your device, it leaves you open to theft if your devices become compromised.

6. Store Your Private Keys Securely:

   • Store the private keys similarly to valuables or jewelry.

   • A fireproof safe or safety deposit box are both great options.

   • However, it cannot be guaranteed that your paper keys will remain viable when exposed to water, humidity, or heat.

• Generate Paper Keys at Your Own Risk:

  • Be aware of the potential risks and take necessary precautions if you use a paper wallet.

The best option for securing your private keys and hardware wallets is immediately taking them on a boating trip, accidentally throwing them away, or losing them at the bottom of a large body of water. Joking aside, it’s not a big deal if you lose access to your hardware wallet, provided you backed up your seed phrase correctly. However, losing access to your seed phrase means you lose access to your Bitcoin.

1. Verify Your Seed Phrase Backup:

   • After setting up hardware wallets, send a small amount of Bitcoin to your address.

   • Wipe your device and restore it with the seed phrase to ensure you can regain your wealth if the hardware is lost or no longer functional.

2. Physical Security of Private Keys:

   • The key to maintaining security in your cold storage is to ensure that private keys remain secret and secured.

   • Signing devices or hardware wallets should also be hidden and secured, but in a different location from their private keys or seed word backups.

3. Secure Storage Options:

   • Many people lock their keys in safes or hide them in unusual locations.

   • Companies like Crypto Cloaks make products that allow you to mount your hardware wallets wherever you want.

4. Creative Hiding Places:

   • Some Bitcoiners are known to hide their seed phrases inside walls or furniture.

   • Be mindful that the most secure setups may add complexity, resulting in unforeseen errors that prevent you from recovering your Bitcoin.

When setting up your Bitcoin cold storage, there are a few hard and fast rules to follow.

1. Treat It Like a Valuable Asset:

   • Treat your Bitcoin cold storage as you would treat any valuable bearer asset like jewelry, large amounts of cash, or ammunition.

2. Plan for Long-Term Security:

   • Treat your Bitcoin as if it’s worth at least 10 times more than it currently is.

   • Bitcoin’s value tends to explode in short periods of time. Plan your security for the long term so you’re not scrambling in the bull market to make your storage safer.

1. Geographical Distribution:

   • Geographical distribution is a popular method for enhancing security.

   • Hide your seed phrase in your friend’s or family member’s home.

   • Divide the seed phrase into several pieces and distribute those to multiple parties.

2. Follow Proven Guidelines:

   • Follow these two guidelines, and you should be all right.

   • For those seeking more specificity, consider additional best practices detailed below.

1. Backup and Verify Your Seed Phrase:

   • Always back up your seed phrase and verify it by restoring your wallet.

   • Ensure your backups are stored in a secure, fireproof, and waterproof location.

2. Use High-Quality Hardware Wallets:

   • Invest in high-quality hardware wallets known for their security features.

   • Regularly update the firmware of your hardware wallets to protect against vulnerabilities.

3. Keep Hardware and Keys Separate:

   • Store your hardware wallet and seed phrase in different locations to minimize risk.

   • Avoid storing digital copies of your seed phrase on internet-connected devices.

4. Educate and Train:

   • Educate yourself and anyone else involved in your Bitcoin security about best practices.

   • Regularly review and update your security measures as needed.

By following these considerations and best practices, you can ensure the long-term security of your Bitcoin cold storage.

What: Users store private keys on a purpose-built piece of hardware.

• Enhanced Security: Private keys never touch the internet, which reduces the risk of losing them.

• Long-Term Storage: Suitable for long-term storage.

• Recoverability: If you lose your hardware wallet, you can use the backup seed phrase to restore your wallet.

• Seed Phrase Security: Users must secure a seed phrase backup, requiring a thoughtful strategy to protect it.

• Physical Theft Risk: If your hardware wallet is stolen, your funds risk being hacked. Protecting seed phrase backups is standard practice for wallets where the user controls the private keys.

• Blockstream Jade

• Coldcard

• BitBox

• Bitkey

What: Typically involves printing out your Bitcoin public and private keys on paper.

• Secure and Offline: Reduces online hacking risks.

• Full Control: Offers full control over private keys and Bitcoin assets.

• Cost-Effective: Easy to create with just a printer and paper.

• No Hardware Failures: Not prone to hardware failures like digital devices.

• Physical Damage Vulnerability: Secure but vulnerable to physical damage.

• Inconvenient for Frequent Use: High risk of irreversible loss if lost or stolen.

• Lack of Recovery Options: Require secure storage and carry a risk of key interception during printing if the printer is not secure.

• Paper wallets are not very reliable. Imagine a baby with a book: sometimes it’s cute, but other times they just tear it apart or try to eat it. Now, picture that baby with your paper wallet after just hitting your first full Bitcoin. It’s not a great option if you want to store wealth long-term.

Bitcoin cold storage rules are similar to Fight Club. Don’t talk about it unless you completely trust the person, like a spouse or next of kin. No device is perfect; all will inevitably have vulnerabilities that can be exploited.

• Beware of Phishing Scams: Downloading software updates from emails is a surefire way to get your coin jacked from a phishing scam.

• Keep Seed Phrases Offline: Once your key is generated and backed up, NEVER type it into a device connected to the internet. Your phone or computer’s notepad is not a great place to store seed phrases.

Now that you have a clearer understanding of the importance of securely storing your Bitcoin, it’s the perfect time to start your Bitcoin journey.

Buy Bitcoin with Swan today and take the first step towards a more secure and sovereign financial future. With Swan, you’re not just buying Bitcoin; you’re investing in peace of mind.

If you already have some Bitcoin but are seeking an alternative to Coinbase, because you are unsure if its safe to use anymore learn how to delete your Coinbase account in only 3 easy steps.

Thinking about Bitcoin retirement options? Consider a tax-free Bitcoin IRA option with Swan IRA.

Swan is a leading Bitcoin financial services company with more than 120,000 clients and 170 employees, operating globally. Established in 2019, Swan helps individuals and institutions to understand and invest in Bitcoin. The Swan app simplifies Bitcoin purchases with instant and recurring buys. Swan IRA provides a tax-advantaged solution for saving Bitcoin in retirement accounts.

For HNWIs and businesses, Swan Private provides white-glove service for large purchases, treasury solutions, and employee Bitcoin benefits. With Swan Vault, clients can easily custody their own Bitcoin with peace of mind. Financial advisors trust Swan Advisor for client Bitcoin allocations, backed by world-class custody and educational content.

Swan Managed Mining provides clients with fully segregated and dedicated mining operations, catering to their unique requirements, opportunities, and strategic advantages. Swan prides itself on exceptional client service, making Bitcoin accessible to all. For more information, please visit swan.com.