The search for security and safety amid cryptocurrency chaos

In a volatile market where key players have suffered high-profile failures, iStorage CEO, John Michael, considers the best way to keep crypto funds secure and entirely under control.

Cryptocurrency is unpredictable. But outside of its potential as decentralised currency – and the ability of the blockchain, the shared database crypto relies upon, to act as an immutable ledger of transactions – its volatility may be its key selling point. Bitcoin, Ethereum and their ilk have the potential to fluctuate in price wildly. One day an investment of fiat currency, for example, may produce a massive loss in the crypto market but the next could offer huge growth.

Crypto’s big problem is that the volatility gamble does not only apply to currencies. It can just as easily affect the tools that make crypto work. When trouble strikes a crypto exchange, an online entity which switches out real-world currency for crypto tokens as well as storing that crypto online, one’s investment could not only lose value – it could be lost entirely.

Notable crypto disasters

Transactions on the blockchain are irreversible. If a criminal infiltrates an online wallet and transfers its contents, there is no hope of a resolution. In the case of Japanese exchange Mt. Gox, for example, a breach saw the company’s ‘hot wallet’ – essentially an online account used to hold cryptocurrency for quick transfers or sales – emptied by hackers, losing 7% of the world’s Bitcoin, most of which belonged to its customers . The attacking party transferred and ‘washed’ the coins, automatically scattering them between anonymous wallet addresses to make tracing their whereabouts on the blockchain impossible.

It is also a given that the company behind the exchange is operated properly and is trustworthy. The recent high-profile collapse of crypto exchange FTX happened because customer deposits were mishandled, loaned to owner Sam Bankman-Fried’s hedge fund second business, and otherwise lost to risky bets. When this was discovered, major investors bailed, a potential takeover was dissolved, and the crypto market itself crashed. End-user customers were left without financial recourse, their fiat currency gone, and their crypto deposits locked into FTX’s platform while a block on withdrawals was instituted.

An exchange alternative

Crypto exchanges are not inherently unsafe. Yet FTX’s fall has certainly created increased wariness from investors. Exchanges are a necessary means to trade digital currency for hard currency, but that’s as far as trust should go. Taking the decision to store crypto offline provides full control over funds and isolates them from any potential online disaster. Setting up an offline wallet, otherwise known as a ‘cold wallet’, is a simple process which allows the movement of funds away from exchanges and into a software package stored on a device controlled by the funds’ owner.

Once that currency has been transferred, it becomes completely hidden from the internet. The token that then represents the cryptocurrency itself remains stored on the blockchain, but its location – and the cryptographic keys required to access it – are known only to the offline wallet. For all intents and purposes that currency disappears. Although, as we will discuss, a cold wallet comes with its own vulnerabilities, its offline nature makes it the safest way to store cryptocurrency.

Protecting the cold wallet

There are some downsides to moving cryptocurrency offline. Managing offline storage requires a little more attention than simply relying on the streamlined tools of an exchange. Cold wallets such as Ledger, Trezor, and KeepKey can remain safe offline indefinitely, but they must be periodically connected to the internet to update the value of their crypto portfolio, to update the investor on their contents, or to transfer money away from them. They are by far the most secure method of cryptocurrency storage, but cold wallets are also not impervious to hacking. If an attacker were able to gain access to the hardware containing the wallet itself, or the seed phrase (a mnemonic phrase to recover a lost or broken crypto wallet) used to generate its private key – both of which should be securely stored by their owner – they could steal its funds.

Perhaps most importantly, a cold wallet’s practice of security by obscurity makes it fragile in its own way: if a wallet is physically lost, or if its access credentials are forgotten, its contents permanently go with it. The fact that it is cryptographically secured means that no amount of searching, hacking or computation will ever get its contents back. Managing an offline wallet is, essentially, to manage one’s own bank: protecting one’s assets is critical.

Safer data through encryption

One way to ensure the safety of a cold wallet is to store it on a hardware-encrypted data storage device. While a wallet should always sit on external storage which can be automatically or physically disconnected when not in use, hardware encryption adds a second layer of protection, since an opportunistic attacker will not be able to access a single byte of the drive’s contents without the appropriate credentials. It needn’t have a high capacity, since wallets themselves are very small, but a reliable, secure data storage device removes the possibility of anyone potentially accessing a wallet they shouldn’t. With the right choice of hardware, a wallet becomes double-protected: an intruder entering the wrong passcode too many times could cause the drive to be erased and, with it, any possibility of accessing the wallet is removed.

The positive is that even if the offline wallet disappears, funds won’t necessarily be lost. Unlike a hot wallet on an exchange, a cold wallet does not have to be a singular entity. Offline wallets can be cloned by copying them to additional drives, providing backups to protect the first against disaster, and removing the need to write down or remember a seed phrase. Most cold wallet software tools can be used to generate a full backup of private and public keys and to store those elsewhere, too. As long as care is taken around where each copy resides – and, again, proper access controls and encryption are implemented – a cold wallet offers the strongest assurance possible that cryptocurrency remains safe and secure.

John Michael, CEO, iStorage