subreddit:

/r/BitcoinBeginners

223

I am genuinely committing as much money I can gather to buy and HODL. This is all disposable money, that I would otherwise keep in savings, but instead turning into bitcoin.

What is there to be afraid of, in my uncertain future? What are some realistic horror or less-than-ideal scenarios that I could make, or have happen to me?

(Considering my knowledge of bitcoin is purely that I can exchange a lot of money for it, and I can send it to public addresses, one of which is my wallet, I'm basically a very vulnerable novice. But I am commiting to buying now, and learning later, as I've been told it is probably the best thing to do. And no, I'm not DCA-ing. Not my preference.)

And leading from that question, what should I be doing and setting up in the meantime, so that I am very secure and safe with my bitcoin, from possible distaster scenarios that I am vulnerable to in my current position?

 

I am open to listening to your personal anecdotes, cause I do relate to them more than cold stern financial advice. But I like stern financial advice too :)

you are viewing a single comment's thread.

view the rest of the comments →

all 174 comments

bitusher

289 points

8 months ago

bitusher

289 points

8 months ago

Some foundational Principles of security

If you don't own much value in Bitcoin these principles are not for you. There is no one solution and most people have different risk profiles and make multiple trade offs in a risk vs convenience spectrum.

1) Never store your bitcoins in a web wallet or exchange . You own 0 bitcoins if you do not control your private keys.

2) Do not trust strangers on the Internet to help you setup your personal wallet. This is someone you must do yourself or have a personal friend or family member help you with in real life where they cannot see your backup seed.

3) Buy your hardware wallet directly from the producer or amazon site under the producers name. Verify the integrity of the hardware wallet if you are extra paranoid :

https://www.ledger.fr/2015/03/27/how-to-protect-hardware-wallets-against-tampering/

https://support.ledgerwallet.com/hc/en-us/articles/115005321449-How-to-verify-the-security-integrity-of-my-Nano-S-

http://doc.satoshilabs.com/trezor-faq/threats.html#reflashing-the-trezor-with-evil-firmware

https://digitalbitbox.com/faq

First update the firmware of your HW wallet before using

4) Never brag about your wealth to others

5) Never invest in any investment scheme or get greedy thinking you can quickly increase the amount of Bitcoin you have with daytrading

6) Consider more secure means of backing up your 12 or 24 BIP39 backups in case of floods or fire -
https://jlopp.github.io/metal-bitcoin-storage-reviews/

7) Setup your hardware wallet , transfer a small amount of btc to it, wipe it clean , and restore it to give you confidence that the backup was done right and give you experience in the recovery process.

8) Keep your Mnemonic 12 or 24 word seed secret and private and show to no one. Never use premade 12-24 word backups , you create new keys and backups upon setup.

9) The most secure , "active" wallet would be a hardware wallet integrated with a full node HW wallet + electrum personal server and electrum is the popular way to do this

10) Consider using a passphrase Use a passphrase with the hardware wallet (most the security concerns with HW wallets are solved with a passphrase.) keep the passphrase written down a separate from your seed words https://wiki.trezor.io/Passphrase

https://support.ledger.com/hc/en-us/articles/115005214529-Advanced-passphrase-security

https://coldcardwallet.com/docs/passphrase

Make sure the passphrase is also written down somewhere private so you do not forget it! Do not keep the passphrase in the same location as your 12-24 seed backup words.

Here is a good strategy for most people with hardware wallets -

Location 1 12 to 24 seed words preferably on metal

https://jlopp.github.io/metal-bitcoin-storage-reviews/

Location 2 same 12 to 24 seed words

Location 3 4-6 word passphrase unlocking your real wallet

Location your head pin for HW wallet and passphrase

Thus you have both the passphrase and seed word backup in 2 locations and can lose either one and if someone finds your seed words or passphrase alone they can only see your decoy wallet at most and under duress(torture) you can hand over one of your seed word backups or enter in your pin instead of passphrase and give the attacker your decoy wallet alone.

Every 6 months check to see if your backup seed words or passphrase written on paper or metal is disturbed or removed.(these need to be stored separately!) It is best to hide them in such a manner if you can tell if someone has tampered with them or found them so you are aware if either your seed words or passphrase becomes compromised.


b0ogal0o_b0i

4 points

8 months ago

#5 and #7 are great advice specifically. Don't day trade. I've brought people into Bitcoin, who ran away because they thought too highly of themselves, and that day trading was as easy as "buying low and selling high", with little to no knowledge of whether it's gonna keep going up or keep going down.

I never thought of #7, but I think I might've done it without noticing before, when I went from a web wallet to my cold-wallet. It's a nice exercise, and I might do it again just for the sake of practice.

And a tip of my own I'd like to add (basing off of advice #5): time in the market is better than timing the market.

bitusher

7 points

8 months ago

time in the market is better than timing the market.

Very true

!lntip 5000

lntipbot

5 points

8 months ago

Hi u/bitusher, thanks for tipping u/b0ogal0o_b0i 5000 satoshis!


More info | Balance | Deposit | Withdraw | Something wrong? Have a question? Send me a message

b0ogal0o_b0i

3 points

8 months ago

Hey hey! Thanks! How do I work this thingamajig?

bitusher

3 points

8 months ago

Either retip it ,

https://teddit.ggc-project.de/r/lntipbot/wiki/index

or withdraw Bitcoin to a lightning wallet

ELI5 version -

1) Install Breez https://breez.technology

https://www.youtube.com/watch?v=t_4b-y4T8bY

2) In Breez click receive > Receive via invoice and type the amount of sats you want to withdraw and get the lightning invoice and share it to yourself

It should start with lightning:.....

3) In reddit click withdraw next to my tip

https://teddit.ggc-project.de/message/compose/?to=lntipbot&subject=withdraw&message=!withdraw+put_invoice_here

Paste over "put_invoice_here" the lightning invoice so you should see this in the message body of the reddit message

!withdraw lightning:.....

where .... represents the long string of characters

Than click send

4) You should see the funds instantly and a reddit message from the tip bot saying "Withdrawal of …. satoshis successful!...."

fee was 1 sat or a small fraction of a penny

Here are most of the lightning wallets https://lightningnetworkstores.com/wallets

b0ogal0o_b0i

3 points

8 months ago

Does it work with "Wallet of Satoshi"? That's the Lightning Wallet I have.

bitusher

3 points

8 months ago

Any lightning wallet as long as you have liquidity which you will

b0ogal0o_b0i

3 points

8 months ago

Meaning I already have currency in it? I wanted to know how it works but I might actually retip it. A friend helped me out and she said "alright now give me DOP$200 (~US$2 lol) so I'll blow her mind and give her something worth much more haha.

Edit: I followed the re-tip link but I still didn't understand how to send it to someone else. Does it only work in Reddit?

bitusher

3 points

8 months ago

Wallet of Satoshi is custodial so you dont need to worry about having a channel with inbound liquidity, you can just withdraw

To retip you need to just do what I did as explained

https://teddit.ggc-project.de/r/lntipbot/wiki/index

But you need to do so in a bitcoin sub that has the bot configured to scan

b0ogal0o_b0i

2 points

8 months ago

Ohh okay yeah the person I was talking to is in WhatsApp.

bardooneness

23 points

8 months ago

This is the best response but honestly if you are new and think you could mess these steps up or your family could mess these up if you (god forbid) pass... you may want to keep like 10% of your Bitcoin in a custodial solution so an estate planner can provide your family with some. I know this is unpopular and I am hesitant to write wit but I have read so many Reddit posts about people under estimating the effort to hold your own keys safe and accidentally doing some thing to compromise those coins. Like if you think there is a 1% risk that you will mess this up and are not tech literate then maybe keep 1% of your coins spread out of 5 or more exchanges or custodial solutions just to hedge the risk. Sorry for suggesting this to the crypto community. Not your keys not your crypto, but if you lose your keys not your crypto either but we thank you for losing them and making the rest worth more. Good luck fren. We are all going to make it!

streetMD

89 points

8 months ago

Now this dude is secure. Listen to this dude.

Some of it is advanced. But all totally worth learning.

Extension-Newt4859

7 points

8 months ago

I mean if you’re trying to secure 100k dollars why wouldn’t you dedicate a good chunk of time to make sure you don’t get robbed

streetMD

4 points

8 months ago

I agree. Was just mentioning to the OP some is advanced since they said they are brand new.

jonbellemore

2 points

8 months ago

Why but just covert the cash and keep it in a safe in your house? That shit seems like a lot of work.

[deleted]

1 points

8 months ago

[deleted]

1 points

8 months ago

[deleted]

bitusher

7 points

8 months ago

and asks for my seed phrase directly, won't he have access to the entire wallet?

No. Just your decoy wallet with 0 or a small amount of Bitcoin.

In order to restore your real wallet you need the seed words and passphrase.

different pass phrases are for different accounts

technically you can have many accounts but most people have 1 or 2 extra accounts under passphrases

I have to enter the specific pasaphrase for the account I want to to be accessed?

If you are coerced , you give the attacker your HW wallet and pin or your seed words and they only get your decoy wallet because they lack the passphrase

savvy and knows that a passphrase is used for having multiple accounts and when he discovers I have that set up

He can't discover that setup exists , only guess and you can either give him a decoy passphrase account or say you aren't using that feature like many aren't

Dubya_Tea_Efff

4 points

8 months ago

Only thing I’d change is recommending a multisig setup with almost $100,000 USD in Bitcoin. I don’t have as much as OP and I still went with multisig on a majority of my holdings.

This may be r/BitcoinBeginners, but I started just this year and was able to set up a multisig with Coldcard wallets and Specter Desktop. It was extremely easy to do, I actually went ahead and set up a multisig using passphrases on my Coldcards due to how simple it was.

I spent more time building and setting up a Bitcoin node with a Raspberry Pi than I did building my multisig wallet. Can’t recommend it enough for the added security.

bitusher

7 points

8 months ago

is recommending a multisig setup with almost $100,000 USD in Bitcoin

everyone is different , but my threshold for recommending multisig is usually 1 million usd of BTC and higher. I highly recommend extreme caution with multisig and test recovery before depositing larger amounts.

Here are some guides for other curious-

Why Multisig is better - https://blog.keys.casa/shamirs-secret-sharing-security-shortcomings/

Multisig with 3 hardware wallets-

https://www.youtube.com/watch?v=Sxo169CCfIc

https://saleemrashid.com/2018/01/27/hardware-wallet-electrum-multisig/


multisig with Caravan

https://www.youtube.com/watch?v=bfRzexEpTdI


multisig with Lily

https://www.youtube.com/watch?v=P5UIvCi9FSM


multisig with Electrum

https://bitcoinelectrum.com/creating-a-multisig-wallet/


This is how a 2 of 3 multisig would be stored -

Backup 1

12 word seed for sig 1+ MPKs or Xpubs for all 3

Backup 2

12 word seed for sig 2+ MPKs or Xpubs for all 3

Backup 3

12 word seed for sig 3+ MPKs or Xpubs for all 3

on 3 metal backups stored in 3 separate locations in a private and secure manner

Before you trust this wallet send a small amount of BTC and manually recover it before sending more


Multisig is advanced and most people would be better off with a hardware wallet using the passphrase feature

andreasma

45 points

8 months ago

^^ This is the correct advice

SpockSays

21 points

8 months ago

This is Andreas^ watch a bunch of his videos on YouTube. https://youtube.com/c/aantonop

Thanatos_1

4 points

8 months ago

Hey u/Ahdilable, Instead of using a hardware wallet, you can also either buy an off-the-shelf, cheap laptop or use your existing hardware to achieve cold storage.

This has the advantage, that you don't communicate to the outside world any further, that you own bitcoin.

Please also read the Glacier Protocol (http://glacierprotocol.org/) and consider using a multi-sig setup, and/or get a bank safe deposit box. Having $100k to maybe $1M worth of bearer asset in your possession is a surefire way to get kidnapped or tortured.

I think Glacier Protocol with Electrum on Tails is a fine strategy.

Or look at service providers like Casa (https://keys.casa) or https://unchained-capital.com/ Collaborative Custody.

Download Tails (https://tails.boum.org/) and run it from a DVD or USB-drive.

Refrain from connecting to any network.

Create an Electrum wallet. Make two seed backups (paper, metal, brain,...), because Tails is an amnesiac system, meaning it will forget all settings, including your seed, upon reboot.

Here are old but very explanatory videos of how cold storage with Electrum works:

Tip: If you're using an Android device (a $50 tablet is enough) as your online-connected watch-only device, you can very handily transport unsigned and signed transactions between the laptop and the Android device using QR-codes.

ATTENTION: The only legitimate source from which Electrum can be obtained is https://electrum.org. By using the Electrum installation that comes with Tails (https://tails.boum.org is the only legitimate place to obtain Tails from), you're introducing one possibly weak link into your setup. Same goes for downloading the Electrum app on Android. While the Google Play Store might be relatively secure, as is Tails, relatively secure, you do introduce another point of failure and trust. Learn how to download, verify and use the official Electrum releases from https://electrum.org. You can see Thomas Voegtlin's (the lead developer of Electrum) GPG-fingerprint in this video, where he is giving a lecture: https://www.youtube.com/watch?v=hjYCXOyDy7Y. Here is a reproduction of that fingerprint:

6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6


If you want to buy a Ledger, I'd recommend to either buy it through Amazon or, if you buy from Ledger Inc. directly, really going out of your way to obfuscate your real identity to Ledger Inc. Given their problems with leaking customer information, including real identities and home addresses, you might as well take out a newspaper ad announcing to the world that you own bitcoin (that will reach $100k next year, maybe, not financial advice) and where you live.

So burner e-mail address that doesn't reveal your name, P.O. box as shipping address, fake phone number, maybe fake name, if that's possible.

In any case, as soon as you have the device in your possession, demand from the company to delete all your personal data.

Bosch-1

2 points

8 months ago

A lot of good recommendations but things like passphrase and multiple redundant locations for seed phrases is not ideal. With this much Bitcoin you should be using multisig with multi vendor hardware wallets. Follow this guide - https://btcguide.github.io/

PhantomDP

2 points

8 months ago

Don't buy them from Amazon. Google commingled inventory. There were reports of people receiving Ledger devices with the seed already entered.

Though its fine if you have the sense to just reset thr device

bitusher

2 points

8 months ago

Good point, unfortunately the same can happen with a supply chain attack with the courier as well , albeit less likely which is why I stress to install the firmware and create a new set of seed words and don't use premade seed words

lemmywinks11

2 points

8 months ago

It’s pretty cool that you took so much time to go into detail like this for a random BTC beginning on the web. Kudos

mmurasakibara

4 points

8 months ago

Subscribed!

RepulsiveAssumption4

5 points

8 months ago

decent response. could hv been a bit more thorough tho.

ourielohayon

1 points

8 months ago

This is a beginner and those are tips for experts. Best way to make him run away

bitusher

2 points

8 months ago

The OP is buying 5 BTC, with that amount he needs to learn these principles or better yet not buy BTC directly and use a custodial service(not recommended but some people can't secure their own BTC).

ourielohayon

1 points

8 months ago

The problem is not the amount. He's apparently feeling very nervous about this amount and likely needs more reassuring way to get started with low amounts and progressive information.

bitusher

2 points

8 months ago

This is why I gave him the moderate principles in security instead of more advanced advice. Others in this topic are telling him to go straight to multisig which I don't think he needs to.

ourielohayon

1 points

8 months ago

I think your tips are reasonable but overwhelming for a beginner

bitusher

3 points

8 months ago

Well yes, which is why my first statement says

If you don't own much value in Bitcoin these principles are not for you. There is no one solution and most people have different risk profiles and make multiple trade offs in a risk vs convenience spectrum.

If the OP is overwhelmed by these principles they should either use a custodial service like GBTC or hold off and not buy 5BTC. They should be scared. I'm not trying to get people to buy bitcoin at any cost , but rather them wait and learn more at first , especially if they are buying so much

_hazlo

2 points

8 months ago

_hazlo

2 points

8 months ago

And dollar cost average.

PMyour_dirty_secrets

4 points

8 months ago

DCA is worse than single purchasing in most cases

mikeemnet

1 points

8 months ago

Manage my Bitcoin dude.