Cybersecurity in the World of Cryptocurrencies

Imagine we receive a message from the company we buy cryptocurrencies from. It warns of a suspicious login and urges us to secure our account immediately. We open the link and enter our login details and verification code. Everything looks like a routine security check. But the message was not sent by our exchange. The link led to a fraudulent website, and an attacker has just obtained our details.

In another situation, we hold cryptocurrencies in our own hardware wallet. The keys are protected inside the device, and we have never shared our recovery phrase with anyone. Even so, we can lose part of our funds if, while using a blockchain application, we ourselves approve a malicious operation. The attacker does not need to obtain our key. It is enough to convince us to sign the malicious operation ourselves.

Cybersecurity in the world of cryptocurrencies therefore involves more than just choosing a wallet. We need to understand how to protect access to our account, what allows our assets to be moved, and what consequences confirming a particular operation can have. Understanding these differences is precisely what helps us recognise situations in which a seemingly ordinary step can have serious financial consequences.

Blockchain security and the security of our funds

When news breaks of stolen cryptocurrencies, it is easy to get the impression that someone has broken an entire blockchain. In reality, however, several different events may be involved. A compromised account with a provider, a leaked private key or a bug in an application are not the same as a failure of the rules of the network itself. For users, all of these situations can end in a loss of money, but they require different prevention and a different response.

It is therefore useful to think of security in several layers. One is the blockchain network and its rules. Others are the applications, smart contracts and companies through which we work with cryptocurrencies. No less important are our email inbox, phone, computer, login details and the way we approve operations. Good security in one layer does not replace protection of the others.

It also matters who manages the keys. When our assets are held in custody by a provider, we protect access to our account while also relying on the security and operation of that company. With our own wallet, we take on responsibility for managing keys and backups. The distinction between hardware and software wallets is, moreover, something different from the distinction based on whether we manage the keys ourselves or entrust them to a provider. A software wallet can also allow self-custody.

The choice of custody method should therefore reflect what we understand and what we are able to manage over the long term. A more complex setup is not necessarily safer for a particular person if they later cannot restore access or spot a possible mistake.

When an attack looks like help

Phishing is a scam in which an attacker poses as a trustworthy person or service in order to obtain sensitive information or persuade someone to take a dangerous action. In the world of cryptocurrencies, it may take the form of a fake email from an exchange, an imitation app or a message from supposed wallet support. A scammer may also get in touch by phone or via a private message on social media.

Imagine a notice saying that we must transfer our funds to a “safe wallet” within thirty minutes. The instruction may be accompanied by our name, a familiar logo and a plausible-sounding explanation. What matters, however, is who controls the destination address and whether we have verified the request independently of the message we received. If the place for storing our assets was chosen by a scammer, we may end up sending our funds to them ourselves.

A request to “verify” a recovery phrase works in a similar way. Trezor, for example, explicitly warns that its support never needs it and that users should never share it with anyone. A professional-looking message is no proof of its real origin. Artificial intelligence today makes it possible to create convincing texts and even imitate a voice or image. Language errors can therefore be a warning sign, but their absence does not confirm that a message is trustworthy.

A practical defence is to break the path the attacker has prepared for us. Instead of clicking the link in the message, we open a familiar app or the verified address of the service and check any problem directly there. We contact customer support through its official channels. Neither HTTPS nor a secure connection symbol confirms that the operator is trustworthy. After all, a fraudulent website can use an encrypted connection too.

The email inbox is part of account protection

When securing an investment app, it is easy to overlook the email inbox we use to restore access. If someone takes control of it, they may receive security notifications or start a password reset for linked services. What an attacker can do depends on the specific security in place, but protecting the email inbox is an important part of the whole system.

For every important account, it makes sense to use a long and unique password. Reusing the same password ties the security of different services together. A leak at one of them can therefore put the others at risk too. A password manager helps create and store different login details without us having to remember them all. However, the password manager itself also needs strong security and a well-thought-out way of restoring access.

Another layer of protection is multi-factor authentication, which uses another way of proving identity in addition to a password. A one-time code from an authenticator app generally offers better protection than SMS, but even that can be entered on a fake website. Where a service supports properly implemented passkeys or FIDO security keys, it is possible to obtain protection that is more resistant to phishing. None of these methods, however, removes all the risks associated with an account.

Security must also include a way of safely restoring access. Losing a phone or a security key should not catch us off guard only at the moment it actually happens. We keep backup codes in a protected place, following the service’s instructions. We enter a verification code only during an operation we have started ourselves in a verified service. We never share it with someone who has called us unexpectedly.

A recovery phrase plays a different role from a password

An app password, a hardware wallet PIN and a recovery phrase are not interchangeable pieces of information. A password or PIN can protect the use of a particular app or device. A private key makes it possible to create the digital signatures needed to move assets. In common seed-based wallets, the recovery phrase then serves as a backup from which the relevant keys can be derived again.

This explains why revealing a recovery phrase is so serious. An attacker who obtains the necessary backup can restore the wallet on another device. They do not need to know the PIN of the original device. Some setups require an additional piece of information for recovery, such as a passphrase, or several parts of the backup. The exact rules depend on the solution used, and it is necessary to understand them before storing a larger amount of funds.

With standard self-custody, a sensible basis is to keep the backup outside the everyday digital environment. A photo on a phone, an unencrypted document or a note synchronised to the cloud create further opportunities for it to be stolen. At the same time, the backup must remain legible and protected from loss or damage. Security here means not only preventing unauthorised access, but also preserving the ability to restore the wallet.

Managing backups therefore also matters from the perspective of inheritance. A backup stored so that no unauthorised person can find it will not help us if we cannot find it ourselves after losing a device. Instructions thought through in advance can combine protecting assets during our lifetime with the possibility of passing them on legitimately. That does not mean, however, that we have to email the recovery phrase itself to our family.

What a hardware wallet can do

A hardware wallet, such as the Czech-made Trezor, separates the handling of private keys from an ordinary phone or computer. With a correctly used device, signing takes place inside the wallet and the keys are not sent to the connected application. This reduces the risk of them being stolen by malicious software on the computer. The assets themselves remain recorded on the blockchain. The device protects the means needed to control them.

This protection does not mean, however, that every confirmed operation will be in our interest. If we ourselves approve a transfer to an attacker or a dangerous permission, the signature may be technically correct and still have harmful consequences. It is therefore important to check the details on the device’s trusted display and to understand what we are confirming. With more complex operations, wallets also differ in how clearly they can display them.

We can therefore think of a hardware wallet as a tool that protects the signing process. The decision about what we sign, however, remains ours. If the interface shows only incomprehensible data or the request does not match the intended action, the safe course is to stop the operation and verify what it means. Not even an expensive device can replace this check. Nor will it protect us if we enter our recovery phrase on a fraudulent website ourselves.

A digital signature can also mean a permission

When using blockchain applications, we may be confirming more than just an immediate transfer. Some tokens require us first to allow a smart contract to move a certain amount of our tokens. Such a permission, known as an approval, can be a normal part of a decentralised exchange. What matters, however, is to whom we grant it and how broad it is.

Consider a model situation in which we want to swap tokens worth fifty euros, but the app asks for the ability to move a substantially larger amount. The difference between the intended trade and the scope of the requested permission is a reason to check. If we grant unlimited permission to a malicious contract, we may also put at risk other tokens covered by the approval. That does not, however, automatically mean exposing all assets on all blockchains.

We also need to distinguish between connecting a wallet, signing a message and approving a specific permission. Simply connecting a wallet to a website in the usual way generally does not give the website the right to move our funds. A subsequent signature, however, can have a different effect, even when we are not paying a network fee for the operation at that moment. Moreover, closing the page may not cancel a previously granted permission to move tokens. Disconnecting an app and revoking an approval are two different actions.

This leads to a useful habit: before every confirmation, we check whether the requested operation matches what we actually wanted to do. If we do not understand the recipient, the contract, the amount or the scope of the approval, we do not confirm the operation. On supported networks, older permissions can be reviewed and revoked using verified tools. Their address, however, must also be verified. A supposed “wallet cleaning” service may be yet another fraudulent trap.

When transferring, both the address and the network matter

Cryptocurrency addresses are long, so in everyday use we often copy them. An attack known as address poisoning targets precisely this habit. The scammer inserts into our transaction history an address similar to one we have already used and counts on us copying it next time. The beginning and end of the address may look familiar, while its middle part is different and the address actually belongs to someone else. Such an incoming transaction on its own does not mean that our keys have been leaked.

We therefore obtain the address from the recipient’s verified source and check it in full before confirming. The transaction history should not serve as an automatically trusted address book. With a new recipient, a test transfer of a small amount followed by verification that it has been received can help. It is necessary, however, to take into account the transaction fee and any minimum amount required for a deposit to be credited. Not even a successful test replaces checking the details on the subsequent larger transfer.

In addition to the address, the asset and the blockchain network must also match. Some tokens exist on multiple networks, and the receiving service may not support all of them. An identical-looking address therefore does not by itself guarantee that the funds will be delivered correctly. Before sending, we always read the recipient’s current instructions, including any additional identifier such as a memo or tag. A mistaken transfer may not be possible to correct, and any recovery of funds may be subject to further conditions.

A significant part of protection therefore consists of a few moments spent checking before confirming a transaction. With an ordinary payment, we are used to checking the account number and the amount. With cryptocurrencies, we add the network, the type of asset and any additional requirements.

Security also requires protecting devices and good habits

Computers, phones and web browsers are the environment in which we work with accounts and wallets. Regular updates fix known security vulnerabilities and should therefore be a routine part of managing them. It is similarly important to avoid installing unknown programs and unnecessary browser extensions. We look for a wallet app through its developer’s verified website and check who its actual publisher is.

A strong warning sign is an unsolicited offer of help that requires remote access to a device. Someone posing as an investment adviser may, during a supposed “investment setup”, watch our screen, get us to confirm payments or obtain further sensitive information. The Czech Police have repeatedly warned about this method in connection with cryptocurrency scams.

With more active use of cryptocurrencies, it is also possible to separate assets held for the long term from funds intended for trying out individual applications. The aim is to limit the value of assets exposed to any particular mistake. This separation, however, must reflect the actual way the keys are managed. Another account created from the same leaked recovery phrase does not solve its compromise. Likewise, several wallets on a compromised computer may not provide independent protection.

When returns exist only on the screen

Some cryptocurrency scams involve neither stealing a password nor compromising a wallet. The perpetrator persuades a person to send money themselves to a supposed investment platform. In the app, the victim then watches a growing balance, which may not correspond to any real assets. When they want to withdraw the money, a request arrives for a further payment to unlock the account, verify their identity or cover a supposed tax.

Imagine we have deposited thirty thousand korunas and after a few weeks we see a value of sixty thousand in the account. The number on the screen alone, however, does not explain who holds the assets or whether they can actually be withdrawn. Even an initial withdrawal of a small amount may be part of building trust. A further deposit may then only deepen the loss instead of making it possible to obtain the promised return.

When assessing a service, we therefore need to know its actual operator, its terms and how it handles funds. A promise of a guaranteed high return, pressure to decide quickly or an instruction to keep the investment secret from those around us are reasons for caution and for scrutinising the offer thoroughly. Even securely controlling a wallet does not on its own protect us from sending money to a fraudulent project.

How to respond if we suspect an attack

The first response depends on what has actually happened. We stop following the suspicious person’s instructions and carry out further steps exclusively through verified channels. If we suspect our computer has been compromised, we secure our accounts from another, trusted device. For an account at risk, we change the login details and check active sessions and the available security settings. We also contact the service provider without delay and ask for help in limiting unauthorised access. If the scam also involves a bank payment or a payment card, we contact the bank as well.

With our own wallet, it is important to distinguish between a malicious permission and a leak of keys. A suspicious approval may need to be revoked on the relevant network. If, however, someone has obtained the recovery phrase or a private key, neither revoking the approval nor changing the app password will remove their access. In such a case, we need to stop using the compromised wallet and safely move any remaining funds to a new, independently created wallet.

In such a situation, a new wallet means genuinely new keys and a secure backup created in a trusted environment. Simply adding another account under the same seed is not enough. The specific procedure, however, depends on the network and the way the wallet was compromised. If incoming funds disappear immediately, an attacker’s automated program may be behind it. Sending more cryptocurrency to cover transaction fees may then only lead to further losses. We therefore deal with such a situation according to verified instructions from the wallet’s support.

At the same time, it is important to preserve evidence. Addresses, transaction identifiers, amounts, times, web addresses and all communication are useful. We report the incident to the affected service and, if we suspect a crime, also to the Czech Police. The publicly traceable movement of funds on the blockchain may help an investigation, but it does not by itself guarantee their return. Particular caution is also called for towards people who subsequently get in touch promising to “recover cryptocurrencies” for an upfront payment. The FBI also warns about such follow-up scams.

Security as part of everyday use

Before confirming any operation, it is worth asking ourselves a few simple questions:

• – Did we start this operation ourselves, and are we in a verified app or on the correct website?
• – Do we understand what is supposed to happen to our funds?
• – Do the recipient, the full address, the asset, the network and the amount match our intention?
• – Are we granting only the permission that the intended operation needs?
• – Do our keys, recovery phrase and verification codes remain protected?
• – Do we have a secure and clear way of restoring access?

Conclusion

Cryptocurrencies can give people greater control over their digital assets. With this possibility, however, also comes responsibility for how they protect access to their funds and verify individual operations. Neither blockchain security nor a high-quality hardware wallet will on its own solve a leaked recovery phrase, a compromised account or a malicious permission that we ourselves approve.

Effective protection therefore lies in a combination of suitable tools and everyday habits. Unique passwords, multi-factor authentication, securely stored backups and consistent checking of transactions help limit various types of risk. Equally important, however, is being able to stop when a request does not make sense to us and to verify it independently of the person or message that led us to it.

Security must also work when a phone is lost, a device is replaced or access is restored. The best solution for a particular user is therefore one they understand and can use over the long term. Spending time on setting it up correctly is just as important as deciding on the purchase of cryptocurrencies itself.

This text serves informational and educational purposes only and does not constitute investment advice. Crypto assets are volatile, and you may lose the entire amount invested.