Changpeng Zhao, also known as CZ, said secure cryptocurrency storage requires users to address three priorities: theft prevention, accidental loss of access and inheritance planning. He said the appropriate protections depend on the value of the assets and the owner’s technical expertise.

For self-custody, Zhao recommended protecting private keys, maintaining reliable backups in multiple locations and testing recovery procedures before they are needed.

Securing personal wallets

Zhao recommended storing private keys and signing transactions on a separate computer that is not connected to the internet. Users should install software only from official sources, check it for malicious code and protect the device through encryption and physical access controls, he said.

For mobile wallets, Zhao advised using a dedicated phone restored to factory settings and installing only essential applications. He recommended against obtaining root access or performing an iOS jailbreak. The phone should remain offline except when a connection is required for transfers or updates, he said.

Hardware-wallet users should choose devices from reputable manufacturers, protect them from theft and tampering, and verify a recipient’s address on the wallet’s screen before approving a transfer, according to Zhao.

He cautioned that hardware wallets do not eliminate every risk. Software problems, physical attacks and insecure backup storage can still lead to the loss of funds.

Backups and inheritance

To reduce the risk of losing private keys, Zhao recommended creating several backups and keeping them in different locations. Possible storage methods include paper, metal backups and encrypted USB drives.

Each method has limitations, he said. Paper can be damaged, metal backups can be lost, and digital copies require strong encryption. He also warned users not to photograph private keys or take screenshots because the images may automatically synchronize with cloud services.

Users should test both their backups and the full recovery process in advance, Zhao said.

Inheritance planning creates separate security risks. Giving another person a private key provides immediate access to the funds. Zhao said one alternative could be a dead man’s switch that sends instructions after a prolonged period of inactivity, although users should test such a service before relying on it.

He also recommended against placing unencrypted keys or recovery passwords in scheduled messages. Instead, users could encrypt instructions for a designated recipient, including through the recipient’s PGP public key.

Protecting exchange accounts

On centralized exchanges, the provider controls the assets and storage infrastructure, but users remain responsible for securing their accounts, Zhao said. He advised assessing an exchange’s reputation, security resources, testing practices and business-model resilience while also considering counterparty risk.

For account protection, Zhao recommended strong, unique passwords stored in a password manager. Users should enable two-factor authentication, preferably through hardware security keys or authenticator applications rather than SMS.

He also advised using a separate email address for each exchange and securing the related email accounts. Withdrawal address whitelists can restrict transfers to addresses approved in advance.

Users should protect application programming interface keys against unauthorized access and securely store private keys when using asymmetric authentication, Zhao said. They should reach exchange websites through verified bookmarks or by manually entering the address, rather than following suspicious links in emails, text messages or social-media posts.

Zhao separately warned about SIM-swap attacks, in which attackers take control of a phone number and intercept SMS authentication codes. Hardware security keys, when supported by a service, provide a more phishing-resistant authentication method, he said.

Balancing custody options

Zhao recommended diversifying cryptocurrency holdings between exchanges and personal wallets based on the user’s technical skills, access needs and ability to maintain appropriate security.

Self-custody gives users control of their private keys but requires reliable backup and recovery procedures. Exchange custody depends on the provider’s reliability and the security of the user’s account. A separate wallet can also provide access to part of a user’s funds when an exchange is temporarily unavailable for maintenance, Zhao said.

The U.S. Securities and Exchange Commission previously proposed new cryptoasset custody rules for investment advisers and funds.

Source: Incrypted