GhostlyInc wallet security workspace
Crypto Wallet Security: How Seeds, Keys and Transactions Can Fail
A blockchain can stay cryptographically secure even if the wallet around it fails. Use this hub to learn how seeds, private keys, backups, signatures, and recipient verifications can jeopardise your funds.
Purpose of this hub
Wallet security is a chain; one weak link can lose access to all funds
Robust blockchain cryptography cannot fix a predictable seed, recover a missing private key, correct a reused signing nonce, or reverse a payment sent to a lookalike address. This hub distinguishes these failure modes so users and developers can address the correct risks.
Threat map
Trace the secret from entropy to the final transaction
Each layer addresses a distinct issue. A secure backup cannot make up for poor key generation, nor can a hardware wallet protect a payment if the wrong recipient is approved.
Generate
Generate unpredictable secrets
A wallet requires sufficient reliable entropy and a cryptographically secure random number generator. Lengthy seeds offer little strength if their origin is predictable.
Back up
Retain every key required for recovery
A backup must correspond with the wallet's design. Early loose-key wallets might generate new change keys post-backup, whereas modern deterministic wallets rely on safeguarding the recovery phrase.
Sign and store
Keep signing materials isolated
Private keys, signing nonces, wallet software and storage boundaries all matter. A flaw in any can expose control without compromising the blockchain itself.
Verify and send
Confirm the intended destination
Irreversible transactions mean recipient verification is essential to wallet security. History entries, shortened addresses, or lookalike destinations must never replace an independent check.
Research plan
Real-world wallet failures, explored through practical examples
This research series tracks real wallet failures from weak randomness to misleading transaction history. Published investigations are full case studies; others remain unlinked until sources and guidance are ready.
COLDCARD RNG Weakness 2026
Which seeds are impacted, why updated firmware cannot fix existing keys, and how to move bitcoin securely without transferring vulnerabilities to a new wallet.
Address Poisoning
How lookalike addresses appear in transaction history and why users must verify the full recipient, not just familiar prefixes or suffixes.
The Bitcoin Backup Issue That Cost 8,999 BTC
How a missing change key rendered an apparently valid wallet backup incomplete, and why Bitcoin introduced a key pool for safer recovery.
The Danger of Weak Randomness in Crypto Wallets
A wallet may employ robust cryptography yet still produce insecure seeds or private keys. Discover how poor randomness can jeopardise your funds and the steps users should take.
Milk Sad / Libbitcoin Explorer
How a seed command offered far less security than its output length implied, and lessons for wallet developers.
Randstorm / BitcoinJS
How outdated browser environments and JavaScript randomness can leave long-lived wallets vulnerable years after creation.
Android SecureRandom 2013
Why weak or repeated randomness in ECDSA signing can expose private keys, even if key generation differs.
Protection workflow
Reduce wallet risk following the secret's path
Begin with how the wallet creates and stores secrets, then verify recovery and every outgoing transaction. Labels like hot, cold, or hardware wallet do not replace this process.
- 01
Select a wallet you trust
Use a wallet with regular updates, clear recovery instructions, and precise approval details. Don’t rely solely on advertising.
- 02
Keep your recovery backup offline
Store your seed phrase or wallet backup offline in at least two secure locations. Test recovery before it's needed, and never save the seed phrase in cloud storage.
- 03
Transfer funds from an old or insecure wallet
If you no longer trust an old wallet, create a new one with up-to-date software and transfer funds to its new address. Always send a small test amount first.
- 04
Verify the full address before sending
Compare the full recipient address with a trusted source. Double-check it on the signing device, especially if copied from your transaction history.
Bottom line
Secure the wallet process, not only the device
Safeguard how secrets are generated, backed up, used for signing, and verified before funds move. Refer to the research plan when an old wallet, seed, or transaction needs detailed technical review.