Bitcoin Forum

The other day, MEW 's wallet was taken over.

Apparently, I seem to have written a private key at the phishing site.


How to use WEB wallet to not fail like me.
Please tell me what you are doing, such as when you use or save PW.

I think you pretty save your Private Key on a safe note.

However, you admit that it seems you are a victim of a phishing site. No matter how secure our private key or password is, if you input it on a phishing site then there is a chance that it will be compromised.

Next time be aware on what site you are inputting your important credentials.

All phishing attacks seem to target Myetherwallet domain name, use MyCrypto instead, It's the same with more features.

If you ever type your private keys, or upload your JSON file at a phishing site, you're basically at the mercy of the attacker, there is nothing that can be done to protect yourself from that, just be vigilant.

The first thing is don't put your private keys anywhere like airdrops and bounties. Next one is checking twice the official Myetherwallet website or not and keep in touch with Myetherwallet social media updates. In my opinion is you can use Metamask in your web browser. You can use Metamask safer than Myeterwallet.

Next time, access those web wallets from a saved/bookmarked link instead.

---

On a side note: None of the web wallets are safe.

I suggest to go only through the bookmark on the official website of the MEW Wallet. When you open the site, check all the address symbols (often change "a" to "á"). I apologize for my English.

Is it safe to assume the best wallets are the core wallets?

As far as you have your keys on any website including web wallet service provider, don't expect security for your wallet. Crypto is all about self-responsibility and hence we should take enough security precautions to keep our crypto funds safe. I would recommend you to keep your funds in offline wallets such as a securely generated paper wallet or reputed hardware wallet. Web wallets are convenient but I don't expect security from them.

MyEtherWallet wasn't taken over(at least recently). You got hacked because of user error. You most likely clicked on a phishing link when you Googled "myetherwallet". The thing is, hackers can pay ads to Google for listing a phishing site version of the original MEW. So this wasn't MEW's fault. Unfortunately you learned the hard way; hopefully your losses wasn't that much.

Next time when using MEW, type the URL "myetherwallet.com" accurately on your browser's address bar intead of Googling it.

Use hardware wallets otherwise you can never be safe, that is also recommend by the wallet you use ::) so still entering private keys is nonsense and you accept losing coins.

To be fair, MEW's domain was "taken over" for some users due to the temporary DNS hack. Which means that some users who accessed the MEW domain where accessing a phishing website (even if it was showing as insecure).

The definitive solution is to download MEW's source code[1] and run it locally on your computer.

[1] https://github.com/MyEtherWallet

there is an official MEW Chrome Extension you can use to increase your security
However, I'm not quite sure if this Chrome Extension would protect you in such case above?
but this extension would definitely help you from falling into phishing sites 8)

Put your private key in a secured place that your the only one who knows were it is. Make a copy or print it to have a back up, which is recomemded. Just be careful cause a lot of hackers will try to steal your private keys.

It would be a good idea if you would read OP's post first before commenting on it.

You admit to type your private key at the phishing site, so i recommend you bookmark the legit page https://www.myetherwallet.com/
Bookmark and only use it, don't search on the address bar or google some thing like MEW, myetherwallet, eth wallet... and click on the result links, never do it. The search results are not safe. You can install Metamask, a good and legit ETH and ERC20 wallet extension on Chrome and Firefox, this extension also warn you when you visit a fake MEW website.
Metamask legit extension: https://chrome.google.com/webstore/detail/metamask/nkbihfbeogaeaoehlefnkodbefgpgknn?hl=en

the only way to stay safe is always going to be using cold storage!

using MEW actually allows you to do it in a somewhat easy way. here are the steps:
1. download the source to the website https://github.com/kvhnuke/etherwallet (verify if this is the right link yourself)

2. go to send offline tab. all the other steps will also be in this tab
https://i.imgur.com/E5Cu9fB.jpg

3. (online) enter your address in step 1 which you want to send from. write down gas price and nonce

4. (offline) enter appropriate info in step 2. choose the right option from bottom of this step "How would you like to access your wallet?" (it usually is the last one: private key). enter the right information here and click unlock

5. (offline) move a little lower, click generate transaction and now copy the "Signed Transaction" and transfer it to your online computer

6. (online) go back to https://www.myetherwallet.com/#offline-transaction and scroll to the bottom of the page, step 3. paste the "Signed Transaction" from #5 here and click send.

7. do this as a test first to learn how things work, you can send a small amount and check everything then do it for everything.

Web wallets are a pleasure to use but prone to phishing attacks. If you bookmark MEW and access it ONLY from that bookmark, you are quite safe. But bookmarks can be hacked too I guess, never heard of it but why not. Next level of protection would be using hard wallet like Ledger or Trezor. You can connect it to MEW easily and can almost guarantee your safety. Just make sure you're sending to the right address and you now 99.999% safe.

As long as your computer have no malware. The hardware wallets are the only one that are truly safe, I suggest investing in one.

100% safety is almost impossible to reach, so the first rule: be paranoid.

If you visit MEW daily (without login in) you will increase the chance that you subconsciously notice if something is 'off'

Use Metamask (don't keep it open, just login when necessary)

Keep coins / tokens you don't intend to trade soon on a hardware wallet.

Don't follow links. Always type the url.

Keep your computer clean (virusscanners / anti-malware software)

Blockchain.info is pretty reliable in terms of not gettin hacked, but they had technical difficulties in past.
So overall there is no online wallet that is secure and reliable. You can always be your own bank and choose software wallet like multibit or electrum etc.

But many people still aware about this, they think because web wallet are easy to using doesn't it best safe to secure their money. For me, invest buy hardware wallet its worth because it is for saving our money forever.

For using MEW you can use some addon on your browser.those addon would help you from getting out the pishing site. MEW already support some addon and they also tell us to install those add-ons for our safety. as a reference:

https://i.imgur.com/pnBCbG6.png

I am using this addon: https://chrome.google.com/webstore/detail/cryptonite-by-metacert/keghdcpemohlojlglbiegihkljkgnige

It is better to store coins in offline wallets (cold wallets). For example you can save your private keys in password-encrypted files and backup on USB, paper, etc. Alternatively you can buy a Trezor or Ledger hardware wallet.

Then you can use coinb.in (in the case of bitcoin) or import the private key into MEW (ethereum) or download the clients (bitcoind and geth) to generate transactions only when needed.

If you still want to use a web wallet, make sure to check the URL (it is better to bookmark the URL or type it exactly) and the SSL certificate (click on the lock next to the URL bar) every time you use the wallet. If you use Windows, make sure to use anti-virus software to avoid viruses that can steal your bitcoin. If you use OSX or Linux you probably dont need this. In addition ignore all emails or social media messages that ask for your private key. This is a phishing attack that tries to steal your bitcoin. You never need to send your private key anywhere, apart from when you import it into a trusted wallet.

You need to make sure you are logged on to the real (authentic) site.
Then, you must be mindful of prop ups asking for unwarranted details.
You also need to install anti-spy, among others.
Save your private keys securely.
Don't use easy-to-get password.
Use two-factor authentication, if possible.
Do not reply suspicious messages asking for any info.

I would rather use a hardware wallet instead of a WEB one. It's very easy to  compromise your PC if it's your work station connected to the world web.

Web wallet website is bookmarked on my computer for safe.I also use Metamask to connect between them. We do not use private key many time.

- Advantages of wallet Wallet:
Enhanced security features, such as 2-step verification.
You can choose whether your balance is reflected in your local currency.
The user interface design is intuitive and can be easily navigated.
As a security measure, Blockchain automatically creates a new wallet address after each crypto transaction.

- To protect yourself against future incidents, you should remind yourself of the following:
Disconnect immediately if anything is different from the one you are accessing (for example, an unsecured connection message).
Make sure the site you visit has a secure encryption icon. Especially the websites that you send personal information, money (eg ETH, Bitcoin, trading platform, e-commerce site ...) must always have encryption symbols to ensure information is secure.
Limit use of web-accessible wallets such as MyEtherWallet, which uses add-ons like MetaMask or wallet applications like Eidoo. Still, it is possible for these wallets to be compromised but still safer for MEW.
If you still want to use the MEW wallet, you can view the MyEtherWallet User Guide on your hard drive and offline.

Bookmarking the website is easy, simple and safe.

It only take few secs to check the website if there are some unwanted characters or misspelled letters because some letters contains dots so check it thoroughly.

But if you don't want to feel safer, use a hardware wallet.