Bitcoin Forum

Brothers and Sisters on the forum I need your help, I don't have money for a hardware wallet and all I have left is android wallet, the problem is fear of copying my private key into something else, I have come to realise that clicking on COPY on your phone can be dangerous, where to decide to PASTE can be unsafe too, for those who aren't using hardware wallet how are you doing it? What is the safe procedure with mobile wallet users.

Your choices are pretty limited as a lot of things can go wrong. But at the very least, only write down your recovery phrase on a piece of paper, and use a privacy-friendly keyboard app. I personally wouldn't secure my investments on a vanilla Android device though, at the very least I'm going to flash GrapheneOS.

Seriously though, unless you really need to hold crypto (maybe you're from Venezuela or a similar country), I really wouldn't buy crypto if you can't even afford a Ledger Nano S.

I'm having a hard time understanding your request, you don't have money for a hardware wallet, so you are running on a mobile wallet through your Android device; which part of this process requires you to copy your private keys?

On electrum, you will be giving your mnemonic phrase on creating an address and you can back that up physically and store in a secure location without having to copy or screenshot them, which are not advisable for safety.

• Have two devices, one is airgapped where you create a wallet with your private keys,
• On the second device which accesses the internet, you create a watch only wallet with your public key,
• When creating a transaction, you get your raw unsigned transaction on the watch only wallet and then sign that on the airgapped one.

Mobile wallets have been considered one of the most at risk wallets (after Web wallets). I've been keeping some amount of funds on my phone though to test the lightning network and before that I've kept a decent amount of funds in a phone without much issues (the majority of my funds are now on hardware but if you can't afford a hardware wallet, a phone might be OK die the time being - especially if you don't install many random apps).

If I'm going to guess, to import the same wallet backup to a different wallet on a different blockchain. (e.g. having the same backup for both BlueWallet and MetaMask, etc.)

Warning, this may be a little advanced for newbies, especially if not tech savvy!

For you have a computer or laptop? Or do you have somebody in your family who can help? Do you have 2 USB sticks (you can do also with one and some patience)? Or can you borrow one for a 30-60 minutes job?
Get Tails OS onto an USB stick, boot from that (with no internet at all), run Electrum from there. Create a new wallet.

Write the seed (or the first address' private key) down to paper.
You need in Electrum to see addresses: View->Addresses. Copy/paste the first address from the wallet into a new file into second USB (or you can write to another piece of paper).

Make sure you've written everything correctly, optionally you can do it by trying to recover to a new wallet and see if the (first) address is matching.
Tip: make sure you write different 1, I, l since it's a common mistake.

Now make multiple copies of that seed or private key (copy by hand, not xerox!) and keep them safe in multiple safe locations. Maybe laminate them.

Reboot the computer/laptop into the original PC, you can clean the USB stick (GParted for Linux or Macrorit Partition Expert Free Edition for Windows should be fit for the job) and format like new (keep in mind that if you started Tails without persistence - the default mode - then you don't have anything important on that USB).

Now you can send your coins from Android to the newly created address.
That address never touched the internet and should be safe.
You can look on https://mempool.space how much money you have on that address.
You basically made yourself safely a paper wallet. Enjoy!

It is only if your device is infected. If you have a good web surfing style, your device will have low risk of infection. So it starts with how you use your device.

How to lose your Bitcoins with CTRL-C CTRL-V (https://bitcointalk.org/index.php?topic=5190776.msg52682018#msg52682018)

You don't have to own hardware wallet to store and use your Bitcoin. There are good SPV wallets like Electrum wallet for Android. It is available for desktop too.

 How to Safely Download and Verify Electrum (https://bitcointalk.org/index.php?topic=5240594.msg54223763#msg54223763[GUIDE)

Your skepticism about copy>pasting has been discussed in detail here (https://bitcointalk.org/index.php?topic=5190776.0), well worth reading.
Mobile version wallets generally also provide a seed phrase other than the privatekey, and that (at least) doesn't make it difficult for the user to manually rewrite the key somewhere else. So far, electrum does this.

To me, I never had any issue with my phone never experienced someone hacking my phone or stole my funds from my phone.
I don't use other Android OS I only use the stock firmware from Samsung with Knox which is secured. I put all my crypto wallets under Knox secured folder and the good thing about this is if someone tries to root and hack your Knox secure folder it will automatically stop running and all files and wallets under the secured folder you can no longer access all data.
It means Knox automatically locks your data to prevent unauthorized access.

If you are using a different phone model and you want to use your phone as your hardware wallet then you can do that too you can use your phone as your cold storage and never connect it to the internet.
You can still sign a transaction with your offline wallet(Cold storage) from your phone through QR code scanning. You just need an extra device for generating a unsign transaction either a laptop or phone with a watch-only wallet and can able to scan QR codes.

So all of your raw unsigned/signed transactions are transferred through your camera and from generated QR codes.

I agree with you that there are copy and paste malware attack as well but you can't make the claim that finding a secured place to store your keys after copying them is a problem, online mobile wallet isn't advisible at all, i will strongly recommend you to go for hardware wallet, here you don't have to worry about how to save your keys, they are more reliable for use and has least tendencies for an attack unlike the online or mobile wallet, electrum wallet is also another good option for you, it has it mobile version but you just need to have a means to safe-keep your keys, if you consider the amount it will cost you to secure a hardware wallet and the amount of asset worth in your wallet and compare it to the risk attached, you will discover it's worth going for, except you have very little coins in your wallet.

Don't worry, you don't have to buy hardware wallet and you don't to use need any special hard technique to secure your coins.
Simple solution is to use regular paper with pencil and write down all your seed words during creation of your wallet, this is best to be done offline.
It's much easier to write seed words than private key, and you can later generate multiple addresses for receiving coins.
If you want to be even more secure you can use metal plates or stainless steel washers instead of regular paper.
Always keep your paper or metal backup in safe place, best have multiple copies in different locations.

why would you even transfer a private key anywhere using the android device?
A phone device is probably the worst way for holding crypto funds. I think one of the easiest options for you is to have a blockchain.info wallet and use their application, you can also access it via the web from other devices.
there you can use a QR code for everything, thus you will avoid the risk of a potential clipboard infection.

You can always look out and be alert upon copy pasting. Your worry is valid because there are malware that really attacks you with copy pasting of addresses and the hackers address will replace yours.

First, don't save your private keys/seeds on your mobile device. Keep it simple in a written form and keep that in a place that's safe and only you know it at least.

Second, a mobile wallet is what you'll use since you don't have much option. Research on what's the most recommended one, if you're for a multi currency wallet, there are plenty of them but make sure that they provide private keys for their users.

Lastly, as what I've said in the first sentence. Be vigilant and don't send quickly, before you send a transaction, check it as many times as you can if the address you'll be sending it out is correct.

Though I know that possible hacking and malware infection in mobile wallet apps but fortunately, I've never experienced it in how many years using an android mobile phone.  But you shouldn't create your wallet on your mobile phone in the first place, upon creation finds a device that is rarely used on the internet, a laptop would be better to create a wallet through Electrum.

But if that's a big amount that you've wanted to store in a long run, it would be better if you have to spend a little amount to buy a hardware wallet which is pretty safe.  Don't risk your investment and might you'll regret it in the future.

You shall not feel worry about that. What you can do to double check when you were clicking the ccopy and pasting your privatekey. There was also another way like prepare a note to write your privatekey manually. This is will much more safe if you are feeling worry by using the copy and pasting board. I think that if it is the best way to write your privatekey manually. I do know that the reputation of android is the worst thing to hodl your crypto.
This is working pretty the same like when you were using the paper wallet. This is the most easiest way to do rather than gone with a complicated way but you must keep your paper wallet privately.

Write down the private keys into you personal diary or something which isn't not accessible by others, that is the better way in my opinion. I don't know how much you're holding in your android wallet but if I am not wrong I kept upto one bitcoin in my Electrum wallet which is created on both PC and android but I sm sure that I didn't have installed any pirated apps and applications from third party websites so I can say that I am safe so not really worried.

To me what strikes me about this, is that if the OP doesn't have money for a hardware wallet, he must not have much money in the Android Wallet, I'm guessing something like $50.

Looking at his post history, he seems like an impulsive person who is driven by the fads of the moment to invest in shitcoins, and surely with the market downturn there has been, the value of his portfolio is laughable.

Friend Vvang, if you don't have money for a hardware wallet you shouldn't be spending money on the shitcoins of the moment to see if you hit the lottery.

I would tell you that before spending a penny more on "investments" you should do a lot of research and not put money into something because you've seen the Youtuber of the moment, but as impulsive as I think you are I doubt you'll listen to me.

Having funds that you're afraid to lose on an Android mobile is just one more disaster out of everything you've been doing lately. Stop, reflect and try to do things right from now on.

Ive read some cases on axie infinity community regarding this kind of virus wherein you copy an address and paste it then the wallet is different suddenly. When they transact the tokens sent to the wrong address. So be careful when you click links might get some malware like that.

To be safe actually using free wallets download is never try to join massive airdrops with potential scam links. Cause you might get those kind of viruses that could resulted to hack.

Exactly, this is risky enough. There maybe malware clipboard if we are clicking copying and then pasting and this means that the private keys copied and pasted may be different.
Aditionaly, saving our private keys online is not safe enough. Not only about malware but also hack probability. Commonly, an app or certain platform has print options in their platform or wallet. This may be used to print out the private kye and store it to the safest thing or person that we know. But if you don't trust it anymore, it is better to save it by yourself.

I have been using mobile wallets for years and so far nothing untoward has happened. Perhaps you only need to choose a wallet which is both open-source and non-custodial. Of course, the level of security is lower for a hot wallet compared to a cold wallet. But for the meantime, while you have yet to secure yourself a hardware wallet, it's best to take note of that.

Also, avoid saving vital information in your phone as you're probably connecting it online every now and then and undesirable entities could get access to those files. So instead of copy-pasting your private keys in your mobile device, it's best to just manually write it down on a piece of paper, make several copies, and keep them in different safe places.

Well, when it involves security, it is extremely valid to use a Hardware Wallet.

A mobile wallet would be ideal for you to keep a small amount in it, maybe $50 / $100 / $500 or others values, so you can use it on a daily basis.

I do not advise you to store a large amount of Bitcoin in a Mobile Wallet, because it is very vulnerable.

If you don't have a hardware wallet yet, One option that came in my mind is to use the Electrum wallet.
It is an excellent wallet and also has several interesting features!

Electrum also allows some methods to increase the security of your wallet, which would be the use of additional passphrases or multi-sig.

@Vvang, if you don't know how to create a multi-sig wallet on Electrum, I translated a topic that would be a tutorial to creating a wallet on Electrum Multi-sig  :)

For more information - [TUTORIAL] - How to create a multi-signed wallet on Electrum  (https://bitcointalk.org/index.php?topic=5392586)

I think a better part that can trigger this issue is with sites the mobile wallet owner visits. If the user has a habit of visiting porn sites they will easily be exposed to malware vulnerability. This expectedly also exposes the wallet to hacks and attacks. I've been using mobile wallets as long as I can remember and I haven't had any issues with the various ones I have used. I make sure I'm extremely careful while installing them. I don't copy to paste passphrases. Just generate the passphrase offline and write them out on a sheet of paper.

If it is a crypto wallet that will be used only for storage, then I would consider that after ensuring that the backup (seed words) is completely correct and safe, delete the entire wallet and before that save the addresses that have a balance or master public key with which I would make a watch-only wallet (https://electrum.readthedocs.io/en/latest/coldstorage.html). For someone who only receives transactions, this would be safer as it would prevent possible hacking - although everyone should still be on the lookout for clipboard malware in that case.

In case the OP or someone else uses a mobile wallet for outgoing transactions as well, raise your smartphone habits to the highest possible level, which includes AV protection, not downloading risky apps, and regular security updates for your OS.

Mobile wallet doesn't mean inherently insecure. Same as a offline computer doesn't necessarily mean it's secure. Depends on how it was generated mainly, and for the upmost security the device should remain offline from generation.

Okay, so I think it's important to distinguish why, and mainly because mobile phones are assumed to be online, and used as a daily device. However, that isn't always the case. A mobile phone wallet, that is completely offline should be just as safe as a computer based one. There might be some arguments in there, that might prove otherwise, but if it's stored correctly, and generated correctly, and the way you downloaded the wallet software was verified, and done correctly, then it should in theory be about the same security.

Personally, I would prefer a offline wallet generated via computer, but I get that phones could be a valid option for others, as long as they keep it offline. The risks multiply when you connect a wallet or generate a wallet to the internet. By that, I don't mean the wallet directly, but the device it's stored on.

Well it’s very important to be security sensitive in all aspect of crypto-currency but one way of being security conscious is by not complicating things, I have and android wallet of which I make use of and by following simple instructions I have been able to remain safe, first you need to trust yourself alone that is your first point of security your phone password should be private then about coping and pasting, well call me orthodox but I prefer to write my seed phase down and keep it safe.

This is the step most users go about keeping there private keys safe or seed phrase. For electrum it's clearly seed phrase for which your sure to verify before proceeding. This involves you making a hardcopy of the seed phrase, you are allowed to make screenshots but, its not of best interest to have your keys in the screenshot on your device or any device at that, not to mention getting to upload it somewhere especially on the Internet. Most people see safety in Google cloud but that would be one of the worst ideas ever. Any hack or phishing attempt and your keys/seed is compromised too.
You would have better luck with safety in copying the seed phrase and storing it in a location that your sure to be secured.

Keep in mind, that whatever wallet you have been using on the device, you need to secure your device first. Often we use mobile for daily life and browse a lot of sites. So you need to be careful about phishing attempts and malware. So you would be safe, and always you need to double-check the wallet address you are going to paste. Make sure the address are matching with the address you have copied. If you found something wrong, immediately erase everything and reinstall your wallet. Don't forget to secure and save your wallet credentials offline device or notebook to avoid loss.

Well, I confess that I didn't think with that vision
Thanks for correcting me!

I have a limited knowledge in this technical area, can you tell me which type of OS is more vulnerable, Android or iOS? (or this variable depends exclusively on the smartphone user?

By default, iOS generally is safer than Android. But there are things to consider such as user behavior, Android/iOS version and built-in application. Each smartphone brand have different built-in application where some of it can't be removed. For example, there was vulnerability found on Samsung built-in application[1].

[1] https://techcrunch.com/2021/06/10/security-flaws-found-in-samsungs-stock-mobile-apps/ (https://techcrunch.com/2021/06/10/security-flaws-found-in-samsungs-stock-mobile-apps/)

If you do not have money for a hardware wallet, then most likely you have nothing to store there. Your mobile wallet will remain safe if you don't connect it to questionable sites to get a few dollars. You also need to do research before installing unknown apps on your phone.

If you have a tablet or a computer that you don't need to connect to internet you can use them as cold wallet. You will use them to sign your transactions with the seed they store and use your smartphone to create unsigned transactions in "watch only" mode and to broadcast transactions signed by your cold device. It's very easy with Electrum, you can also make a multisig wallet with your cold device as co-signer, it's almost the same thing as explained in the thread (https://bitcointalk.org/index.php?topic=5392586) of gagux123 quoted above. If you need to connect your cold device, you will have to send your funds to another seed before and to never use this seed again.

You are right again. But the difference is that not all people are wise and accurate. I read the OP's post history. It's short, but even there you can see that the OP is hot and hasty. He does not study but is in a hurry, hence the fear of losing.

In addition, he had money to spend on a hardware wallet and was gradually learning about cryptocurrencies, but he did it differently. The funny thing is, he will lose these coins too. Such people need experience and bitterness to be accurate.

But I agree that not everyone has the opportunity to purchase multiple devices to share their entertainment and finances. This is especially difficult when you are young.

One safe method I employ in keeping my wallet safe is to write out the recovery phrase/private keys on a book.
I have a special book for that, where I write my password and private key on.
It is very unsafe copying and saving your private keys/password online. Many wallets have been hacked that way. So, if you can't get a hardware wallet. Maybe you can try that method.
However, keep this book out of reach of anyone.

You can consider a mobile wallet but it is risky and easily hackable. I suggest you save up and get yourself a hard wallet so you can increase your security and maintain low stress. For the time being, it is okay but long term, not really. You need to backup also, so you can't risk your assets.

A hardwallet is quite cheap... I don't know how much you invested in crypto but probably not a huge amount if you can't afford to buy a hard wallet.
The best thing is just to write down on a piece of paper your seed phare and to never interact with risky websites or tokens.

Ledger Nano S is cheap and I wonder why the OP finds it hard to get one if he's truly the fear of losing his coins grabbed him in the neck since mobile is always vulnerable to attack and it's not advised to use it as storage wallet.

I don't have any experience on getting my mobile wallet hacked, I use non-custodial wallet for years now and don't have any issues with it. If your scared of your putting some crypto on your mobile phone, I suggest to re-format it to clear all your apps and files to avoid malicous apps and files to your phone. If you have a good amount of crypto, I think selling some would be enough to buy a hardware wallet. Not just you improve your security, You also get a confidence and will make you stop worrying about your wallet conditions.

Most of us would use a PC, but there are steps you can take to secure your Android device as well.

First of all, make it cleaned from all malware, by installing something like the Alliance Shield app from Google Play.

Second, make sure that you are only using the correct wallet software, such as Electrum Wallet, Atomic Wallet, Guarda or others. Make sure there are no fake copies of wallets installed.

You can ensure that you only have legit wallet apps by going to the website of the wallet, and click on the download link for Android. It should take you to the Google Play link, so if it does not list it as installed, then it means that the copy of that wallet you have installed is a fake copy.

I don't know the amount of Bitcoin you have managed to secure but if it is value worth almost to $1k, I will suggest you get a hardware wallet at all cost but if it is less than or within the range of a hundred, you can use Electrum since it can be used offline with any computer that doesn't have anything installed. Create a seed phrase with a passphrase or seed extension and make sure you back it up, send your bitcoin to any of the wallet addresses. Open an Electrum wallet on your android device and create a watched only wallet with that address. You can be viewing your balance on your android but you have to make sure that your seeed phrase is properly secure, if you loose it, keep it safe like you would keep a secret until you need it.

Many people that claim they can't afford hardware wallets can afford them, they just don't want to. Think about it. If you own a modern smartphone or change phones every few years, you might as well use an older model and purchase a decent hardware wallet for the difference. I have talked about Bitcoin with a friend who says he doesn't have money to invest, but at the same time he uses a better phone than I do, owns a smart-watch, expensive sneakers, and buys new shirts every now and then. Of course he can invest in Bitcoin. Instead of purchasing 4 shirts this month, he could just buy 2 and save money for a hardware wallet...

---

Using a mobile wallet is less safe than using a desktop or hardware wallet. But in the end, it comes down to the person and the way the phone is used. If you can't differentiate good security practices from bad ones, you might want to look into learning that first before you start dealing with cryptocurrencies. I have used mobile wallets for years with amounts I spend when on the go and I don't have problems with that. But I am also not the person who will fall victim to phishing, malware, and other online hazards. Get yourself familiar with basic online safety and you won't have to worry about having your devices hacked.