How do I safely transact / sell btc over the counter at a bitcoin exchange shop?

[9thsky]

If I'm being extra careful storing my bitcoin by using an airgaped computer and electrum, and using only a master watch key, how do I safely sell bitcoins over the counter at a bitcoin exchange outlet?

The issue isn't whether the exchange place is reputable or not. Considering its a huge company (such as coinbase) and it's reputation is not in question, how do I make sure nothing happens between the transfers...like having to go online with my seeds and so forth?

Any safety pointers / protocol? I also don't trust my phone, it being rooted n'all.

[ABCbits]

how do I make sure nothing happens between the transfers...like having to go online with my seeds and so forth?

Electrum have good guide about it to without going online with your seed, see https://electrum.readthedocs.io/en/latest/coldstorage.html
You need two device and a way to transfer the unsigned transaction.

[o_e_l_e_o]

how do I make sure nothing happens between the transfers...like having to go online with my seeds and so forth?

So, if your bitcoin are stored on an airgapped computer which obviously you do not want to take with you to the store, then you have two options as far as I can see it.

First option: Visit the shop, set up the agreed trade, and get their deposit address. Go home, make the transaction, return to the store, and collect your fiat.

Second option: Transfer the proportion of bitcoin you wish to sell out of your cold storage and on to a mobile wallet, a software wallet on a laptop you can carry with you, or a hardware wallet. Take that device with you to the store, and use it to make the transaction to the store once you are there.

[9thsky]

how do I make sure nothing happens between the transfers...like having to go online with my seeds and so forth?

Electrum have good guide about it to without going online with your seed, see https://electrum.readthedocs.io/en/latest/coldstorage.html
You need two device and a way to transfer the unsigned transaction.

Would it be safe for the watching-only wallet to be a rooted mobile phone that's always online? What's the worst that can happen? Let's say if the phone is compromised.

[9thsky]

how do I make sure nothing happens between the transfers...like having to go online with my seeds and so forth?

So, if your bitcoin are stored on an airgapped computer which obviously you do not want to take with you to the store, then you have two options as far as I can see it.

First option: Visit the shop, set up the agreed trade, and get their deposit address. Go home, make the transaction, return to the store, and collect your fiat.

Second option: Transfer the proportion of bitcoin you wish to sell out of your cold storage and on to a mobile wallet, a software wallet on a laptop you can carry with you, or a hardware wallet. Take that device with you to the store, and use it to make the transaction to the store once you are there.

I could take the airgaped computer (laptop) to the store. I'm concerned about getting online.

[mocacinno]

--snip--
Would it be safe for the watching-only wallet to be a rooted mobile phone that's always online? What's the worst that can happen? Let's say if the phone is compromised.

As long as you keep the airgapped computer offline, the worst that could happen if you use the xpub on a rooted phone that was compromised is basically that the hacker would be able to derive a list of addresses and check if they were funded.
He/she can not rob you, but he/she can harm your privacy... that's about it...

--snip--

I could take the airgaped computer (laptop) to the store. I'm concerned about getting online.

If you follow electrum's walktrough, there shouldn't be any instance where you have to bring your laptop online.
If you're really worried, just create an airgapped testnet wallet using the same electrum binaries on your laptop and mobile phone (just start the wallet with the testnet parameter). Fund your testnet wallet and try to spend your funds... If you can spend the testnet funds from your airgapped setup without bringing your laptop online, there should be no reason why you wouldn't be able to do the same on the main net.

[FatFork]

Would it be safe for the watching-only wallet to be a rooted mobile phone that's always online? What's the worst that can happen? Let's say if the phone is compromised.

A watching-only wallet means that the wallet doesn't hold any private keys. All it does is monitor the addresses, so no one can actually spend coins from the watching-only wallet.

[o_e_l_e_o]

I could take the airgaped computer (laptop) to the store. I'm concerned about getting online.

The airgapped computer should never go online. If it does, then it is no longer airgapped and your wallets are no long secured.

What you need to do is go to your airgapped computer, open your wallet in Electrum, click Wallet -> Information, and click on the QR code symbol at the bottom right of the box titled "Master Public Key". Then open Electrum on your phone, create a new wallet, select "Import Bitcoin addresses or private keys", click on the camera icon, and scan the QR code. This will create a watch only wallet on your phone, which can see all your addresses but does not contain any private keys, and therefore there is no risk of your coins being stolen should your phone be compromised.

When you want to make a transaction, craft the transaction on your mobile wallet, and then press the QR code button. Open your cold wallet on your laptop, go to Tools -> Load transaction -> From QR code, and scan the QR code from your phone to load the unsigned transaction. Then you sign your transaction on your cold wallet and hit Export -> Show as QR code. On your phone, go to Send -> Scan, and scan the QR code from your laptop to load the now signed transaction. You can then broadcast this transaction from your phone.

This means that your private keys never leave your airgapped computer, and your airgapped computer never goes online.

The biggest risk with what you have described is carrying your airgapped laptop around with you. My airgapped encrypted cold storage never leaves the house. Any coins I want to carry with me I do so on a mobile wallet or a hardware wallet.

[9thsky]

OK, so using the unsigned method, would it be possible considering the shop provides a QR code to send them bitcoins?

[o_e_l_e_o]

OK, so using the unsigned method, would it be possible considering the shop provides a QR code to send them bitcoins?

Absolutely. The shop displays a QR code, you scan it with your phone, set up the transaction and choose your fees, generate a QR code of this unsigned transaction, scan it with your laptop, sign the transaction, generate a QR code of this signed transaction, scan it with your phone, broadcast the signed transaction.

[bob123]

You wouldn't always need to carry your air-gapped wallet with you.

Depending on the situation, you might be able to get the address you'll need to send the funds to prior visiting the store.
Then you could already create and sign the transaction at home (not broadcasting it!) and take it with you to the store.

When making the trade, broadcast the transaction there.

This would obviously require you to know the address and the amount you are going to sell before going to that store.
I don't know how applicable this is to your situation.

[9thsky]

How about when it comes to selling online like to websites (such as Coinbase)? How safe is it sending your bitcoins to their wallet (I'm guessing that's the only way to do it)? Do they offer any guarantees (like tanditional banks)? Any precautionary steps to follow in this case?

[pooya87]

How about when it comes to selling online like to websites (such as Coinbase)? How safe is it sending your bitcoins to their wallet (I'm guessing that's the only way to do it)? Do they offer any guarantees (like tanditional banks)? Any precautionary steps to follow in this case?

Not exactly any guarantees, no. They all promise to have top notch security and have enough funds in safe place for compensation then we see them get hacked and millions of dollars worth of cryptocurrencies stolen just like that. Sometimes they compensate the users or at least some of it, sometimes they don't.
The only thing users can do is to decrease their exposure to risks, eg by not storing coins on exchanges and only making quick trades and cashing out.

[o_e_l_e_o]

How about when it comes to selling online like to websites (such as Coinbase)? How safe is it sending your bitcoins to their wallet (I'm guessing that's the only way to do it)?

Indeed. When dealing with centralized exchanges such as Coinbase, the only way to use them is to deposit your coins in to their wallets and give up control of your money for the time it is on their platform.

Do they offer any guarantees (like tanditional banks)? Any precautionary steps to follow in this case?

Some of the larger ones such as Coinbase and Binance either offer insurance on funds that you have deposited to their platform, or in the past have absorbed the losses from hacks and thefts from their own profits so that their customers do not lose out. However, many smaller exchanges do not offer this or could not afford this, and even with the large exchanges, all it takes is one hack of sufficient size and all their security and guarantees go out the window.

However, hacks of the exchange itself are probably the least of your concerns when using a centralized exchange. The far more common hacks are hacking of individual accounts, either through brute force, phishing, social engineering, hacking email accounts, or whatever. If your individual account is hacked and all your funds stolen, no exchange will offer any compensation since it wasn't their fault. On top of external hacks, you have to take in to account that while your funds are on an exchange, you do not own them. There are thousands of users across pretty much every exchange who have had their coins confiscated or seized or their accounts frozen because the exchange has decided that some part of their activity was "suspicious". That could be from tracking your deposits or withdrawals, or the trades you make, of the volumes you trade, or a hundred other things - the exchanges rarely give a reason other than you have triggered some internal algorithm or process. And on top of all that, you have to consider the privacy implications of completing KYC and handing over all your details to a centralized exchange, many of whom have been caught sharing or selling this information with third parties in the past.

[Theb]

Unfortunately I don't think exchanges with reputable names will allow you to trade with their OTC desk because this is a service for institutional customers only. Like Coinbase they have what they call Coinbase Prime for their OTC desk and the only customers they are willing to take are large volume buyers/sellers aka Institutional investors or traders. Also when it comes to you trading via OTC on a reputable exchange I don't think you have to worry about anything as long as you know the basics about security like you not providing your private key or any other info that will lead you vulnerable to any hacks.

When it comes to privacy here is what Coinbase has to say in their OTC pdf.

Every OTC trading partner is also a Coinbase customer, meaning that they will have completed extensive onboarding and AML / KYC screening and verification. Client information remains strictly confidential and counterparty details are never revealed.

If you won't be dealing on large quantities of crypto I don't think OTC trading is suited for you since you are better off trading in a normal trading platform.