How safe are offline wallets?

[Ultegra134]

I'm currently using Electrum on my laptop; however, for whatever reason, I don't feel quite safe or comfortable practically having my bitcoin stored on my computer. How safe is a wallet like Electrum? If we suppose that my computer is infected with malware (or a Trojan horse, you name it), can someone access my wallet and send funds to another address? Is it possible to have the wallet.dat file stolen and accessed even though it's protected with a password?

I generally feel a little paranoid after being infected with a fake Google Sheets extension. I didn't lose anything of value, but I don't feel comfortable having my funds on the computer I'm using. Ever since, I've stopped downloading any pirated software and performed regular checks, but it's still unknown how I got infected. What other options do I have? Using a separate computer or hard drive for my wallet? The best option, I guess, is a hardware wallet.

[1714603583]

1714603583

[1714603583]

1714603583

[1714603583]

1714603583

[1714603583]

1714603583

[Charles-Tim]

You can go for Electrum cold storage or just buy a hardware wallet for more security. Online wallet can download and install malware which can be used to steal your coins. You can also use a paper wallet and keep it completely offline.

The advice has always been to have your coins on a cold wallet which are safer. It is true to not keep large amount of coin on an online wallet.

[hosseinimr93]

I don't feel quite safe or comfortable practically having my bitcoin stored on my computer.

Your bitcoin isn't stored on your computer.  Your bitcoin is on the blockchain and the keys you need to access your bitcoin are on your computer.

How safe is a wallet like Electrum?

Electrum is an open-source wallet and there isn't anything hidden from the users. If it's used in the correct way, it's completely secure.

If we suppose that my computer is infected with malware (or a Trojan horse, you name it), can someone access my wallet and send funds to another address?

Yes. That's possible. Your safety depends on how you use electrum. There's always the possibility that your computer gets comprised.

Using a separate computer or hard drive for my wallet? The best option, I guess, is a hardware wallet.

If you want to be 100% secure, you should use electrum on an air-gapped device.

[jackg]

An offline and airgapped.machine is one of the safest options, followed by a hardware wallet, then a 2 of 2 multisig with two online machines running different operating systems (such as a computer and a phone) and then a single wallet on an online machine like electrum.

If you're prone to installing malicious software.a keylogger is all that's needed to find your password and those are hideable enough. If your wallet file is discovered and is encrypted with at least 4-8 randomly generated words or 13 randomly generated alphanumeric characters then you're safe having your wallet file intercepted.

If you're storing more than $700, I think a hardware wallet should be a no brainer and a go to for storing funds. If you've got less then you will have to weigh up the consequences of storing your funds in hot wallets than using hardware and see what you're best doing.

[o_e_l_e_o]

How safe is a wallet like Electrum?

It's not that Electrum is unsafe - it's that your entire set up is unsafe.

The current version of Electrum has no critical bugs or vulnerabilities which could directly lead to your coins being stolen. In that sense, it is a very safe piece of software. However, it cannot protect you against malicious parties attacking your computer, stealing your wallet file, planting clipboard malware, keyloggers, or other malware, and so on. You are storing funds in a hot wallet and so no wallet software, regardless of how good it is, can possibly mitigate against all potential threats.

I must say that downloading pirated software on the same computer that stores a bitcoin hot wallet is a particularly dangerous move. As is using anything Google related.

What other options do I have?

A hardware wallet, or a cold airgapped wallet.

[pooya87]

The correct terminology for a wallet like Electrum is "desktop wallet" not "offline wallet".

And it is only as safe as the environment you are using it in. If you have installed it on an online computer (or any system that has been connected to the internet in the past even if it is offline from now on) it is considered less safe because your system could be infected and your keys could be compromised.

The only true security is in cold storage which is where your wallet is created and stored in an air gap environment. The easiest solution is hardware wallets which I consider semi-cold since there still is a small chance to be compromised. The best solution is a completely offline PC that is cut off from the rest of the world.

[m2017]

I'm currently using Electrum on my laptop; however, for whatever reason, I don't feel quite safe or comfortable practically having my bitcoin stored on my computer. How safe is a wallet like Electrum? If we suppose that my computer is infected with malware (or a Trojan horse, you name it), can someone access my wallet and send funds to another address? Is it possible to have the wallet.dat file stolen and accessed even though it's protected with a password?

I generally feel a little paranoid after being infected with a fake Google Sheets extension. I didn't lose anything of value, but I don't feel comfortable having my funds on the computer I'm using. Ever since, I've stopped downloading any pirated software and performed regular checks, but it's still unknown how I got infected. What other options do I have? Using a separate computer or hard drive for my wallet? The best option, I guess, is a hardware wallet.

Your feelings are understandable and a hardware wallet can return a sense of comfort. Judging by the fact that you are considering this decision, it can be assumed that you are leaning towards using the HW. So make a bold decision and don't expect the approval of others. The combination of Electrum + hardware wallet will be reliable, and if you want more, then use this bundle on another PC, which will only be used to work with crypto currencies. A restful sleep will be guaranteed for you.

Today is the last day of the Black Friday sale and you can order hardware wallet at a 15-30% discount depending on the brand. Check out this section to find out more: https://bitcointalk.org/index.php?board=261.0

[Lucius]

@Ultegra134, there is an option to still have Electrum on your computer, but at the same time you don't have any risk for your BTC. All you need to do is check whether your backup is correct and in a safe place, and then start the process of creating a watch-only wallet with which you can then have complete insight into your transactions and deposit addresses, but without the risk that you can in any way be hacked.

What you should pay attention to in that case is that if you want to recover the standard wallet again, be especially careful with your seed in the sense that you don't have a keylogger or some other dangerous malware on your PC.

[o_e_l_e_o]

All you need to do is check whether your backup is correct and in a safe place, and then start the process of creating a watch-only wallet with which you can then have complete insight into your transactions and deposit addresses, but without the risk that you can in any way be hacked.

Such a system is not that safe. By using a seed phrase which was generated in a hot wallet on an online machine, and stored for an unknown amount of time on the same online machine, then the seed phrase has still been exposed to the internet and any malware on OP's device, even if he now deletes it from his device and sets up a watch only wallet instead. And indeed, simply deleting the wallet file does not completely scrub it from the hard drive, and it could still be recovered. Not to mention that without an airgapped computer he can't make any transactions without importing his seed phrase back on to his online machine and again risking exposing it.

If you want a secure watch only wallet, then the corresponding seed phrase needs to be generated on a permanently airgapped machine and kept permanently airgapped itself.

[Lucius]

Such a system is not that safe.

No desktop or mobile hot wallet is safe, but I guess we can agree that it is safer to have a watch-only wallet than the standard version on the computer we use every day? If some malware has already compromised the OP seed, in most cases its wallet balance would already be zero, and surely the chances of that are less if you remove that hot wallet from your computer.

I just suggested him a completely free option so that he can sleep somewhat peacefully, but he should definitely think about a relatively cheap investment in a hardware wallet, or even better an airgapped device.

[o_e_l_e_o]

No desktop or mobile hot wallet is safe, but I guess we can agree that it is safer to have a watch-only wallet than the standard version on the computer we use every day?

Sure, but simply deleting an already hot wallet and turning it in to a watch only wallet on the same machine isn't that safe, which was the point I was making. In fact, you might even expose yourself to more risk if you are going to have to import your seed phrase in plain text back on to that online computer every time you want to make a transaction, as opposed to having it stored encrypted on the same computer in your wallet file. If you want the real security that a watch only wallet brings you, then the seed phrase/private keys need to have been generated securely in the first place.

I just suggested him a completely free option so that he can sleep somewhat peacefully, but he should definitely think about a relatively cheap investment in a hardware wallet, or even better an airgapped device.

Yeah, this. No amount of tinkering around the edges of a hot wallet will make it safe.

[dkbit98]

How safe is a wallet like Electrum? If we suppose that my computer is infected with malware (or a Trojan horse, you name it), can someone access my wallet and send funds to another address? Is it possible to have the wallet.dat file stolen and accessed even though it's protected with a password?

It's open source software and it's very safe if you use it correctly.
However, if your computer is infected with any malware than you shouldn't use any bitcoin wallet at all.
Even if you can access your wallet, malware can change your addresses or spy you in other ways to get your passwords and information.

I generally feel a little paranoid after being infected with a fake Google Sheets extension. I didn't lose anything of value, but I don't feel comfortable having my funds on the computer I'm using. Ever since, I've stopped downloading any pirated software and performed regular checks, but it's still unknown how I got infected. What other options do I have? Using a separate computer or hard drive for my wallet? The best option, I guess, is a hardware wallet.

It is best to use separate laptop with Linux OS installed, and this device should be used only for Bitcoin related stuff, and if possible offline.
Hardware wallet is most convenient option, it's like a mini dedicated computer that is great for mobility, but used laptop can often be cheaper and better than hardware wallet.

[Ultegra134]

Pardon me for not replying for over two days. I was having some health troubles and had some doc appointments and blood tests. Back to the subject now. Thank you for your replies, I'll try to respond to most of them.

I don't feel quite safe or comfortable practically having my bitcoin stored on my computer.

Your bitcoin isn't stored on your computer.  Your bitcoin is on the blockchain and the keys you need to access your bitcoin are on your computer.

Excuse me, wrong selection of words. You're correct.

It's not that Electrum is unsafe - it's that your entire set up is unsafe.

The current version of Electrum has no critical bugs or vulnerabilities which could directly lead to your coins being stolen. In that sense, it is a very safe piece of software. However, it cannot protect you against malicious parties attacking your computer, stealing your wallet file, planting clipboard malware, keyloggers, or other malware, and so on. You are storing funds in a hot wallet and so no wallet software, regardless of how good it is, can possibly mitigate against all potential threats.

I must say that downloading pirated software on the same computer that stores a bitcoin hot wallet is a particularly dangerous move. As is using anything Google related.

Certainly. Electrum is perfectly safe and have never faced any issues using it. My whole setup of storing my wallet in the computer I use sounds and is absolutely not that safe. I almost got burned once and could have lost a decent sum of money. I won't be that lucky next time.

The correct terminology for a wallet like Electrum is "desktop wallet" not "offline wallet".

The only true security is in cold storage which is where your wallet is created and stored in an air gap environment. The easiest solution is hardware wallets which I consider semi-cold since there still is a small chance to be compromised. The best solution is a completely offline PC that is cut off from the rest of the world.

Sorry, you're correct.

I'm planning to purchase a new laptop or even a desktop computer quite soon, and was actually planning to install the wallet to the old one and isolating it. What happens if the HDD goes bad, though? Backing up the seed phrase enough to recover it from another computer, I guess.

Today is the last day of the Black Friday sale and you can order hardware wallet at a 15-30% discount depending on the brand. Check out this section to find out more: https://bitcointalk.org/index.php?board=261.0

The idea of either buying a HW or buying a new laptop/desktop (which I was already planning to) are the most prevailing onces at the moment. Unfortunately, due to feeling unwell the past few days as explained before, I missed the Black Friday discount.

@Ultegra134, there is an option to still have Electrum on your computer, but at the same time you don't have any risk for your BTC. All you need to do is check whether your backup is correct and in a safe place, and then start the process of creating a watch-only wallet with which you can then have complete insight into your transactions and deposit addresses, but without the risk that you can in any way be hacked.

What you should pay attention to in that case is that if you want to recover the standard wallet again, be especially careful with your seed in the sense that you don't have a keylogger or some other dangerous malware on your PC.

Thanks for the suggestion. So, if I understand correctly, backing up the seed phrase on paper, for example, and setting the wallet to watch-only removes the ability to send funds and practically secures your wallet. Thus, in case I want to send Bitcoin to someone, I have to recover my wallet using the seed phrase. Am I correct?

[hosseinimr93]

What happens if the HDD goes bad, though? Backing up the seed phrase enough to recover it from another computer, I guess.

Right. All your private keys can be derived from your seed phrase and that's all you need for recovering your wallet.

So, if I understand correctly, backing up the seed phrase on paper, for example, and setting the wallet to watch-only removes the ability to send funds and practically secures your wallet. Thus, in case I want to send Bitcoin to someone, I have to recover my wallet using the seed phrase. Am I correct?

For spending bitcoin from your wallet, you should create an unsigned transaction on your watch-only wallet, sign it on the offline device and broadcast it using your online device.
In this way, you can make transaction without your seed phrase connecting to the internet.

[joniboini]

The Electrum guide linked by charles might be able to help you get a better picture of how to do it (with pics and stuff like that). I do recommend you to read it. Try to practice it a bit if you're not used to this.

Buying an HW wallet is also a good idea even if it was not discounted imo, but if you already have another device that can run Electrum and you only plan to use Bitcoin, there's no need to rush it. CMIIW.

[pooya87]

I'm planning to purchase a new laptop or even a desktop computer quite soon, and was actually planning to install the wallet to the old one and isolating it.

If you are willing to spend money on a computer it may be more convenient to purchase a hardware wallet instead. It is also cheaper.

Another method would be to use a live Linux which you could burn on a DVD to run offline without any network connection or access to hard disks, etc. and then creating the wallet in that environment and writing down the seed phrase on a piece of paper. Of course securing this wallet is harder and spending from it is more complicated compared to using a hardware wallet.
Also: https://bitcointalk.org/index.php?topic=853288.0

What happens if the HDD goes bad, though? Backing up the seed phrase enough to recover it from another computer, I guess.

That's right. It is always best to keep multiple backups so that you can reduce the risks of losing funds. Make sure to protect those backups though.

[Pmalek]

How safe is a wallet like Electrum?

It's safe when used on a completely secure OS operated by a user that knows what they are doing. Ideally, the computer that holds your software wallets (if you insist on using software wallets and not cold storage or hardware wallets) shouldn't be used for general internet surfing or whatever you did that had you download a fake Google Sheets extension. Use it for one purpose only: sending and receiving crypto. Adding new use cases just increases the possibility of something going wrong.

If we suppose that my computer is infected with malware (or a Trojan horse, you name it), can someone access my wallet and send funds to another address?
Is it possible to have the wallet.dat file stolen and accessed even though it's protected with a password?

Depending on the type of infection, someone could get access to your PC and take whatever files they want. They could also encrypt your data and ask you to pay a ransom to have it decrypted. Your keystrokes and display could be recorded to discover what you are typing, like passwords, PINs, etc. A password could be brute forced depending on its strength. "123456" is much easier to hack than "LeT14=hUGo#$".

I generally feel a little paranoid after being infected with a fake Google Sheets extension. I didn't lose anything of value, but I don't feel comfortable having my funds on the computer I'm using...The best option, I guess, is a hardware wallet.

You could have taken advantage of the various Black Friday offers that allowed you to purchase a solid device for $50-$100 if weren't sick. Too bad. The investment is worth it. We might see new promotions closer to the new year.

[hugeblack]

I'm planning to purchase a new laptop or even a desktop computer quite soon, and was actually planning to install the wallet to the old one and isolating it. What happens if the HDD goes bad, though? Backing up the seed phrase enough to recover it from another computer, I guess.

As long as you have the ability to purchase a new computer, buying a hardware wallet wallet will be a better solution if you are the skeptical type or that clicks randomly and explore new applications or download many unknown closed source programs/crackers.

A cold storage management requires some knowledge and keenness, otherwise it is better to purchase hardware wallet.

Finally, being offline does not mean that you are safe. If hacker gets access to the root, he may do a lot of things, so closing the Internet, signing TX, and re-connecting to the Internet does not mean that you are safe.

[Ultegra134]

~Snipped~

Thank you for your detailed response. I was already planning on buying a new computer because this one is getting rather old and slow. I struggled quite a lot a few months ago when I used more strenuous applications. This is why I considered isolating my older laptop with a Bitcoin wallet. Generally, hardware wallets seem like a decent measure to be on the safe side. During the Black Friday special, the most affordable Ledger one cost approximately €50, if I remember correctly. It sucks to have missed it.

I'm planning to purchase a new laptop or even a desktop computer quite soon, and was actually planning to install the wallet to the old one and isolating it. What happens if the HDD goes bad, though? Backing up the seed phrase enough to recover it from another computer, I guess.

As long as you have the ability to purchase a new computer, buying a hardware wallet wallet will be a better solution if you are the skeptical type or that clicks randomly and explore new applications or download many unknown closed source programs/crackers.

A cold storage management requires some knowledge and keenness, otherwise it is better to purchase hardware wallet.

Finally, being offline does not mean that you are safe. If hacker gets access to the root, he may do a lot of things, so closing the Internet, signing TX, and re-connecting to the Internet does not mean that you are safe.

I guess there isn't such a thing as 100% safety. So far, the hardware wallet option seems to be the safest and most affordable one. Buying a new computer was already on the schedule, but honestly, completely isolating it isn't always possible, and in my case, it probably isn't, because a functioning laptop is always handy.

[Pmalek]

During the Black Friday special, the most affordable Ledger one Trezor One cost approximately €50, if I remember correctly.

You probably just made a typo. But yeah, the Trezor One was on sale for €48 if you live outside of the EU (+ possible taxes depending on your country's tax laws) or €55-€56 within the EU. Trezor just made this announcement yesterday introducing a new promotion for Christmas. 50% off for leather accessories (I couldn't care about this) and free delivery worldwide. I tried to check it out, but I don't see any price reduction. The EU price is €82 and around €70 for deliveries outside of the EU. I think those were the standard rates before the Black Friday promos began.

Buying a new computer was already on the schedule, but honestly, completely isolating it isn't always possible, and in my case, it probably isn't, because a functioning laptop is always handy.

I understand what you are saying. Dedicating a laptop just for a bitcoin cold storage is not for everyone. In that case, keep checking for a better promotion to get your hands on a good hardware wallet. The current one from Trezor isn't special compared to what we had a few days ago. But if the price suits you, go ahead.