Share Your Suggestions About Security For Bitcoin Wallet Android Users

[bayu7adi]

I've been using Android phone since 2014, and so far, I haven't really grasped the threats or dangers of ransomware or malware that could target sensitive apps on my device.

As we know, Bitcoin wallets installed on Android aren't exactly strong against various threats. We use them for daily need, and the device frequently exposed to the internet. I've been pretty good at avoiding scams on WhatsApp or identifying phone scams. but... there are still many uncertainties about hacking, scams, or other forms of cyber attacks on android device.

I'm just curious about what I should be most cautious about when installing a Bitcoin wallet on my Android. What kinds of malware usually pose a threat to the security of my Android based wallet? What types of keyloggers should I be wary of to ensure the safety of my Bitcoin wallet on Android?

Maybe sharing experiences here could give me insights into what I should do and avoid to prevent any future problems.

I will quote good and reasonable answers on this topic so its easier to find the best answer

Some good answer

-cut-
Some Chinese phones probably have hidden code running on firmware level and you can't even detect it's there.
Even with best phones you are constantly connected to internet, so only way to make it more secure is to use secondary offline phone device.
This can be your old phone or hardware wallet with installed wallet, and this can be used with other hot wallet that is connected with internet.
Even better if you have Pixel phones, because you can install open source Graphene OS on them.

Some of the security measures you should be aware of are
- If possible, the primary wallet should be installed on a smartphone that you do not use intensively for internet and other online purposes.

- Do not install unknown apps, or apps from untrusted third parties, There will now be a warning about installing new apps.
There is Google Protect for Android which will provide information on whether the app is safe or not.

- Do not connect your device to unknown networks such as free Wifi in cafes or other places.
Some scammers usually trap their victims with Free Wifi.

- Remove apps that have lots of ads such as games and some apps that provide pop-up ads.
The beginning of malware comes from applications like that.

• Do not try to download programs from unknown sources.
• Do not try to download programs with low downloads from Google Play.
• Download only trusted applications that have thousands of downloads.
• Try to reduce the number of programs you download, as there is no need to download any application or game you like.
• Do not store seeds in digital form or give permissions to any application to do so, including keyboard.
• Check the address several times before sending.
• Avoid random browsing and linking your wallet to any service.
• Make the phone specific for sending Bitcoin and receiving calls.

[1714638223]

1714638223

[1714638223]

1714638223

[Findingnemo]

First of all, this is a child board for the specific wallet : Bitcoin Wallet not just whole Android wallets in general so move to appropriate board if possible.

Bitcoin wallets installed on any device where we connect to the internet aren't safe, so we can't say we can feel completely safe if we take some precautions and all. But wallets on smartphones are good for small storage

So keep only small amounts and will not affect you anyway if you lose it.

Never install apps from third-party sources aka modded APKs which mostly contain spyware that can monitor your keystrokes means it can find your seed phrase and search Bitcoin somewhere the user on the other side can connect the dots.

Make use of the virtual keyboards to type the seed words whether it's creating a wallet or importing a wallet.

[Charles-Tim]

First of all, do not depend on only your Android mobile wallet. You need a secure and safer means like airgapped device, multisig or a hardware wallet.

On your Android, set app download preference to ask me everytime on playstore. Disable all apps download installation so that any app on your phone will not be able to install anything downloaded, unless you enable back yourself. This is how I use my phone that I have wallet on.

You can have two phones to make this convenient for you. You may even not use the phone your wallet is to browse than to use it for something like your bank, wallet and exchanges.

Make use of the virtual keyboards to type the seed words whether it's creating a wallet or importing a wallet.

Exactly. But also some wallets will ask you to just select the seed words or to select some words from the seed phrase after the backup. This is also good.

[FatFork]

From my experience, using open-source wallet apps from verified sources is a good way to stay safe. Stick to well-known and reputable wallet providers to minimize this risk. Also, keeping your Android and everything on it updated helps prevent potential vulnerabilities.

But above all, ensure your wallet usage aligns with the security risk it inherently carries. These mobile wallets, or hot wallets as we call them, are made for everyday use - for making frequent payments and transactions. So it's best not to rely solely on your mobile wallet or use it for long-term storage. If you wanna keep your coins secure for a good while, go with a cold wallet instead.

[taufik123]

I've been using Android phone since 2014, and so far, I haven't really grasped the threats or dangers of ransomware or malware that could target sensitive apps on my device.

Users of Android phones since 2014 will certainly have many Android security updates and that is your protection until now.

As we know, Bitcoin wallets installed on Android aren't exactly strong against various threats. We use them for daily need, and the device frequently exposed to the internet. I've been pretty good at avoiding scams on WhatsApp or identifying phone scams. but... there are still many uncertainties about hacking, scams, or other forms of cyber attacks on android device.

I'm just curious about what I should be most cautious about when installing a Bitcoin wallet on my Android. What kinds of malware usually pose a threat to the security of my Android based wallet? What types of keyloggers should I be wary of to ensure the safety of my Bitcoin wallet on Android?

Maybe sharing experiences here could give me insights into what I should do and avoid to prevent any future problems.

I will quote good and reasonable answers on this topic so its easier to find the best answer

If you use it daily and are constantly exposed to the internet, it will be more at risk for malware and some other viruses or ransomware that might infect.

The statement about "I'm smart enough" seems to need to be changed, because no matter how smart you are to avoid it there will be times when you unknowingly and carelessly click on some foreign files or links that lead to Malware.
Don't get caught up with clever words, because it will take away your vigilance.
Remember that scammers are constantly upgrading their ability to hack into any system.

Some of the security measures you should be aware of are
- If possible, the primary wallet should be installed on a smartphone that you do not use intensively for internet and other online purposes.

- Do not install unknown apps, or apps from untrusted third parties, There will now be a warning about installing new apps.
There is Google Protect for Android which will provide information on whether the app is safe or not.

- Do not connect your device to unknown networks such as free Wifi in cafes or other places.
Some scammers usually trap their victims with Free Wifi.

- Remove apps that have lots of ads such as games and some apps that provide pop-up ads.
The beginning of malware comes from applications like that.

Stay vigilant and always check every detail that is done.
Danger can come from anywhere, My device has even been attacked by Ransomware made my files locked,
it was a valuable lesson for me to stay alert in any case.

[Findingnemo]

From my experience, using open-source wallet apps from verified sources is a good way to stay safe. Stick to well-known and reputable wallet providers to minimize this risk. Also, keeping your Android and everything on it updated helps prevent potential vulnerabilities.

Open source and well-reputed wallet like Electrum is go to options for Android bitcoin users and keeping it updated along with software updates and patches don't mitigate the risk of malware. Android is prone to such attacks because users are likely to install premium versions of applications from pirated sites which we call modded APKs is the biggest and most common mistake an Android user which puts the user's privacy at high risk.

[aylabadia05]

Before having two androids, which I have now separated, androids that had an open source and trusted wallet installed (BlueWallet), I didn't install many applications other than the default ones.

Even though my Android version supports capacity if I play games, there isn't a single game installed so as long as I'm still carrying out my activities as usual and the battery life can last all day even if the internet is active unless I fall asleep (the internet connection is dead and I turn off the Android so it won't be disturbed when I sleep) .

There is a separation between Androids that have a wallet installed and Androids that do not have a wallet installed.
Android with a wallet installed, I limit the internet connection by activating airplane mode as long as I don't need internet access.

[Z-tight]

I'm just curious about what I should be most cautious about when installing a Bitcoin wallet on my Android. What kinds of malware usually pose a threat to the security of my Android based wallet? What types of keyloggers should I be wary of to ensure the safety of my Bitcoin wallet on Android?

You cannot ensure the safety of any wallet that is in an online device, that's because it is not possible to be totally sure that your device is free from malware, even if you try to look out for them. Any wallet on any online device is prone to hacking, so instead of you looking for possible kinds of malware, only store a small amount of BTC in your online wallet, that's an amount that you can afford to lose. Take note that a mobile phone is not also a good device to store a large amount of BTC, in that case you should buy a hardware wallet for your funds, or set up an airgapped wallet if you have the knowledge to do so.

[Yamane_Keto]

• Do not try to download programs from unknown sources.
• Do not try to download programs with low downloads from Google Play.
• Download only trusted applications that have thousands of downloads.
• Try to reduce the number of programs you download, as there is no need to download any application or game you like.
• Do not store seeds in digital form or give permissions to any application to do so, including keyboard.
• Check the address several times before sending.
• Avoid random browsing and linking your wallet to any service.
• Make the phone specific for sending Bitcoin and receiving calls.

[bayu7adi]

Bitcoin wallets installed on any device where we connect to the internet aren't safe, so we can't say we can feel completely safe if we take some precautions and all. But wallets on smartphones are good for small storage

So keep only small amounts and will not affect you anyway if you lose it.

I've implemented something like this before, even the BTC wallet I installed on Android is sometimes only used for small transactions like depositing on a casino platform or exchanging it for altcoins for small purposes. I've minimized the risks with these precautions.

However, the big question is... what kind of malware and spyware has affected BTC wallet users on Android? It's true, I haven't encountered any malware and spyware on Android that threatens my security, but it's essential for me to know what their models are... this way, my vigilance will be more appropriately tuned without compromising my security.

Before having two androids, which I have now separated, androids that had an open source and trusted wallet installed (BlueWallet), I didn't install many applications other than the default ones.

It's true, this is secure... but unfortunately, it eliminates the high mobility function that I desire in an all-in-one Android phone. I can't carry two gadgets when going somewhere, even if their sizes fit in my bag. It's not much different from installing my wallet on a private laptop with small size.

[Findingnemo]

However, the big question is... what kind of malware and spyware has affected BTC wallet users on Android? It's true, I haven't encountered any malware and spyware on Android that threatens my security, but it's essential for me to know what their models are... this way, my vigilance will be more appropriately tuned without compromising my security.

The most common malware that affects crypto wallet users on Android are clipboard hijackers and fake wallet apps but the point is, it is not just limited to it and the potential list can be endless.

Apart from the malware directly targeting crypto wallets, the platform is highly prone to be attacked by spyware, trojans, adware, backdoors, etc which will be a threat to the security of your funds along with any data stored like wallet backup, seed phrases, passwords.

[PrivacyG]

However, the big question is... what kind of malware and spyware has affected BTC wallet users on Android? It's true, I haven't encountered any malware and spyware on Android that threatens my security, but it's essential for me to know what their models are... this way, my vigilance will be more appropriately tuned without compromising my security.

Unless your Android phone is Rooted or you install APKs from Unknown Sources.  You should be fine.  Do not visit random websites and do not install less known Play Store applications.  You should stick to the well known and to the ROM your phone came with.  Do not flash another ROM because it will only build more vulnerabilities.

This is how most of the Android users get infected and inflicted damage upon their Wallets.  They do not stick to what is safe and start experimenting while their Bitcoin is still on their phone.  Big mistake.  Just be careful about the websites you visit, what you download, open, install and flash.  Always check many times if what you are doing is safe before actually doing it.

[Lucius]

~snip~
However, the big question is... what kind of malware and spyware has affected BTC wallet users on Android? It's true, I haven't encountered any malware and spyware on Android that threatens my security, but it's essential for me to know what their models are... this way, my vigilance will be more appropriately tuned without compromising my security.

In general, you can expect any malware/virus that appears in desktop versions, with the only difference being that malware adapts to mobile applications on such devices. If you follow all the advice that you could read in this topic, you have a small chance of infecting your device with something malicious, although you should always count on something new and unpredictable that can slip under the radar and infect millions of smartphones in a very short time.

Since you want to know more, the following link has a good summary of what you are interested in -> https://en.wikipedia.org/wiki/Mobile_malware

[sokani]

I'm just curious about what I should be most cautious about when installing a Bitcoin wallet on my Android. What kinds of malware usually pose a threat to the security of my Android based wallet? What types of keyloggers should I be wary of to ensure the safety of my Bitcoin wallet on Android?

As long as your phone is connected to the internet, there's always the tendency for vulnerability and in that case, I'd advise that you keep only a small amount of digital assets on your wallet.

Download apps from Play store and not from unknown sources. Whenever you want to download an app, always check that you're downloading the original app and not a clone.

Be careful of the apps you grant permission to access your device.

Never store your seed phrase electronically such as emails, note app, cloud storage etc.

Don't screenshot your seed phrase and save on your phone, it could be compromised by an infostealer.

Don't use third party keyboard applications, your seed phrase or other sensitive information could be stolen by keyloggers. Stick with the factory installed stock android keyboard.

[taufik123]

Unless your Android phone is Rooted or you install APKs from Unknown Sources.  You should be fine.  Do not visit random websites and do not install less known Play Store applications.  You should stick to the well known and to the ROM your phone came with.  Do not flash another ROM because it will only build more vulnerabilities.
-snip-

Use Official ROM and it will be safer and more recommended and don't do Root-ing.
A few years ago before knowing Bitcoin, I was quite active in flashing ROMs and Custom ROMs for several smartphones that I used.

Indeed Custom ROM will be more dangerous because there are many vulnerabilities that cannot be fixed,
it will be easily infected with Malware because Rooting that is done opens all entrances for Malware or ransomware.

Some naughty people modify a Custom ROM and Porting ROM usually they embed phishing links,
or Malware that will work to take advantage of smartphone users and even steal the identity of all logins made.

In general, you can expect any malware/virus that appears in desktop versions, with the only difference being that malware adapts to mobile applications on such devices.
-snip-

Malware is now even more sophisticated and smarter.
Even multi-device can attack any device.
Like Xenomorph, which caused an uproar with its powerful intelligence to hide from Google Protect antivirus detection by hiding in commonly used applications.

Xenomorhp even came again with more powerful power to steal all the identity of the device used such as bank data, account data, and crypto wallet Seed Phrase.
It is very dangerous if you are not aware of the security of the device used.

https://www.threatfabric.com/blogs/xenomorph#xenomorph_is_back_once_again

[bayu7adi]

The most common malware that affects crypto wallet users on Android are clipboard hijackers and fake wallet apps but the point is, it is not just limited to it and the potential list can be endless.

My computer was once infected with a virus that manipulated the copy-paste function. Whenever I copied a wallet address, whether it was from BSC, ETH, or BTC, the paste action resulted in the same wallet address. I could prevent this copy-paste manipulation by carefully checking the last few characters of the wallet before pasting it.

on Android, I haven't encountered a similar issue.

Like Xenomorph, which caused an uproar with its powerful intelligence to hide from Google Protect antivirus detection by hiding in commonly used applications.

Is this app genuinely useful for protecting our Android devices? I'm always skeptical about what Google Play Store offers, such as the antivirus apps available there. Despite many ratings claiming that they are top-notch antivirus programs capable of warding off numerous viruses, I find it hard to trust them easily.

even Google Play Protect can be bypassed by viruses, let alone antivirus apps on the play store... is it still wise to install antivirus on Android?? just feel unsafe installing that antivirus because it requires so many permissions.

[taufik123]

Is this app genuinely useful for protecting our Android devices? I'm always skeptical about what Google Play Store offers, such as the antivirus apps available there. Despite many ratings claiming that they are top-notch antivirus programs capable of warding off numerous viruses, I find it hard to trust them easily.

even Google Play Protect can be bypassed by viruses, let alone antivirus apps on the play store... is it still wise to install antivirus on Android?? just feel unsafe installing that antivirus because it requires so many permissions.

If you ask useful or not, Then I say it is useful for initial protection.
I know about Google Protect's weakness to ward off Xenomorph malware, but thanks to that Google Protect has been updated to address attacks of the same model.
 
As long as you still use Android Google Protect will be the first layer of protection and additional antivirus, I only trust antivirus vendors that are already well-known such as Kaspersky, Norton, and others.
Even now every Android smartphone has supporting protection that works together to become the default antivirus besides Google Protect.

Do not install antivirus applications that you do not know and usually the latest Android smartphones already have a built-in antivirus,
so there is no need for additional antivirus.

[taufik123]

Although it's not fully true if Android version of custom ROM is higher than official OS that comes with the Android phone.

Many vendors custom ROM for some smartphones do include an Update for each fix.
Custom ROM has more feature additions with improved Original features from Official ROM.

And when it comes to Custom ROMs and custom ROMs for crypto, there are ChiperOS, Lineage OS, Copperhead OS, CalyxOS and GrapheneOS which focus more on security.
But the use of Custom ROM will be the responsibility of each user.

Source:
[1]https://androidfoss.com/best-custom-roms-for-privacy/
[2]https://xdaforums.com/t/rom-official-11-0-rmx2020-cipheros-1-5-crypto-aosp-2021-03-20.4250137/

[DaveF]

All the security you need.

It's a hot wallet. Don't leave more then spending cash in it. Period. Full Stop.

If you still don't like the above answer. Pair it with some form of hardware wallet. If can be a physical card like a tapisgner or any hardware wallet that works for you.

Could be worse, you could have an iPhone

https://www.theverge.com/2023/9/8/23864150/ios-16-6-1-iphone-security-vulnerability-0-day-exploit-patch-update
https://www.bleepingcomputer.com/news/apple/apple-emergency-update-fixes-new-zero-day-used-to-hack-iphones/

-Dave

[dkbit98]

However, the big question is... what kind of malware and spyware has affected BTC wallet users on Android? It's true, I haven't encountered any malware and spyware on Android that threatens my security, but it's essential for me to know what their models are... this way, my vigilance will be more appropriately tuned without compromising my security.

How would you even know if you had secret malware program running on your phone?
Some Chinese phones probably have hidden code running on firmware level and you can't even detect it's there.
Even with best phones you are constantly connected to internet, so only way to make it more secure is to use secondary offline phone device.
This can be your old phone or hardware wallet with installed wallet, and this can be used with other hot wallet that is connected with internet.
Even better if you have Pixel phones, because you can install open source Graphene OS on them.