img width: 750px; iframe.movie width: 750px; height: 450px;
Core wallet security best practices for safe crypto storage
Core wallet security best practices for safe crypto storage
Write your seed phrase on fireproof steel plates, not paper. Paper burns at 233°C. Steel survives house fires. Never type your recovery phrase into a connected device unless you are physically restoring a device that will remain offline afterward. A single photograph of your seed phrase on a smartphone exposes it to every cloud sync service.
Use a dedicated offline device with a hardened operating system to generate your private key. A Raspberry Pi that never connects to a network creates entropy from hardware noise, not predictable software algorithms. This eliminates remote extraction vectors. Store each private key on separate encrypted USB drives, with one copy in a safety deposit box in a different jurisdiction.
Generate a unique password for each staking application, not a reused master string. Staking rewards accumulate on-chain and are visible on explorers. An attacker who sees your reward flow knows which address to target. Change the password after each withdrawal cycle. Combine a diceware-phrase of seven words with a random 12-character alphanumeric string for each platform.
Never send crypto from a device that has ever accessed a dApp. Use a hardware signer for outgoing transactions. The signing device must never store the private key – only sign after verifying the transaction data on a separate screen. This prevents blind signing attacks that drain staking rewards to attacker addresses. Test each new protocol by sending 0.001 of the asset first.
Core Wallet Security Best Practices for Safe Crypto Storage
Always store your recovery phrase offline, engraved on steel plates or written on fireproof paper, because any digital copy–screenshot, cloud file, or email–destroys its protective value. A single compromise of your device makes that phrase usable to sign transaction requests from any attacker, draining your funds instantly.
To protect your private key, never enter your seed phrase into any website, browser extension, or software that requests it for “verification.” Legitimate non-custodial systems derive the private key locally on your machine and never ask you to paste the full phrase online. Use a dedicated hardware device for staking rewards generation to avoid exposing keys on internet-connected machines.
Set a unique and complex password–minimum 20 characters with mixed symbols–for encrypting your local database files. Without this password, even if the digital seed phrase container is stolen, the attacker cannot decrypt it to send crypto. Never reuse this password across other platforms.
When you need to sign transaction once a month for staking rewards claims, temporarily connect your hardware device to a clean, offline computer that has never browsed the web or installed unknown software. After signing, disconnect the hardware and verify the transaction details on a separate view-only system before broadcasting.
After each time you send crypto or claim staking rewards, generate a fresh receive address for the next deposit. This prevents address reuse from leaking your transaction history and reduces the risk of targeted attacks against a known private key holder. Keep multiple copies of your recovery phrase in geographically separate secure locations.
How to Generate and Store Your Private Key Offline Without Exposing It to Hot Systems
Use a dedicated, air-gapped machine that has never connected to the internet to generate your private key. Boot a live Linux distribution from a USB drive on an old laptop, disable all wireless hardware (Wi-Fi, Bluetooth), and physically remove any network card if possible. Run a command-line tool like `bitcoin-cli` or `openssl` to create the key, ensuring the entropy source is manually seeded by random dice rolls or coin flips–do not rely on the system's default random generator. Write the 24-word recovery phrase directly onto acid-free paper using a pencil, not a printer or digital clipboard, to avoid electronic residue.
After generation, immediately encrypt the private key file using `gpg --symmetric --cipher-algo AES256` on the same offline machine. Choose a password with at least 20 random characters, mixing uppercase, lowercase, digits, and symbols. This encrypted file can then be moved to a USB drive–but only after you have physically verified no other data exists on that drive. Store this drive in a fireproof safe, separate from the paper recovery phrase. Never type the password into any device that has ever been online, as keyloggers or memory scrapers could capture it.
To sign transaction offline, transfer the partially signed transaction (PSBT) to the air-gapped machine via QR code or microSD card. Load the encrypted private key, decrypt it with your password solely on that offline system, apply the signature, and then export the signed transaction back to your online interface. This process ensures your signing material never traverses a network cable or wireless signal. Test this workflow with a small amount first–send crypto to a test address and verify the broadcast succeeds without exposing secrets.
Store multiple copies of the recovery phrase in geographically separate locations. Use metal plates stamped with the words–avoid laminated paper, which can melt or degrade. Each plate must be hidden in a place only you know, such as a safety deposit box or buried container. For redundancy, split the seed phrase using a simple XOR scheme across three plates, requiring any two to recover the key. This prevents a single point of failure if one location is compromised.
Hardware isolation: Use a Raspberry Pi with no network interfaces enabled, running a minimal OS from a read-only SD card.
Entropy source: Roll a die 99 times to generate 256 bits of randomness, entering results manually into the generator.
Verification: On a second offline machine, derive the public key from your private key and confirm it matches your hot address before any deposit.
When you need to access funds, never enter the full seed phrase into any software running on a connected device. Instead, derive individual private keys for specific transactions using a hardware signing device or a dedicated offline laptop. For daily use, create a watch-only address on your online system that tracks balances without holding keys. If you must re-import keys, use a hardware device that signs transaction data internally, never exposing the raw private key to the host computer’s memory.
Taxonomy of attack vectors to avoid: electromagnetic sniffing (use a Faraday bag for your offline machine during generation), acoustic cryptanalysis (generate in a quiet room), and physical theft (distribute key fragments across banks). For maximum protection, combine a passphrase with your seed phrase–append a 40-character string you memorized exclusively. This passphrase acts as a hidden 25th word; even if someone finds the 24-word list, they cannot access funds without it.
Generate key using diceware entropy on a fully offline computer.
Encrypt the private key file with AES-256 and a high-entropy password.
Store paper seed phrase in a fireproof safe and encrypted USB in another location.
Use only offline signing to send crypto after verifying addresses.
Periodically test your recovery process by importing the seed phrase into a fresh offline environment–never online–and confirming the entire balance is recoverable. Burn old USB drives after transferring data to new media every 12 months, as flash storage degrades. This discipline ensures your private key remains a secret known only to you, never risking exposure to hot systems that constantly face probing from malicious actors.
Q&A:
I’m setting up a Core wallet for the first time. What is the single most critical step I have to get right so I don’t lose my crypto immediately?
The most critical step is the safe creation and storage of your 12 or 24-word seed phrase (also called a recovery phrase or mnemonic). This phrase is the master key to your wallet. If you lose it, you lose access to your funds permanently, and if someone else finds it, they can steal everything. When you first create your Core wallet, the software will show you these words. You must write them down physically on paper or a metal backup. Do not take a screenshot, do not type them into a notes app, do not store them in cloud storage like Google Drive or iCloud. That is a way to get hacked. Keep that paper in a safe place, like a fireproof safe for a home. If you are dealing with a serious amount of crypto, consider a shatter-proof metal backup in case of fire or flood. The software is just an interface; the seed phrase is the real asset.
I use the same password for a lot of things. Is it okay to use a strong but reused password for my Core wallet?
No, that is a bad idea. The password you set in the Core desktop app (or any hot wallet) is only for local access to the software on that specific device. It is not the same as your seed phrase. However, a strong, unique password adds a layer of protection if someone gains physical access to your computer while the wallet is locked. A reused password is dangerous because if a different website you use gets hacked and your password is leaked, someone could try that same password on your Core wallet file. They would still need the actual wallet file, but it adds risk. The real focus should be on your seed phrase security, but as a secondary measure, use a password manager to generate a long random password for your Core wallet that you do not use anywhere else. This stops that kind of automated attack.
If my computer crashes or is stolen, how do I get my CORE tokens back? I’m worried I’ll lose everything if the hard drive dies.
You do not need the wallet software or the hard drive to get your tokens back. The CORE tokens are recorded on the blockchain, not inside your computer. Your computer only holds the private key in the wallet file that allows you to control those tokens. If your computer is destroyed or stolen, you can recover your funds on any other device using your 12 or 24-word seed phrase. You simply install the official Core wallet software on a new machine, select the option to "Import Wallet" or "Recover from Seed Phrase," and type in those exact words. Your entire balance will reappear. This is precisely why protecting the physical backup of your seed phrase is the most important step. Without that phrase, the tokens are unreachable forever. A good practice is to write down the specific wallet derivation path (if any) along with the phrase, though the standard core browser wallet wallet usually handles this automatically during recovery.