Buildathons.ai

Crypto Security: Wallets, Keys & Safe Storage Course…

Master the security fundamentals — private key management, hardware wallets, multi-sig, common attack vectors (phishing, rug pulls, approval exploits), and…

Course overview

Master the security fundamentals — private key management, hardware wallets, multi-sig, common attack vectors (phishing, rug pulls, approval exploits), and secure key derivation.

Wallet Types & Key Management

Never store private keys in code or environment variables visible to users. EOA (Hot Wallet): Private key in browser (MetaMask) — convenient, higher risk. Use for small amounts only. Hardware Wallet (Ledger, Trezor): Private key never leaves the device. Even malware can't steal it. Multi-Signature (Multisig): M-of-N scheme — e.g., 2-of-3 signers required. Used by DAOs and exchanges. MPC Wallets (Multi-Party Computation): Key shares distributed across multiple parties — no single point of failure. For a backend that needs to sign transactions: Use AWS KMS or HashiCorp Vault — keys never touch application memory Never hardcode private keys — use environment variables with restricted access Rotate keys regularly and audit signing operations

Hierarchical Deterministic (HD) Wallets & BIP-39

HD wallets generate an entire tree of key pairs from a single seed phrase (12 or 24 words). This means: back up one seed phrase → recover all wallets forever.

Common Attack Vectors

Token Approval Exploits: When you approve a contract to spend tokens, malicious contracts can drain your wallet. Always check approval amounts — use revoke.cash to audit. Phishing: Fake websites that look identical to real protocols. Always check URLs carefully. Rug Pulls: Developers abandon projects and drain liquidity pools. Check: is the contract verified? Is liquidity locked? Are owner functions time-locked? Private Key Exposure: .env files committed to GitHub, clipboard sniffers, fake browser extensions. Use .gitignore aggressively. Re-entrancy Attacks: Smart contract calls external contract before updating its own state — the external contract calls back and double-spends. The DAO hack of 2016 stole $60M this way.