Six Ways to Lose Your All Your Crypto — Journal Report

By Cheryl Winokur MunkAttention crypto investors: Being careless will cost you.As cryptocurrencies gain in popularity, cybercriminals are adopting increasingly sophisticated methods to bilk investors, using artificial intelligence to create scams that are more convincing and more customized to each target. Then there's simple human error, which can be especially damaging when dealing with cryptocurrencies.Here are six ways that crypto investors who let their guard down could risk losing it all.Using the wrong exchangeYou can buy or sell cryptocurrencies through a broker, but many people trade crypto directly on exchanges, of which there are many. Unfortunately, some exchanges have failed in the past, taking crypto investors' holdings with them."There is never necessarily a foolproof plan" for dealing with exchanges, because there have been issues even with those that had been considered reputable, says Eric Jardine, cybercrimes research lead at Chainalysis, a New York-based firm that provides blockchain and cryptocurrency data, software, services and research.But you can improve your odds of avoiding trouble.Investors should buy cryptocurrency through an exchange that's registered with the New York State Department of Financial Services, because of the agency's stringent reporting requirements and rules, says Howard Greenberg, president of the American Blockchain and Cryptocurrency Association, a trade group. Buyers can check the department's website to see if an exchange they are considering is registered. The agency also reviews its exchanges' cybersecurity protocols, potentially reducing the risk of a hack."If you pick one that's approved there, that would be, to me, the closest to a gold standard that's available," Greenberg says.Ignoring storage riskTo access crypto assets, investors need the codes called private keys — long strings of numbers and letters. These keys are too long to memorize, so investors need to store them somehow. There are several options for storing them online, but many experts say that isn't the safest choice because there's always a risk of anything online being hacked.These experts recommend a device called a hardware wallet, or cold wallet, that stores private keys offline. There are many varieties, but hardware wallets generally are roughly the size of a thumb drive or a credit card.Cold storage "is strongly preferred for anything other than minimal holdings. Things connected to the internet are going to have a greater likelihood of getting hacked than not," says Tonya Evans, a professor at Penn State Dickinson Law who teaches an online course on cryptocurrency.Evans says investors might want to hedge their bets by spreading assets among a few different cold wallets. "We always talk about the diversification of asset classes and within asset classes. Diversification of your technology is also important," she says.Not protecting the master keyA seed phrase is a sort of master key — a long string of words that can be used to access all the private keys in a crypto wallet. It can be a lifesaver for crypto investors, because it can be used to recover your keys if your wallet is ever lost or damaged. But if someone else gets hold of it, they gain access to all the keys in the wallet and they can then steal your crypto. So storing the seed phrase safely is critical.Sometimes people store their seed phrase on a piece of paper and then lose it or it is accidentally destroyed, says Jardine of Chainalysis. If instead you store the phrase in a digital file on your laptop or phone, it's vulnerable to hackers.Greenberg, of the American Blockchain and Cryptocurrency Association, has his seed phrase stored on paper at his house, in a safe-deposit box at a bank and with a family member. He also stores it electronically on a hardware device. He adds that heirs also need to know where the seed phrase is stored.Handing the key to a scammerScammers are always looking for ways to steal seed phrases so they can steal crypto assets. For instance, sometimes they'll pose as tech support and ask for a crypto owner's seed phrase to help solve a problem they've identified."Never, under any circumstances, give out your seed phrase," says Steve Larsen, chief executive of AET Investment Services, an alternative-asset brokerage firm in Spokane, Wash.Even if your crypto is stored on a hardware device in your possession, it can be stolen if you give thieves the seed phrase.Falling for familiar tricksScammers can also use familiar social-engineering tactics to steal your crypto. They may send emails or texts, asking you to click on a link to claim crypto you've earned, or for some other reason. Unsuspecting crypto owners click on a link and inadvertently authorize cyber thieves to take everything out of their wallet, Larsen says.Don't respond to crypto-related solicitations over email or text and don't click on links, he says. "Crypto exchanges won't send you an email or text asking you to take action, but that's what people get in their inboxes all the time."He also cautions people to watch out for bogus crypto sites. He had a prospective client who signed up for an account with what the client thought was Coinbase, but it was an impostor site with a very similar URL. The investor lost more than $500,000.Botching transactionsEvans once sent crypto from cold storage to an exchange that didn't handle that particular currency and was told she couldn't get it back or get access to it unless the exchange someday decided to start handling that currency. It was a lesson learned, she says. "It's not retrievable unless the exchange supports it."Sending crypto from one cold wallet to another can also be problematic if you don't double-check the recipient's wallet address and you get it wrong. A mistake can result in losing your crypto permanently. Many crypto platforms have a QR code or copy-and-paste feature to minimize user error, but mistakes are easy to make if people aren't paying close attention, Evans says.Cheryl Winokur Munk is a writer in New Jersey. She can be reached at [email protected].