Module 7: Security model of Bitcoin wallets

​

7.1 Introduction

• Immediate theft of user funds
• Permanent loss with no recovery
• Destruction of user trust and product reputation

​

7.2 Fundamental truths about Bitcoin wallet security

​

7.3 Main threats Bitcoin wallets face

1. Device Theft or Loss If a phone or laptop is stolen, an attacker might access the wallet app and private keys. Defense:
   • Encrypt private keys at rest.
   • Protect app access with PIN codes, biometrics.
   • Auto-lock wallet apps after inactivity.
   • Allow full wallet recovery only via seed phrase.
2. Malware and Phishing Malware can:
   • Steal private keys stored insecurely.
   • Replace clipboard Bitcoin addresses (changing the address when user pastes).
   • Trick users into revealing seed phrases through fake apps or emails.
   Defense:
   • Never store or expose private keys in plaintext.
   • Warn users clearly about verifying addresses.
   • Never ask users to re-enter seed phrases unless in a true recovery context.
   • Educate users about phishing risks.
3. Cloud Storage and Backup Risks If wallets offer cloud backups, attackers may:
   • Hack user cloud accounts.
   • Retrieve improperly secured wallet backups.
   Defense:
   • Encrypt seed phrases client-side before uploading to cloud.
   • Use user-controlled passphrases, not server-controlled encryption.
   • Clearly label cloud backup as optional and risky if user chooses it.
4. Supply Chain Attacks If the wallet software itself is compromised during development, update distribution, or build processes, attackers could inject malicious code to leak keys. Defense:
   • Audit and minimize third-party dependencies.
   • Use secure build pipelines.
   • Prefer open-source libraries with strong security reputations (e.g., BDK, Noble libraries).
   • Allow community verification of wallet source code where possible.
5. Physical Access Attacks Attackers with access to unlocked devices may extract wallet secrets. Defense:
   • Hardware-level encryption (using Secure Enclave / Android Keystore).
   • Detect rooted/jailbroken devices and restrict access.
   • Encourage users to set strong device-level security (passwords, PINs).
6. Social Engineering and Seed Phrase Theft Most Bitcoin thefts happen not because of technical hacking, but because users are tricked. Examples:
   • “Customer support” asking for a seed phrase.
   • “Urgent security update” requiring users to re-enter their seed.
   Defense:
   • Never, under any circumstance, design flows that re-request seed phrases except during voluntary wallet recovery.
   • Warn users constantly: “No one from [Wallet Name] will ever ask for your recovery phrase.”

​

7.4 Wallet threat model summary

​

7.5 What happens if users lose their seed?

• Their device
• Their app
• Their access credentials

• Treat the seed phrase as the real “vault key.”
• Force backup at onboarding.
• Educate users that backup = bank vault key, not just a password reset.
• Offer optional encrypted backups only with full user control.
• Never promise “account recovery” like Web2 apps do. Bitcoin wallets do not work that way.

​

7.6 UX principles for security

​

7.7 Advanced protections (optional future features)

​

7.8 Summary of module 7

• Secure private keys against device loss, theft, malware, and human error.
• Treat the seed phrase as the absolute foundation of user control.
• Protect users not only with encryption, but also with intelligent UX that minimizes risk.
• Expect that users will make mistakes, and design flows that limit irreversible disasters.

​

Module 7 complete