Digital hygiene & security

With Bitcoin, you are the bank — which means you are also the security department. The maths protecting your coins is effectively unbreakable; the weak point is always human. These habits are how self-custody stays safe. Most losses come not from broken cryptography but from broken hygiene.

The golden rule: your seed never goes digital

The single most important habit. Your seed phrase should never be typed into a computer or phone, photographed, emailed, stored in the cloud, saved in a password manager, or sent to anyone — ever. The moment it touches an internet-connected device, assume it can be stolen. Write it on paper or, better, stamp it into steel (fireproof, waterproof), and store it physically. A hardware wallet shows you the seed once, offline; that’s where it should stay.

Everyday hygiene

• Two-factor authentication (2FA). On every exchange and account, turn on 2FA using an authenticator app or a hardware security key — never SMS, which attackers hijack by “SIM-swapping” your phone number.
• Verify, don’t trust, addresses. Malware can swap a copied address for the attacker’s. Always check the first and last few characters on your hardware wallet’s own screen before sending.
• Beware phishing. Fake wallet sites and apps exist to harvest seeds. Download only from official sources, and bookmark them. Urgency and “too good to be true” are the scammer’s tools.
• Test with small amounts first. Before moving a large sum, send a tiny amount and confirm it arrives. A few sats spent on a test is cheap insurance.

Advanced protections

• Passphrase / hidden wallets. Adding an extra secret word (a “passphrase”, sometimes called the 25th word) creates a separate, hidden wallet. This is the answer to what security folks half-jokingly call the “$5 wrench attack” — the point, made famous by an xkcd cartoon, that no unbreakable encryption stops someone from simply threatening you until you hand over your coins. If you’re ever forced to open your device, you can reveal a decoy wallet holding a small balance while your real funds stay invisible behind the passphrase. Powerful — but if you forget the passphrase, those funds are gone, so store it as carefully as the seed.
• Memorisation, with care. A seed phrase can, in principle, be memorised — a “brain wallet” carried across borders with nothing physical. But human memory is fallible; a single forgotten word loses everything. Treat memorisation as a supplement to a durable physical backup, never a replacement.
• Multisig for real money. As we saw, splitting control across keys in different locations removes the single point of failure — the gold standard for securing significant holdings.

The end of the beginning

You’ve travelled from barter and the properties of money, through the rise and fall of gold and fiat, into the computer science and cryptography that made digital scarcity possible — and finally to Bitcoin, and how to hold it. You started this course asking “what is money, really?” You now know enough to answer for yourself — and to decide, with open eyes, what part sound money plays in your life.

One last thing before you go: put it all to the test. The final exam is next.

Key takeaways

• The golden rule: your seed phrase never goes on any internet-connected device, and no one legitimate will ever ask for it.
• Use app-based (not SMS) 2FA, verify addresses on the device, and consider a passphrase ‘decoy wallet’ against the ‘$5 wrench attack’.

Check yourself

Who might legitimately ask for your seed phrase?

Support staffAn exchangeA wallet appNo one — anyone asking is trying to rob you

Why avoid SMS for two-factor authentication?

It’s slowAttackers hijack your number by ‘SIM-swapping’ — use an app or hardware keyIt costs moneyIt’s actually fine