Security & Self-Custody

Protect your crypto: seeds, phishing, hardware, threat models.

Self-custody is hard because attacks are creative. This collection walks through the threats that actually catch users: phishing pages, fake support DMs, malicious dApps, lost seeds, and how SSP's 2-of-2 model neutralises most of them.

Square SSP Academy cover: hijacked social media accounts

Hijacked accounts: when a trusted voice posts a scam

Scammers take over trusted social accounts to post fake airdrops, migrations and security alerts. How takeovers happen, what the scam posts look like, how to spot them, and how account owners can protect themselves.

4 min
Square SSP Academy cover: front-end and DNS hijacks

Front-end hijacks: when the real website turns against you

A dApp's contracts can be safe while its website is hijacked through DNS, hosting or a compromised dependency. How front-end attacks work, what they ask you to sign, and why your wallet's request screen is the real defence.

5 min
Square SSP Academy cover: fake job offer malware

Fake job offers: when the interview is the attack

Fake recruiters lure crypto workers into running a coding test or installing a meeting app that steals wallets and passwords. How the scheme works, where the payload hides, the red flags, and how to protect yourself.

5 min
Square SSP Academy cover: reading security audit reports

Security audits: what an audit report actually tells you

"Audited" is one of crypto's most common badges and one of its most misread. How to read an audit report — scope, date, version, severities and fixes — what audits can't tell you, and the red flags in audit claims.

5 min
Square SSP Academy cover: password managers and crypto secrets

Password managers and crypto: what to store, and what never to

Password managers make almost every account safer. Which crypto secrets belong in one — exchange logins, wallet unlock passwords — and why recovery phrases and private keys should stay offline and, for multisig, apart.

4 min
Square SSP Academy cover: fake crypto wallet apps

Fake wallet apps: how to make sure you installed the real one

Counterfeit wallet apps and extensions steal recovery phrases or control what you see. How they reach people through ads, stores and lookalike domains, five habits that stop them, and what a two-device setup does and doesn't protect.

5 min
Square SSP Academy cover: clipboard hijacker malware

Clipboard hijackers: the malware that swaps the address you pasted

Clipper malware watches what you copy and swaps crypto addresses for the attacker's at the moment you paste. How it works, how it gets installed, how to check addresses properly, and why confirming on a second device matters.

5 min
Square SSP Academy cover: signing messages and sign in with your wallet

Signing a message: what "sign in with your wallet" actually proves

A message signature costs no gas and leaves nothing on-chain, but it binds your key to data. What login signatures prove, which off-chain signatures can move your funds, and how to read a signing request before you approve.

5 min
Square SSP Academy cover: physical threats and wrench attacks against crypto holders

Physical threats: when the attack isn't digital

Someone who can threaten you in person doesn't need to break cryptography. Why wrench attacks are growing, why privacy is the best defence, what 2-of-2 multisig does and doesn't do against coercion, and how to structure holdings to reduce exposure.

5 min
Square SSP Academy cover: fake crypto support and recovery scams

Fake support and recovery scams: the second theft

When something goes wrong and you ask for help, scammers answer first. What fake support and recovery agents ask for, why legitimate support never cold-messages you, and what SSP support can and structurally cannot do.

5 min
Square SSP Academy cover: fake airdrop claims and signature drainers

Airdrops: the claim is the attack

An unexpected token can't take anything from you — signing the claim can. The three things claim pages actually ask you to sign, why off-chain permits are the dangerous modern variant, and what SSP shows you for a typed-data signature.

6 min
Square SSP Academy cover: running your own blockchain node

Running your own node, and why most people don't need to

A node decides what is true for you instead of repeating what a server said. What it actually buys — verification, privacy, unstoppable broadcast — what it really costs, and the honest gap between SSP letting you point at your own node and that being easy.

6 min
Square SSP Academy cover: what the SSP relay server can and cannot see

What the SSP relay can and cannot see

The relay never holds a key and cannot sign — but for fifteen minutes at a time it handles your xpub and your unsigned transaction. What the TTL indexes actually enforce, and why the wallet is built to distrust our own server.

6 min
Square SSP Academy cover: verified smart contracts, proxies and upgrade keys

Verified contracts, proxies, and the upgrade key nobody mentions

A verification checkmark proves the source matches the bytecode — nothing more. Most contracts are proxies whose logic can be swapped after you approve them, which makes the real question who holds the upgrade key and whether there is a delay.

7 min
Square SSP Academy cover: quantum computing and cryptocurrency security

Quantum computing and your coins: what's actually at risk

Hashing is fine; signatures are not. Which of your coins are exposed today, why an address is not a public key, why 2-of-2 multisig barely helps here, and the one free thing you can do about it.

7 min
Square SSP Academy cover: on-chain privacy and what a crypto address reveals

What your address reveals: privacy on a permanently public ledger

An address needs to be linked to you exactly once, and then its whole history — past and future — is linked too. How clustering heuristics work without your cooperation, what actually helps, and the honest limits of what SSP does today.

6 min
Square SSP Academy cover: blind signing and unreadable transaction approvals

Blind signing: what you are actually approving when the screen says nothing useful

The transaction that steals your money is rarely the transaction you signed — you signed permission. Which selectors matter, why 'unlimited' is the word to look for, and why a decoder that guesses is worse than no decoder at all.

6 min
Square SSP Academy cover: address poisoning and lookalike crypto addresses

Address poisoning: the attack that only needs you to copy the wrong thing

No malware, no phishing site, no signature stolen. The attacker just puts a lookalike address in your transaction history and waits for you to copy it. Why 'always double-check the address' fails, and what actually defends against it.

7 min
SSP Academy square cover: the Coldcard entropy bug and two-device architecture

When the Randomness Fails: The Coldcard Entropy Bug and What Two Devices Change

A single 2021 commit made thousands of seeds guessable, and $116M left wallets that had done nothing wrong. Why weak entropy is silent, total loss — and the honest limits of what 2-of-2 protects against.

6 min
SSP Academy square cover: MPC wallets vs multisig

MPC Wallets vs Multisig

Threshold signatures split a key; multisig requires several. What the chain enforces, what each one costs, and which failures each model actually survives.

8 min
SSP Academy square cover: transaction simulation in SSP Enterprise

Transaction Simulation: What a Transaction Will Do Before You Sign It

A preview of a transaction's effects, fourteen warning checks, address-poisoning detection — and why none of it is allowed to block your signature.

8 min
SSP Academy square cover: critical actions and re-signing in SSP Enterprise

Critical Actions: Why Some Operations Ask for Both Devices Again

Thirteen operations need re-signing, not a session cookie. Why the server writes the challenge, what it is bound to, and why failed attempts are logged too.

6 min
SSP Academy square cover: what actually stops a transaction

What Actually Stops a Transaction

Whitelists, time locks and approval rules shape what gets proposed. Only the signature threshold is enforced by the chain. A three-layer threat model, stated honestly.

6 min
SSP Academy cover for a guide to mobile two-factor authentication, with wallet, key, and shield icons on a dark background.

Mobile 2FA: The Right Way and the Wrong Way

SMS 2FA is weak. Learn why, when TOTP authenticator apps and passkeys beat it, and how SSP Key co-signs every transaction as a second key.

8 min
SSP security cover with wallet, key, shield, and chip icons for a crypto OpSec checklist

Your Crypto OpSec Checklist

Run this 15-minute quarterly OpSec checklist to audit your self-custody: keys, devices, approvals, accounts, phishing, and recovery.

6 min
Cover illustration with wallet, key, shield, and chip icons beside the title Supply-Chain Attacks and Deterministic Builds

Supply-Chain Attacks and Deterministic Builds

What a software supply-chain attack is, why crypto wallets are prime targets, and how deterministic builds and audits let you verify what you run.

7 min
Square cover for a guide on BIP-39 passphrases, with wallet, key, shield, and chip icons over an SSP security badge.

Passphrase vs No Passphrase: The Trade-off

A BIP-39 passphrase — the optional 25th word — can protect a stolen seed or lock you out for good. What it buys, what it costs, and how it compares to SSP.

7 min
SSP security cover with wallet, key, shield, and chip icons on a navy square card

Browser-Extension Hygiene for Crypto Users

Browser extension security for self-custody: vet what you install, apply least privilege, lean on LavaMoat, and let SSP's 2-of-2 backstop a bad extension.

6 min
SSP security cover with wallet, key, shield, and chip icons, illustrating a guide to crypto phishing attacks.

Phishing Attacks Targeting Crypto Users (and How to Spot Them)

Crypto phishing targets you, not the cryptography. Learn the patterns — wallet drainers, approval phishing, address poisoning — and how SSP helps.

7 min
Key, lock, shield, and database icons illustrating crypto inheritance and emergency access planning

Crypto Inheritance Planning: Emergency Access

Crypto inheritance planning means giving heirs a path to your funds without exposing the keys. Practical approaches, honest trade-offs.

7 min
SSP Academy cover with lock, eye-off, shield, and key icons titled If a Key Is Compromised

What Happens If a Crypto Wallet Key Is Compromised

A crypto wallet key compromised in a 2-of-2 multisig is an emergency, not stolen funds. How to recognize, contain, and rotate keys fast.

6 min
SSP Academy cover: Lost Both Devices, full recovery from your seed phrase

Restore Your Crypto Wallet From a Seed Phrase

Lost both your SSP devices? Restore the entire wallet from your BIP39 seed phrase with this calm, step-by-step full recovery walkthrough.

7 min
SSP Academy cover for recovering a wallet after a lost phone, with fingerprint, key, shield, and wallet icons

Recover a Crypto Wallet After a Lost Phone

Lost the phone running SSP Key? Restore SSP Key on a new device while the browser key keeps your funds safe in the 2-of-2.

8 min
SSP Academy cover for recovering a wallet after a lost browser, with key, shield, wallet, and lightning icons

Recover a Crypto Wallet After a Lost Browser

Lost the browser extension to a new computer or wiped profile? Recover your SSP wallet with SSP Key, no seed phrase needed.

7 min
Wallet Recovery 101 cover with key, shield, database and wallet icons

How to Recover a Crypto Wallet: Keys vs. Seeds

A clear guide to crypto wallet recovery: what a seed phrase, derived keys, and metadata each do, and what you actually need to restore a wallet.

7 min
Navy SSP cover for Self-custody checklist for your first $1,000, with wallet, key, shield and fingerprint icons over a dark gradient

Self-custody checklist for your first $1,000 — the concrete starter playbook

Eight ordered steps to set up SSP 2-of-2, write down both seeds, test recovery, and move your first $1,000 off the exchange in one afternoon.

8 min
Navy SSP cover for Self-custody without going to cold storage, with wallet, key, shield and lightning icons over a dark gradient

Self-custody without going to cold storage — the middle path most users need

Self-custody isn't a single setup. The right point on the spectrum is warm storage — a multisig you actually use — not air-gapped cold storage.

8 min
Navy SSP cover for What self-custody actually requires of you, with key, shield, fingerprint and CPU icons over a dark gradient

What self-custody actually requires of you — the honest list

Backups, opsec, device management, recovery planning, time and attention — the five-category bill self-custody puts on you, no marketing softening.

8 min
Navy SSP cover for The 7 failure modes exchanges can suffer, with shield, lock, hidden-eye and lightning icons over a dark gradient

The 7 failure modes exchanges can suffer (and what each one looks like)

Insolvency, hacks, freezes, exit scams, sanctions, KYC locks, withdrawal halts — the seven ways your funds can leave a custodial exchange.

9 min
Navy SSP cover for Custodial vs. non-custodial wallets, with wallet, key, shield and CPU icons over a dark gradient

Custodial vs. non-custodial wallets: definitions, trade-offs, and the wallets that quietly are one

What custodial vs. non-custodial actually means, the 12-word test that tells them apart, the wallets that pretend to be one and aren't.

7 min
Navy SSP cover with wallet, key, shield and CPU icons over a dark gradient, opening the Self-Custody Fundamentals series

Not your keys, not your coins: where the phrase came from and why it keeps coming true

Origin and meaning of the most-repeated and most-ignored sentence in crypto, with Mt. Gox, Celsius, and FTX case studies, and when ignoring it is rational.

7 min
A vault icon shielding a user wallet from an exchange logo, indicating self-custody

Why self-custody matters now

Self-custody means you hold the keys. Here's what custodial failure actually looks like, what self-custody is, and the honest trade-offs.

5 min
Twelve-word seed phrase printed on a paper card next to a hardware wallet

Seed phrase best practices

What a seed phrase actually is, how to store it without losing it or leaking it, and how SSP's 2-of-2 multisig changes the threat model.

7 min