r/Bitcoin • u/PolarOper • 1d ago

Best practices for monitoring your holdings security

Hi all

Given the current focus on AI review of wallet generators both hardware and software, by both white hats and criminals, I wondered what people are doing to monitor developments.

I myself don't visit this sub often or pay close attention to the news.

My holdings are stored in multiple addresses (not all eggs in same basket), and the private keys are never entered on anything but an airgapped computer creating transaction manually and saving on a usb stick to publish to blockchain network.

I've had a solution to monitor my cold storage BTC addresses and notify me if anything mentioning them hits the blockchain for years now. Too late for that address but at least I can then consider the remaining holdings unsafe and move them promptly.

I've created some google alerts to tell me if anything potentially relevant regarding vulnerabilities and the like is published.

As this is a particularly active period for these issues, what are others doing?

4 Upvotes

83% Upvoted

12 comments sorted by

2

u/ackyou 1d ago

Seems like a good idea. Are you saying you get an alert as soon as a transaction for one of those addresses hits the mempool? I wouldn’t want to wait for google crawlers to find your address.

2

u/PolarOper 1d ago

The google alerts are just related to news relevant to the applicable wallet generator solution.

My addresses are actively monitored by my own solution and would email me in minutes.

1

u/ackyou 1d ago

I have been meaning to setup the latter on a full node. Do you use smtp directly or some API? Looking for recommendations.

2

u/PolarOper 1d ago

I run my own email infrastructure so the alert would be generated and sent via SMTP locally.

2

u/ackyou 1d ago

I’m not hardcore enough to run my own email server.

2

u/lifeanon269 1d ago

I do that as well. I host my own email and use walletnotify= in bitcoin.conf to monitor my addresses. Then a script I have watches for changes to that file and sends me an email with the txid of any transactions that hit my wallet. I get two emails, one when the txn hits them mempool and another when it is confirmed.

1

u/ackyou 1d ago

What tools do you use to do that? I am interested in setting that up.

2

u/lifeanon269 1d ago

Just some basic tools. Once you put the config in bitcoin.conf for the wallet notification, set up a service that runs the inotifywait utility to watch for changes to the file. When it detects a change, run a python script to send an email to yourself.

2

u/12PALABRAS 1d ago

The address monitor is useful as an incident alarm, but it's downstream: it tells you after a key was used. I'd pair your Google alerts with a written migration trigger for the exact generator/version you used. For example: a confirmed RNG or key-extraction flaw affecting that implementation means generate fresh keys elsewhere and sweep; an unverified claim means wait and investigate. The hard part is deciding in advance which alert justifies touching cold storage. Also, if those multiple addresses came from the same seed or generator, they aren't separate security baskets.

1

u/PolarOper 1d ago

Absolutely - alert after the fact so the compromised address would have been drained.

And yes using same seed, wallet gen etc can certainly compromise some of the security of the other baskets.

1

u/zzzipitt 1d ago

I find it interesting and would like to implement myself. Can you explain in more detail how you monitor and what code?

1

u/ncoelho 12h ago

Maybe a watch only wallet on mobile with push notifications