Bitcoin Security Education Hub

A seed phrase (also called a recovery phrase or mnemonic phrase) is a sequence of 12 or 24 common English words generated when you create a new Bitcoin wallet. These words encode the private keys that control your Bitcoin.

The seed phrase standard is defined by BIP39 (Bitcoin Improvement Proposal 39). It uses a wordlist of 2,048 words. A 12-word phrase provides 128 bits of entropy; a 24-word phrase provides 256 bits — both are computationally impossible to brute-force.

Why it matters:

• Anyone who has your seed phrase has full control of your Bitcoin.
• If you lose your seed phrase and your device breaks, your Bitcoin is gone forever.
• No bank, no company, and no government can recover it for you.

How to store it safely:

• Write it on paper with a pen. Never type it into any device.
• Store copies in at least two separate physical locations (e.g., home safe + safety deposit box).
• Consider engraving it on a metal plate for fire and water resistance.
• Never photograph it, email it, or store it in cloud services.

The golden rule: your seed phrase should never touch the internet.

The BIP39 passphrase is an optional extra word (or phrase) added to your seed phrase. While your 12 or 24 words are fixed, the passphrase can be any string of characters — a word, a sentence, or a random string.

How it works: The passphrase is combined with your seed words during key derivation. Even a single character difference creates a completely different set of private keys and a completely different wallet. There is no "wrong" passphrase — every passphrase generates a valid wallet.

Key benefits:

• Plausible deniability: You can keep a small amount of Bitcoin in the wallet without a passphrase (the "decoy wallet") and your real funds in the passphrase-protected wallet.
• Protection against physical theft: If someone steals your seed phrase backup, they still cannot access your funds without the passphrase.
• No single point of failure: Store the seed phrase and passphrase in separate locations.

Important warnings:

• There is no way to recover a forgotten passphrase. Not even the wallet developers can help.
• Choose a passphrase you can memorize, or store it securely and separately from your seed.
• Test your passphrase setup before sending significant funds.

Bitcoin's blockchain is a public ledger. Every transaction ever made is permanently recorded and visible to anyone. While wallet addresses don't contain your name, they can often be linked to your real identity through various techniques.

How your privacy can be compromised:

• Exchange KYC: When you buy Bitcoin on an exchange, your identity is linked to your withdrawal address.
• Address reuse: Using the same address multiple times makes it trivial to track your transaction history.
• Chain analysis: Companies like Chainalysis use clustering algorithms to link addresses to identities.
• IP address leakage: Broadcasting transactions from your home IP can reveal your location.

Privacy best practices:

• Use a new address for every transaction (most modern wallets do this automatically).
• Use Tor to broadcast transactions anonymously.
• Use CoinJoin / Privacy Protocol to break transaction history links.
• Avoid mixing KYC and non-KYC coins in the same wallet.

Privacy is not about hiding illegal activity — it's about protecting your financial sovereignty, just as you wouldn't show your bank statements to strangers.

Mobile wallets are great for everyday spending and small amounts, but they come with unique risks compared to hardware wallets or air-gapped setups.

Top mobile security risks:

• Malware: Malicious apps can read your clipboard, screen, or keystrokes.
• SIM swapping: Attackers convince your carrier to transfer your number, bypassing SMS 2FA.
• Fake wallet apps: Counterfeit apps in app stores steal your seed phrase on first launch.
• Physical theft: An unlocked phone in the wrong hands can drain your wallet.

How to stay safe:

• Only install wallets from official sources (App Store / Google Play) and verify the developer name.
• Enable full-disk encryption and a strong PIN or biometric lock.
• Never enter your seed phrase on a device connected to the internet unless absolutely necessary.
• Keep only spending money in mobile wallets — store savings in cold storage.
• Use a dedicated device for crypto if you hold significant amounts.

CoinJoin is a method of combining multiple Bitcoin transactions from different users into a single transaction. This makes it difficult for blockchain analysts to determine which input corresponds to which output.

How it works:

• Multiple users agree to combine their transactions.
• All inputs and equal-value outputs are mixed together in one transaction.
• An outside observer cannot determine who sent Bitcoin to whom.

What CoinJoin protects against:

• Transaction graph analysis linking your past and future transactions.
• Exchange surveillance of withdrawal addresses.
• Merchant profiling based on your payment history.

Limitations to understand:

• CoinJoin improves privacy but is not a magic bullet — post-mix spending habits matter.
• Mixing fees apply (typically 0.3%–0.5%).
• Some exchanges may flag CoinJoin outputs — understand the regulatory environment in your jurisdiction.

For maximum effectiveness, use CoinJoin in combination with Tor, fresh addresses, and careful post-mix spending practices.

When you hold Bitcoin on an exchange, you don't actually own Bitcoin — you own an IOU from the exchange. The exchange holds the private keys; you hold a promise.

Risks of exchange custody:

• Exchange hacks: Mt. Gox (2014), Bitfinex (2016), FTX (2022) — billions lost in exchange collapses.
• Freezes and withdrawal limits: Exchanges can freeze your account at any time.
• Regulatory seizure: Governments can compel exchanges to freeze or seize funds.
• Insolvency: If an exchange goes bankrupt, you become an unsecured creditor.

Self-custody means:

• You hold the private keys (via seed phrase).
• No third party can freeze, seize, or lose your funds.
• You are solely responsible for security and backup.

The recommended approach: use exchanges only for buying/selling, then immediately withdraw to a self-custody wallet you control.