C4 Wallet Security & Key Management Flashcards

What attack involves a malicious actor replacing a legitimate wallet address displayed in an application with their own address?

Answer: Address substitution / clipboard hijacking attack

Clipboard hijacking malware monitors the clipboard and silently replaces copied cryptocurrency addresses with the attacker's address.

Which key management practice does C4 recommend for long-term storage of significant cryptocurrency holdings?

Answer: Using a reputable hardware wallet with an offline, encrypted backup of the seed phrase

C4 best practices recommend hardware wallets paired with secure, offline backups (e.g., metal seed plates) for long-term significant holdings.

What is key stretching as applied to cryptocurrency wallet passphrases?

Answer: Using a computationally intensive function (e.g., PBKDF2) to derive a key from a password, slowing brute-force attacks

Key stretching functions like PBKDF2 (used in BIP39) apply thousands of iterations to make brute-force attacks against passphrases computationally expensive.

What is the risk of storing a seed phrase digitally in a photograph or note-taking app?

Answer: Cloud sync or app compromise can expose the seed phrase to attackers

Cloud-synced apps can be hacked or compromised, exposing the seed phrase and allowing an attacker to drain the wallet completely.

What is Shamir's Secret Sharing (SSS) as applied to cryptocurrency key backup?

Answer: A cryptographic scheme that splits a secret into multiple shares, requiring a threshold number to reconstruct it

Shamir's Secret Sharing splits a secret (such as a seed) into N shares, where any defined threshold K shares can reconstruct the original secret.

Why should cryptocurrency users verify wallet software downloads using cryptographic signatures provided by developers?

Answer: To ensure the downloaded binary has not been tampered with or replaced by a malicious version

Verifying GPG/PGP signatures confirms the software comes from the legitimate developer and has not been modified by a third party (supply chain attack).