Cryptocurrency Wallets and Security 5 — Questions and Answers
Question 1: What is a 'wrench attack' (also called a $5 wrench attack) in cryptocurrency security?
- Exploiting weak encryption by brute-forcing short private keys
- Physically coercing a person to reveal their private keys or seed phrase (Correct answer)
- Using a hardware tool to extract keys from a device's chip
- A network attack that corrupts blockchain consensus
Correct answer: Physically coercing a person to reveal their private keys or seed phrase
A wrench attack refers to physical threats or violence used to force a person to hand over crypto access, bypassing all digital security measures.
Question 2: How does a 'honey pot' or decoy wallet help protect cryptocurrency holdings?
- It attracts miners to prioritize legitimate transactions
- It holds a small amount of funds that, if drained, signals the owner that their security is compromised (Correct answer)
- It mirrors the main wallet to test new transactions safely
- It generates fake addresses to confuse chain analysis tools
Correct answer: It holds a small amount of funds that, if drained, signals the owner that their security is compromised
A decoy wallet with a small visible balance can reveal unauthorized access attempts while protecting the main wallet hidden behind a passphrase.
Question 3: What is the risk of generating a seed phrase on an internet-connected device at setup?
- The seed may not meet BIP39 entropy standards
- Malware or keyloggers could capture the seed phrase during generation (Correct answer)
- The blockchain requires online validation of new seed phrases
- Internet-generated seeds expire after 90 days for security
Correct answer: Malware or keyloggers could capture the seed phrase during generation
Any malware present during seed generation can silently record the phrase, giving attackers permanent access to the wallet without any further interaction.
Question 4: Which storage medium is most resistant to physical degradation over long time periods for a seed phrase backup?
- Laminated paper in a waterproof bag
- Steel or titanium metal plate with stamped or engraved words (Correct answer)
- Encrypted USB drive in a fireproof container
- Printed QR code stored in a safety deposit box
Correct answer: Steel or titanium metal plate with stamped or engraved words
Metal plates resist fire, water, and corrosion for decades, unlike paper which degrades, USB drives that fail, and QR codes that fade.
Question 5: What is the purpose of the 'coin control' feature in advanced Bitcoin wallet software?
- Setting a maximum price at which the wallet will process transactions
- Manually selecting which UTXOs to spend to improve privacy and fee management (Correct answer)
- Controlling which coins are eligible for staking rewards
- Locking specific addresses from receiving future deposits
Correct answer: Manually selecting which UTXOs to spend to improve privacy and fee management
Coin control lets users choose exactly which UTXOs are included in a transaction, preventing dust coins from linking addresses and enabling fee optimization.
Question 6: What does 'key derivation function' (KDF) contribute to wallet password security?
- It generates the blockchain address from a public key
- It makes brute-force attacks computationally expensive by intentionally slowing password hashing (Correct answer)
- It converts a 12-word seed into a 256-bit master private key
- It distributes key storage across multiple servers for redundancy
Correct answer: It makes brute-force attacks computationally expensive by intentionally slowing password hashing
KDFs like bcrypt, scrypt, or Argon2 are deliberately slow, meaning attackers must spend enormous time and resources to test each password guess.
Question 7: A user receives an email claiming their wallet provider requires them to verify their seed phrase to prevent account suspension. What should they do?
- Submit the seed phrase through the official website only, not the email link
- Ignore and delete the email — no legitimate service ever requests a seed phrase (Correct answer)
- Enter the first 6 words as a partial verification to confirm legitimacy first
- Call the support number listed in the email to confirm the request
Correct answer: Ignore and delete the email — no legitimate service ever requests a seed phrase
No legitimate wallet provider or exchange will ever ask for your seed phrase; this is a phishing attempt designed to steal full wallet access.
Cryptocurrency Wallets and Security 5
What is a 'wrench attack' (also called a $5 wrench attack) in cryptocurrency security?