<p>I have my &quot;cold stash&quot; wallet.dat on multiple fully offline, encrypted hard disks/sticks inside a fireproof safe. I never seriously considered printing them onto paper because that would be too stealable/seizeable. At least they would have to point a gun to my head for me to give them the encryption key as I have it currently.</p>
<p>My &quot;live&quot; wallet.dat is running on my Windows 10 machine with Bitcoin Core. Yes, I know how insanely bad Windows 10 is, but I have also taken insane measures to be as safe as I could possibly be. But still, every day, I fear that some kind of malware update or 0-day will just snip away all my &quot;live&quot; coins.</p>
<p>(I say &quot;all my coins&quot; as if I have more than one Bitcoin in my live wallet. Yeah, right... More like &quot;all my satoshis&quot;.)</p>
<p>Now, I'm strongly considering starting to regularly buy $100 worth of Bitcoin each month, regardless of the current price, because I'm convinced that it will skyrocket at least 10x and maybe 100x in the upcoming years.</p>
<p>However, this makes me even more scared of getting them stolen.</p>
<p>I can't buy a physical wallet because, just like paper ones, that screams &quot;steal me&quot; or &quot;seize me&quot; to the burglars/coppers.</p>
<p>I do have a Raspberry Pi (v1) which I'd love to use as a dedicated &quot;Bitcoin station&quot;. Sadly, they made it so incredibly <strong>cryptic</strong> (no pun intended) to enable encryption on that thing, that I've simply given up on ever doing it. Note that, since you have to &quot;burn&quot; an image onto the RPI's &quot;hard disk&quot; (flash memory), there is no installer like on x86 machines, where you normally can select encryption. It has to be done &quot;after the fact&quot; in an extremely convoluted and impossible to follow manner. It's as if they don't <em>want</em> RPIs to be secure...</p>
<p>Putting any amount of BTC in an &quot;exchange&quot; or &quot;bank&quot; is impossible both because I don't trust them whatsoever (and for good reasons), but also because they all require &quot;KYC/AML&quot; crap now. (Bisq is how I get new coins.)</p>
<p>I've been thinking and thinking, but I simply can't see any way to make sure that I have some Bitcoin secure <em>and</em> accessible at the same time. I wish I had pre-generated some receive addresses for my cold wallet and written them down so that I could regularly &quot;send in&quot; some to it, to keep as few satoshis as possible &quot;live&quot;. (It still boggles my mind how that is technically possible!)</p>
<p>Is there something I haven't thought of? Is there like a dedicated &quot;Bitcoin OS&quot; for the RPI or something which encrypts itself on the first boot and is rock-solid and minimal and dedicated only for Bitcoin?</p>

CC BY-SA 4.0
2020-11-23T12:35:40.877Z
Wallet.dat itself is encrypted if you use a password. No need to encrypt the entire Pi. It would probably be a waste of performance to encrypt the whole chainstate, so might as well only do wallet.dat anyway.
Jannes
CC BY-SA 4.0
2020-11-23T22:39:16.027Z
Storing your wallet backup in **only** digital format is terrifying to me. All digital devices will fail, given a long enough timeframe. You should really consider making a physical backup of some sort.
chytrik
CC BY-SA 4.0
2020-11-24T12:00:01.337Z
i'm confused, why don't you just use a hardware wallet? it covers everything you mentioned perfectly. you can set a pin number on the hardware wallet and it will wipe itself after sufficient incorrect attempts, and if you keep the seed safe you can recover your coins even in the event the physical hardware wallet is lost or stolen.
ieatpizza
<bitcoin-core><wallet><security><privacy><wallet-security>
Can you think of a safe way to safely keep my "spendable" Bitcoin in my situation?
D. Retelle
# Can you think of a safe way to safely keep my "spendable" Bitcoin in my situation?

(Asked by: username_0 on 2020-11-23)

I have my "cold stash" wallet.dat on multiple fully offline, encrypted hard disks/sticks inside a fireproof safe. I never seriously considered printing them onto paper because that would be too stealable/seizeable. At least they would have to point a gun to my head for me to give them the encryption key as I have it currently.

My "live" wallet.dat is running on my Windows 10 machine with Bitcoin Core. Yes, I know how insanely bad Windows 10 is, but I have also taken insane measures to be as safe as I could possibly be. But still, every day, I fear that some kind of malware update or 0-day will just snip away all my "live" coins.

(I say "all my coins" as if I have more than one Bitcoin in my live wallet. Yeah, right... More like "all my satoshis".)

Now, I'm strongly considering starting to regularly buy $100 worth of Bitcoin each month, regardless of the current price, because I'm convinced that it will skyrocket at least 10x and maybe 100x in the upcoming years.

However, this makes me even more scared of getting them stolen.

I can't buy a physical wallet because, just like paper ones, that screams "steal me" or "seize me" to the burglars/coppers.

I do have a Raspberry Pi (v1) which I'd love to use as a dedicated "Bitcoin station". Sadly, they made it so incredibly **cryptic** (no pun intended) to enable encryption on that thing, that I've simply given up on ever doing it. Note that, since you have to "burn" an image onto the RPI's "hard disk" (flash memory), there is no installer like on x86 machines, where you normally can select encryption. It has to be done "after the fact" in an extremely convoluted and impossible to follow manner. It's as if they don't *want* RPIs to be secure...

Putting any amount of BTC in an "exchange" or "bank" is impossible both because I don't trust them whatsoever (and for good reasons), but also because they all require "KYC/AML" crap now. (Bisq is how I get new coins.)

I've been thinking and thinking, but I simply can't see any way to make sure that I have some Bitcoin secure *and* accessible at the same time. I wish I had pre-generated some receive addresses for my cold wallet and written them down so that I could regularly "send in" some to it, to keep as few satoshis as possible "live". (It still boggles my mind how that is technically possible!)

Is there something I haven't thought of? Is there like a dedicated "Bitcoin OS" for the RPI or something which encrypts itself on the first boot and is rock-solid and minimal and dedicated only for Bitcoin?

**Tags:** bitcoin-core, wallet, security, privacy, wallet-security

> **Comments:**
> **username_1**: Wallet.dat itself is encrypted if you use a password. No need to encrypt the entire Pi. It would probably be a waste of performance to encrypt the whole chainstate, so might as well only do wallet.dat anyway.  
> **username_2**: Storing your wallet backup in **only** digital format is terrifying to me. All digital devices will fail, given a long enough timeframe. You should really consider making a physical backup of some sort.  
> **username_3**: i'm confused, why don't you just use a hardware wallet? it covers everything you mentioned perfectly. you can set a pin number on the hardware wallet and it will wipe itself after sufficient incorrect attempts, and if you keep the seed safe you can recover your coins even in the event the physical hardware wallet is lost or stolen.  

---

## 0 answers

