Crypto Guardian#

Comprehensive cryptocurrency security system for AI agents managing on-chain assets. Based on real-world theft patterns targeting AI agents and their conversation histories.

Threat Model: How AI Agents Get Robbed#

Primary Attack Vector: Conversation History Scanning#

Attackers actively scan public AI platforms, GitHub commits, and conversation logs for exposed private keys and seed phrases. A single private key in a chat history = immediate drain.

Real incident (2026-05-01):

• A private key was stored in SESSION-STATE.md
• AI conversation history was accessible to scanning systems
• Attacker found the key within minutes → drained ~$227 AUD in two transactions

Secondary Attack Vectors#

• Phishing: Fake wallet apps, fake airdrops
• SIM-swap: SMS-based 2FA for exchanges
• Supply chain: Compromised hardware wallet sellers
• Smart contract exploits: Approved malicious tokens
• Social engineering: DMs promising "free crypto"

---

Gold Rules (Non-Negotiable)#

1. Private keys and seed phrases MUST NOT exist in workspace files#

Files that are NOT safe:

• SESSION-STATE.md
• working-buffer.md
• MEMORY.md
• .env (with the private key itself)
• Any .json, .txt, .md in the workspace
• Any AI conversation history (public platforms)

Safe alternatives:

• .env only, with keys referenced as env vars at runtime
• Hardware wallets (keys never leave device)
• Encrypted storage with passphrase
• Wallets where private key is never stored at all (watch-only + hardware sign)

2. Never process private keys through AI conversation#

• Don't send private keys in messages (even to "help analyze")
• Don't ask AI to sign transactions interactively in chat
• Use proper signing infrastructure (hardware wallet, air-gapped setup)
• Private key = one-time use, then never touches the network again

3. Assume all workspace files are public#

• Every file written to workspace is potentially searchable
• Compaction services, memory systems, and search indexes all scan content
• If it would be bad if exposed, don't write it down

---

Wallet Architecture#

Strategy: Compartmentalization#

Hot Wallet (Small, Online)

• Purpose: Daily operations, small amounts
• Balance: $50-500 AUD max
• Examples: DEX trading wallet, Fiverr earnings wallet
• Always: Watch-only access where possible

Warm Wallet (Medium, Semi-Air-Gapped)

• Purpose: Active project funds, bounty earnings
• Balance: $500-5000 AUD
• Access: Hardware wallet for signing, watch-only for monitoring
• Examples: Jupiter DCA wallet, Grip Protocol wallet

Cold Wallet (Large, Offline)

• Purpose: Long-term holdings, savings
• Balance: >$5000 AUD
• Access: Hardware wallet only, no online access
• Storage: Physically separate from daily devices

Recommended Wallet Setup#

text

Purpose              | Wallet Type        | Key Storage
---------------------|--------------------|----------------------
Trading/Active       | Software (Solflare) | .env, never in files
Grip/Bounty Earn     | Software (MetaMask) | Seed phrase in .env only
Long-Term Savings    | Hardware (Ledger)   | Never touches computer

---

Operational Security Checklist#

Before Handling Any Crypto Asset#

• Is this a new wallet or existing one?
• Will I need to store a private key or seed phrase?
• If YES: Can this be done with a hardware wallet instead?
• If YES: Can the signing happen on a different device than this agent?
• Is the amount worth the risk of key exposure?

When Creating New Wallets#

1. Generate on air-gapped hardware device OR in proper software wallet
2. Immediately back up seed phrase to physical location (paper/metal)
3. Verify the address BEFORE funding
4. Delete any纸上残留的seed phrase notes
5. Fund only after confirming backup is secure

When Signing Transactions#

• Use hardware wallet or proper signing infrastructure
• Verify destination address on device screen
• Verify amount on device screen
• Never sign blind (don't sign unknown data)
• Set appropriate token approval limits (not unlimited)

For AI Agent Integration#

• Use wallet APIs that don't expose raw private keys
• Store keys in environment variables, not files
• Use signer.py / signer.ts pattern: key in env → sign in-process
• If possible, use wallet connectors (WalletConnect, Phantom) instead of raw keys
• Monitor with watch-only addresses (never put watch-only in signing context)

---

Token Approval Security#

The Danger of "Unlimited Approvals"#

When you approve a token spending, you often approve "unlimited" tokens. This means if the contract is malicious or hacked, they can drain your entire balance.

Rule: Always set specific approval limits, not unlimited.

How to Check Approved Tokens#

bash

# Check token approvals on Etherscan/Blockscan
# 1. Go to the address on Blockscan/Polkassembly
# 2. Click "Token Approvals"
# 3. Revoke any unused or suspicious approvals

# For Base network:
# https://basescan.org/tokenapprovalchecker

Approval Checklist#

• Check approvals before using new dApp
• Revoke approvals for dApps you no longer use
• Use limited approvals (exact amount, not unlimited)
• Be extra careful with USDT, USDC, WETH (high value tokens)

---

Multi-Signature (Multisig) Setup#

For amounts >$5000 AUD, consider multisig:

Gnosis Safe (Free, on Base)

• 2-of-3 signers: Hardware wallet + Ledger + Desktop
• Requires multiple devices to authorize any transaction
• Recovery: If one device lost, others still work

When to Use Multisig:

• Team/project funds (multiple decision makers)
• Long-term savings (>1 year)
• High-value holdings (>$5000 AUD)
• Any wallet that can't afford to be drained

---

Incident Response#

If You Suspect a Key Has Been Exposed#

1. Act immediately — assume compromised until proven otherwise
2. Check blockchain — look for outgoing transactions you didn't authorize
3. If drained: Transaction is irreversible. Document for records.
4. Revoke associated API keys: Any exchange keys that might be linked
5. If fresh wallet: Move remaining funds to new wallet immediately
6. Do NOT: Continue using the exposed key for anything

If You Discover a Drain#

1. Save transaction hashes — evidence for exchange reports
2. Report to exchange (if funds were cashed out there)
3. Check if it was a smart contract exploit — might be recoverable
4. Accept the loss if on-chain and irreversible

Recovery Is Rare#

Unlike credit cards, crypto transactions are irreversible. Prevention is the only real protection.

---

For OpenClaw Agents: Practical Implementation#

Wallet Strategy for This Agent#

text

Wallet Type    | Address           | Storage      | Used For
---------------|-------------------|---------------|--------------------------
Active DCA    | [DISCARDED]          | None        | (empty, was drained)
Bounty Earn   | 0xD1089e...           | .env only   | Grip, ClawMoney
Watch-Only    | [YOUR WALLET]         | TOOLS.md    | Monitor only
New DCA Wallet| TBD (new generation)  | Hardware    | Jupiter DCA (future)

Key Storage Rules#

1. Never write full private keys anywhere (except .env, which must be gitignored)
2. Never in conversation: Even "let me check if this key is correct"
3. Never in SESSION-STATE.md or working-buffer.md
4. Never in memory files after session
5. Use hardware wallet for any amount >$500 AUD

Environment Variable Pattern#

python

# Correct: Private key in environment only
from dotenv import load_dotenv
load_dotenv()
private_key = os.environ["SOLANA_PRIVATE_KEY"]  # Never written to file

# Wrong: Private key written to any workspace file
# private_key = "[PRIVATE KEY]"  # NEVER DO THIS

Monitoring with Watch-Only Wallets#

Use a different address for monitoring than for signing:

• Watch address: In TOOLS.md or config files
• Signing address: In hardware wallet only

This way, even if monitoring credentials are exposed, the funds are safe.

---

Summary: Security vs. Convenience#

Security LevelUse CaseKey StorageMaximumLong-term savingsHardware wallet onlyHighActive project funds.env + careful handlingMediumDaily tradingSoftware wallet, small balanceLowTesting/learningAny, small amounts

Rule of Thumb: The cost of losing a wallet should never be life-changing. Keep only what you can afford to lose in hot wallets.

---

Emergency Contacts#

• Base Network Scanner: https://basescan.org/
• Token Approval Checker: https://basescan.org/tokenapprovalchecker
• Revoke.cash: https://revoke.cash/
• Gnosis Safe (Multisig): https://app.safe.global/
• Ledger Recovery: https://www.ledger.com/stop-phishing-attacks

---

Crypto Guardian v1.0 — Created 2026-05-01 after real wallet theft incident