How to properly create and store an admin wallet: private key security

In the previous article we covered why you need two wallets - hot and admin - and why the bulk of funds should sit on the admin wallet under your key, not on the server. But an important consequence follows: the entire protection rests on one thing - how securely the admin wallet's private key is created and stored. If the key is created carelessly or sits on a compromised device, the whole model falls apart. Here we'll cover how to approach this as seriously as possible.

Let's set the scale right away: the admin wallet holds up to 80% of your liquidity. This isn't a case where you can "set it up properly later". The approach to creating it should be the same as a bank's approach to its vault.

The base rule: hot and admin always use different seed phrases

Before getting into details, let's fix a principle without which everything else loses meaning. The admin wallet's seed phrase (mnemonic) and the hot wallet's seed phrase must be completely different. This isn't one wallet with two addresses - these are two independent wallets, created separately, with different mnemonics.

The reason is simple. A seed phrase is full access to the wallet: whoever knows the mnemonic owns all the funds. If hot and admin are derived from the same seed phrase, then compromising that phrase means losing both at once. Yet the whole point of splitting into hot and admin was precisely that these wallets should have different access levels and different protection. A shared seed phrase reduces that separation to nothing.

So: create the admin wallet and the hot wallet as separate wallets, each with its own unique seed phrase. Then even a full compromise of the hot wallet (whose key is on the server) doesn't touch the admin wallet at all.

Principle one: download the wallet only from an official source

The most common way funds get stolen isn't hacking the wallet - it's substituting the app itself. The victim downloads "TronLink" or "Electrum" from a fake site or a link in search ads, installs malware that looks like the real wallet, and immediately loses everything.

This isn't theory. Electrum has a documented history where attackers distributed a fake copy of the wallet and stole hundreds of bitcoins from those who downloaded the fake. So you have to treat the source with extreme strictness.

Official addresses at the time of writing:

• TronLink (for TRON networks, TRC20): tronlink.org
• Electrum (for Bitcoin): electrum.org

But don't rely on these links alone - learn to verify authenticity yourself. This is more reliable than any link, because it protects you even if a link has gone stale somewhere or been substituted.

How to verify:

• Type the site address manually into the browser's address bar. Don't follow hyperlinks from emails, chats, search ads, or even from this article - type the address by hand. That rules out link substitution.
• For TronLink, install the extension or app only from official stores: the Chrome Web Store for the browser, Google Play (identifier com.tronlink.global) or the App Store for the phone. Don't download APKs from third-party sites.
• For Electrum, always verify the GPG signature of the downloaded file. This is critical: even if the electrum.org site itself is compromised and the files are swapped, signature verification will reveal it - the attacker won't have a valid signing key. Electrum is signed with the developers' keys (ThomasV, SomberNight, Emzy, felixb_f321x), and the source code is open at github.com/spesmilo/electrum.
• Be skeptical of any "update urgently" messages, especially if they come from inside the wallet or by email. Fake updates were exactly how the Electrum attacks were carried out.

If anything raises doubt - the site address differs by one letter, the design looks unfamiliar, you're asked to enter your seed phrase on a website - stop. A real wallet never asks you to enter your seed phrase on a web page.

Principle two: the key is stored on a separate, isolated device

The admin wallet's private key should not be on a device you use every day. This is the second pillar of security.

The logic is simple. Your work computer or phone opens dozens of sites daily, receives email, installs extensions, runs various software. Any of these actions is a potential infection channel. If the key to 80% of your liquidity sits on such a device, you're keeping your main capital on the most vulnerable surface.

So the device for the admin wallet should be dedicated and meet several requirements:

• Not for everyday use. You don't open random links from this device, don't check email, don't sit in messengers, don't install games or "trial" utilities. Its only job is to store the key and sign transfers.
• A fresh operating system from an official distribution. Install the OS from scratch, downloading the image only from the OS developer's official site (and, ideally, verifying the image's checksum too). Don't use a device that's already been running a system of unknown history for years.
• Minimal third-party software. The device should have only what's necessary to work with the wallet, and nothing more. Every extra program is a potential vulnerability. Don't turn it into a regular computer "while you're at it".
• Isolation from the internet where possible. The less the device contacts the network, the smaller the attack surface. The ideal is a device that goes online only at the moment you need to sign and send a transfer, and stays offline the rest of the time.

You don't have to buy expensive hardware. A separate inexpensive laptop or even a separate phone, used strictly for this task and nothing else, will do.

Where to store the seed phrases themselves

A separate question is where to store the mnemonics of the hot and admin wallets. Two rules matter here.

First: store the hot and admin seed phrases separately, in different storages. If both mnemonics sit in one place, compromising that place again nullifies the entire wallet separation. Different wallets - different seed phrases - different storages.

Second: store mnemonics in encrypted databases, not in phone notes, not in a cloud document, and not in chat history. There are specialized password managers with an encrypted database for this - for example, KeePass or Strongbox. These are open, time-tested solutions that keep all secrets in an encrypted local file (KDBX format) protected by a master password. Access to the database is only via the master password, and the database file itself stays under your control, without mandatory cloud binding.

The principle is the same as with everything else: each seed phrase in its own encrypted database, strong and different master passwords, backups of the databases in a safe place. A paper backup of the mnemonic, stored physically in a secure location, doesn't hurt either - in case of hardware failure.

The third and main principle: set up multisig

Everything described above protects a single key. But there's an approach a level higher - making a single key insufficient in principle. This is multisignature (multisig).

The idea is this. A regular wallet is controlled by one private key: whoever has the key has the funds. A multisig wallet requires several keys to confirm a transfer - for example, two of three. Then compromising one key gives an attacker nothing: to move funds, they need additional keys, stored separately, in other places.

For the admin wallet this means a qualitatively different level of protection. Even if one of your devices is infected or one key is stolen, the funds remain inaccessible. This is the approach worth striving for when storing your main liquidity.

Both recommended wallets support multisig.

In Electrum, multisig is built in. When creating a wallet, at the type-selection stage you choose not "Standard wallet" but "Multi-Signature wallet". Electrum then offers to set the scheme - for example, 2 of 3 (two keys out of three to confirm). You create and store each of the keys (the participants' master keys) separately: ideally on different isolated devices. To sign a transfer you need to gather the required number of signatures from these devices. Electrum walks you through this process step by step during wallet creation.

On the TRON network, multisignature is implemented at the account level. TronLink lets you configure account permissions so that operations require signatures from several keys with a set threshold. You assign several signer addresses and specify how many signatures are needed to carry out an operation. Managing these permissions is done in the account settings.

The specific step-by-step setup depends on the wallet version and your scheme (how many keys, what threshold), and interfaces change over time. So here we give the principle and the general route, while the detailed setup for your configuration we go through individually during onboarding - so you end up with a working multisig scheme, not just an instruction that may have gone stale.

In short: a checklist for the admin wallet

• Create admin and hot as separate wallets with different seed phrases. A shared mnemonic nullifies the separation.
• Download the wallet only from an official source. Type the address manually, don't follow links. For Electrum verify the GPG signature, for TronLink install from the official store.
• Never enter your seed phrase on web pages. Ignore pushy "urgent updates".
• Store the key on a separate device with a fresh OS from an official distribution, without extra software, not for everyday use, offline where possible.
• Store seed phrases in encrypted databases (KeePass, Strongbox), separately for hot and admin, with strong and different master passwords.
• Set up multisig (for example, 2 of 3) so that compromising one key doesn't give access to funds. Store keys on different devices.

These measures seem excessive only until something happens. The admin wallet is the storage of your business's main capital, and it should be treated accordingly. Setting it up properly once is cheaper than losing everything once.