How can bitcoins be stolen?

 First, let’s talk about how Bitcoin addresses work.  Picture Bitcoin addresses as a series of safe deposit boxes at a bank.  Whoever has the key to the box can open it and retrieve the contents.  Likewise with Bitcoin, whoever has the key to a given Bitcoin address can spend the bitcoins stored at that address.  When you create a new Bitcoin address, you create both the public address and the private key that is associated with it.  The private key is a random-looking series of numbers and letters.  Only you have the key, but you can give the public address to anyone without worry.  Others can send bitcoins to your public address, and you can subsequently spend those bitcoins using the private key associated with that public address.  In Bitcoin software, this is all done behind the scenes.  Back to our example, if a safe deposit box key is stolen, the thief can then access the contents of that box.  Likewise with Bitcoin, if someone steals a private key, they will be able to spend any bitcoins within the address related to that private key.  And to be clear, the thief only needs a copy of those random-looking letters and numbers – it doesn’t actually take anything away from your own device.  Common methods of stealing those private keys include malware/viruses that can read files on your computer and track keystrokes, phishing websites that can gather user credentials for online services, and fake online services that pretend to safely store your bitcoins, only to have the operator sweep all the bitcoins stored into his or her own Bitcoin address.  To protect the private keys, some people encrypt them with passwords.  While this makes storage safer, it is not foolproof (keylogging malware can discover your password and decrypt the encryption).  Another method is to use a hardware device like the Trezor – so far, this has proven completely safe.  Some use computers to generate address offline, away from the internet, and then print those addresses out.  This is called paper wallet storage.  Many people recommend against services that store bitcoins on the users’ behalf, because then the service must be trusted not to steal the bitcoins.  This would be anagolous to the bank having another key to your safe deposit box – as long as you trust your bank, it is fine, but you wouldn’t store anything valuable in such a box with that trust.  The bottom line is, without a foolproof device like the Trezor, it can be difficult to ensure your bitcoins will never be stolen.  It is my strong recommendation that such a device be used by anyone who is a novice in computer and electronic device security.