Sorry to hear about your loss.
Yes, you should create a cold wallet. Create that cold wallet via a clean machine. Do not create that cold wallet on any hardware you currently have that had any chance of being compromised.
As to re-plotting, the consensus (based on other threads) is to re-plot. I never understood the need, when your existing plots could still be farmed with everything you currently have, exactly the same way, with the only exception being that your wins will be directed to your cold wallet, via a config.yaml edit.
You could have all manner of malware on your Chia boxes. And still, I do not see how anyone could get to your cold wallet. Of course, you do not want malware on any of your boxes, because someone could change your payout address. My point is that I do not think that you have to re-plot, if your payouts will go to a cold wallet. If I am mistaken, someone please let me know.
On any computer in your network that can access your config.yaml file, you have a potential security risk – where an attacker can tinker with your config.yaml file. In other words, if you have a full node and a couple of harvesters, and all have access to your full node’s config.yaml file, then any of those machines can change your config.yaml’s payout address. And you do not know which of your networked machines got compromised. Or if you have children, with their own PCs, on your network that can reach your Chia boxes, then if their boxes got compromised, then that is a problem.
But as long as you can farm your existing plots with clean code running, I believe that you have no need to re-plot. But you would likely need a fresh OS re-install on every box on your network that can access your config.yaml file (to stop malware from changing your payout address – because you might not realize missed wins, if your payout went elsewhere).
In summary:
– Re-install your OS on any box that has access to your machine with your config.yaml file.
– Create a new, cold wallet, using a clean machine. A fresh OS install is the safest machine to use to create a cold wallet.
– Direct your wins to your cold wallet.
– Save a copy of your blockchain files, before doing anything. That is something you should be doing on a regular basis. Make sure Chia is not running when you make a copy of the blockchain files.
The above might be overkill. I am just trying covering all bases. You pick and choose what is best for your situation.
Also, do not use any of your Chia related boxes for anything other than Chia. On mine, I never even opened my browser. I have a clean OS install, plus Chia installed, and that’s it. I used a different, non Chia computer to download Chia, and then, via a USB drive, copied it to my Chia boxes. No other machines can see my Chia boxes, and nothing other than Chia is installed on my Chia boxes.
I do not trust NordVPN. In general, you are trusting any VPN service with 100% of your on-line activities. They can see everything, and log everything that you do via their service, regardless of any claims that they make. We have no way to verify their “no logs” claim. It is probably safe. But you cannot really know. And how you use your VPN service can expose you to threats. A VPN server is basically a glorified proxy (a system that you somewhat remotely control), that performs actions on your behalf.
The connection between you and the VPN server is encrypted. But then it is 100% decrypted by that VPN server. They see everything in the clear. So depending on what you do via their service, they could be a security risk.
The more computers that your Chia boxes get involved with, then the more risks you are exposing to your Chia boxes.
Lastly, before doing anything, you might want to use Autoruns – if you are running Windows on your Pi or any other boxes networked to your Pi:
Run it with administrator privileges. It will show you every program / service that automatically starts on that box. Some start at boot time, some start at login time, etc. The number of programs that start automatically are numerous.
Autoruns will show you all of them, and allow you to un-check any, which will prevent it from automatically starting (but will not kill what is already running).
You might find malware that is starting. By un-checking it, and re-booting, you could solve your problem. But run Autoruns, again, to make sure the malware did not re-start (something else you missed might enable it).
Note that if you un-check a critical process, you could cripple Windows – perhaps not be able to boot up. So be careful.