A crypto wallet does not hold coins in the way a purse holds cash. Coins live on the blockchain. What a wallet holds is the set of keys that prove you own them and allow you to send them. Whoever controls those keys controls the coins. That single fact is the basis for everything about wallets, from the choice between types to the question of safekeeping.
This guide explains the main kinds of wallet, the difference between a wallet that you control and one that someone else controls, and the basic habits that keep access safe. It does not recommend a particular product.
Keys, not coins
Every crypto address has a pair of keys. The public key, or address, is what you share so that people can send you coins. The private key is a secret number that allows you to sign transactions and move coins away from that address. A wallet is software or hardware that stores the private keys, signs transactions and shows your balances.
If someone else obtains your private key, they can move your coins, and nobody can reverse the transfer. If you lose the key, the coins at that address may be unreachable, and nobody can restore them for you. That is the trade-off at the heart of crypto security.
Hot wallets and cold wallets
A hot wallet is connected to the internet. Mobile apps, browser extensions and desktop software are hot wallets. They are convenient for regular use, and they are exposed to the risks of any connected device, including malware, phishing and a compromised app.
A cold wallet keeps keys offline. Hardware wallets are the common example: small devices that store keys and sign transactions without exposing the key to the computer or phone. A paper wallet, which is a printed key, is also cold, but it is easy to lose or damage. Cold storage suits larger holdings that you do not need to move often.
The choice is between convenience and exposure. Many people keep a small amount in a hot wallet for regular use and a larger amount in cold storage.
Custodial and self-custody
A custodial wallet is run by a company, usually an exchange or a financial service. The company holds the keys, and you have an account with a login. This is convenient, and you can often recover access through the company's support. It also means you rely on the company staying solvent, secure and honest. If an exchange is hacked or fails, the coins held on it can be lost, and customers may not get them back in full.
A self-custody wallet puts the keys in your hands. Nobody else can freeze or move your coins, and nobody can recover them if you lose the key. Self-custody gives you control, and it makes you fully responsible for the security of the keys.
The phrase "not your keys, not your coins" describes this trade-off. It is a reminder that a balance on an exchange is a claim against that exchange, not coins in your control.
Seed phrases
Most modern wallets create a seed phrase, a list of usually 12 or 24 words, from which all the keys in the wallet can be regenerated. The seed phrase is the master backup. Anyone who has it can recover the wallet on another device, so it must be kept as secret as the keys themselves.
The guide on seed phrase safety covers how to write it down, store it and avoid the common ways it is stolen.
A worked example: losing a phone
Suppose you keep 2,000 worth of coins in a mobile wallet on your phone, and you back up the seed phrase on paper in a drawer. You lose the phone. You install the same wallet on a new phone, choose to restore from the seed phrase, and the coins return. Nothing was lost, because the backup was complete and kept safe.
Now suppose the backup was a photo on the lost phone, and you never wrote the words down. The coins are still on the blockchain, but without the seed phrase or the keys, nobody can reach them. The value is still there, but it is locked out of your reach.
| Situation | Outcome |
|---|---|
| Seed phrase written and kept safe | Restore on a new device, coins recovered |
| Seed phrase only in a photo on the lost phone | Coins unreachable |
| Coins on an exchange, account locked | Depends on the exchange's recovery process |
Common threats
Phishing. Fake websites, fake apps and messages that impersonate wallets or exchanges try to get your seed phrase or approve a malicious transaction. A legitimate wallet will never ask for your seed phrase.
Fake support. Scammers contact people on social media or messaging apps, pretending to be support staff, and offer to help recover a wallet. They ask for the seed phrase, and once they have it, they drain the wallet.
Malicious approvals. Some interactions with decentralised applications ask you to approve a transaction that gives a contract permission to move your coins. Read what you are approving, and revoke permissions you no longer need.
Malware. A compromised device can capture keys or swap addresses when you copy them. Use a clean device for sensitive actions, and check the address on the screen of a hardware wallet when possible.
Basic habits
- Write the seed phrase on paper, store it offline in a secure place, and never type it into a website or send it to anyone.
- Use a hardware wallet for larger holdings, and check the transaction on the device's own screen.
- Keep only what you need in a hot wallet.
- Confirm every address you send to, at least the first and last few characters.
- Bookmark the official sites of your wallet and exchange, rather than following links.
- Test a small transfer before sending a large one.
- Review and revoke token approvals you no longer use.
Test the backup before you need it
Before you move a large amount into a new wallet, send a small test amount to it. Then restore the wallet from its seed phrase on a second device, and check that the same balance and addresses appear. Many people discover a backup problem only when they need it most, after a lost phone or a broken device. A restore test takes a few minutes and shows whether the backup really works.
Common mistakes
Storing the seed phrase digitally. A photo, a cloud note or an email can be accessed by others.
Sharing the phone screen during support calls. Screen sharing can expose the seed phrase or the approval screen.
Trusting a wallet recovered from a link. Download wallet software only from the official source.
Leaving large sums on an exchange. An exchange can be hacked or freeze withdrawals, so a balance there is a claim, not control.
What to check
- Who holds the keys: you, or a company.
- Where the seed phrase is kept, and whether a second person could find it.
- Which wallet you use, and whether it comes from an official source.
- How much is in each wallet, and whether it matches your plan.
- Whether you have tested the restore process with a small amount.
Key takeaways
A crypto wallet holds the keys that control your coins. Hot wallets are convenient and exposed to connected devices, and cold wallets keep keys offline. Custodial wallets are run by a company, while self-custody puts the keys in your hands, with full responsibility. The seed phrase is the master backup, so keep it offline and secret. Most losses come from phishing, fake support, malicious approvals and insecure backups, and most can be prevented with simple habits.
This guide is for general information, not financial advice. See the disclaimer.