A wallet holds keys, not coins
The word “wallet” is a little misleading. A cryptocurrency wallet does not contain coins the way a purse contains cash. The balances live on a shared public ledger, which is the idea behind blockchain technology. What the wallet holds is the secret information that proves you are allowed to move the entries attached to your address.
That secret is called a private key. Alongside it sits a public key, from which a public address is derived. The address is something you can share so others can send you funds. The private key is what you must keep secret, because anyone who has it can authorize transfers from that address.
When you send funds, the wallet software creates a transaction and signs it using the private key. The network can check the signature against your public key without ever seeing the private key. That is the core trick: you prove authority without revealing the secret.
Recovery phrases
Most modern wallets do not make you handle raw keys. Instead they generate a recovery phrase (also called a seed phrase), a list of ordinary words that can regenerate all the wallet’s keys. If your phone is lost or broken, you can install the wallet software again, enter the phrase, and regain access.
This convenience has a sharp edge:
- Anyone who learns the phrase can take everything the wallet controls.
- If you lose the phrase and the device, there is generally no company that can reset it for you.
- Transfers are typically final. There is no standard way to undo a mistaken or fraudulent one.
For these reasons, a legitimate wallet or support team does not ask you to type your phrase into a website or tell it to anyone. A request for it is a strong warning sign of a scam. The same logic applies as with any social engineering attempt: urgency and pressure are the usual tools.
Custodial versus self-custody
The most important question about any wallet is who holds the keys.
Custodial wallets are provided by an exchange or service that keeps the keys for you. You log in with a username and password, much like a bank app. The benefits are familiarity and the possibility of account recovery. The trade-offs are that you rely on the company’s security and solvency, and that it may freeze or restrict your account under its terms or the law. A common saying in the field, “not your keys, not your coins,” sums up the concern, though it is a slogan rather than a rule, and custodial services suit some people.
Self-custody wallets put the keys in your hands. You get direct control and no intermediary, but you also take full responsibility: safeguarding the phrase, avoiding scams, and dealing with mistakes yourself.
Neither is simply right. The choice depends on how much you hold, how confident you are with security, and how you weigh convenience against control.
Hot and cold storage
Another distinction is whether the keys are connected to the internet.
Hot wallets run on devices that are online: browser extensions, phone apps, desktop software. They are convenient for frequent use. Because the device is connected, the keys are exposed to malware, fake apps and compromised websites. Software updates and cautious installation habits matter here, as they do for all devices.
Cold storage keeps the keys offline. The best-known form is a hardware wallet, a small dedicated device that stores keys and signs transactions internally, so the keys never reach your computer. Another form is a written or engraved copy of the recovery phrase kept somewhere secure. Cold storage reduces exposure to online attacks, but it adds its own risks: physical loss, damage, theft, and mistakes in how backups are made. Backups are only useful if they exist in more than one safe place and are protected from fire, water and curious visitors.
Many people use a mix, with a small amount in a hot wallet for use and the rest offline, but this is a general pattern, not a recommendation.
Common ways people lose funds
The cryptography is rarely the weak point. Typical problems include:
- Phishing and fake sites. Lookalike domains and fake wallet apps try to capture your phrase or trick you into approving a harmful transaction.
- Malicious approvals. Some applications ask you to sign permissions that let them move your funds later. Reading what you are signing matters.
- Address mistakes. Sending to the wrong address, or one altered by malware, usually cannot be reversed.
- Impersonation. Fake support staff, fake giveaways, and strangers promising returns are common. Phishing scams in this area are widespread precisely because the transfers are final.
- Poor backups. A phrase stored in a photo, a notes app or cloud storage can be exposed if that account is compromised.
Using strong, unique passwords through a password manager and turning on two-factor authentication helps protect the accounts around a wallet, especially custodial ones.
A note of caution
Digital assets can change in value sharply and may be lost entirely, and rules about them differ between countries, including how they are taxed and regulated. This article explains how wallets work; it is not advice to buy, hold or move any asset. If you are experimenting, many people start with very small amounts and practise recovering a wallet before trusting it with anything that matters.