A crypto wallet is a tool that stores the private keys used to control your coins. The coins themselves are not inside the wallet. They are entries on a blockchain. The wallet holds the keys that prove you may move them, and it signs transactions on your behalf.
That detail explains most wallet security advice. Whoever has the key controls the funds, and there is no bank to reverse a mistake.
Keys, Addresses and Seed Phrases
Every wallet is built on a private key, a very large secret number. From it the wallet derives a public key and then an address, which is what you give to people who want to pay you. Sharing an address is safe. Sharing a private key hands over the funds.
Modern wallets do not ask you to manage raw keys. When you create one, you get a seed phrase, also called a recovery phrase, of 12 or 24 ordinary words. All the keys and addresses in the wallet are generated from that phrase. The word-list standard most wallets use, BIP-39, dates from 2013.
The seed phrase is the wallet. Anyone who sees it can recreate your wallet on their own device and take everything. Write it on paper or stamp it in metal, keep it offline, and never type it into a website, a chat or a cloud note. No genuine support agent will ever ask for it.
Hot Wallets
A hot wallet keeps its keys on a device that is connected to the internet.
- Browser extensions and mobile apps such as MetaMask, Phantom and Trust Wallet
- Desktop applications such as Exodus
Hot wallets are free and quick, and they are needed for most decentralized applications. The weakness is the device. Malware, a fake browser extension or a phishing page can expose the keys or trick you into signing a harmful transaction.
Cold Wallets
A cold wallet keeps its keys offline. The usual form is a hardware wallet, a small device from makers such as Ledger and Trezor. The keys are generated inside the device and stay there. When you send a transaction, the device signs it internally and passes back only the signature.
This protects the keys from malware on your computer. It does not protect you from approving a bad transaction. If you confirm a malicious request on the device, the funds are gone. Buy hardware wallets directly from the manufacturer, and never use a device that arrives with a seed phrase already filled in.
The Bitcoin.org wallet chooser compares Bitcoin wallets by type, and ethereum.org has a wallet guide for Ethereum.
Custodial vs Non-Custodial
When you keep coins on an exchange, the exchange holds the keys and you hold a claim on the exchange. This is custodial storage. It is convenient, and password resets exist. The risk is the company. If it is hacked, freezes withdrawals or goes bankrupt, you may wait a long time for your funds or lose them. Customers of FTX learned this in November 2022.
With a non-custodial wallet you hold the keys. Nobody can freeze the funds, and nobody can restore them for you either. The saying "not your keys, not your coins" refers to this trade.
If You Lose the Device
Losing a phone or a hardware wallet does not lose the coins, as long as you have the seed phrase. Install the wallet on a new device, enter the phrase and the same addresses appear.
Lose the phrase and the device, and the funds are permanently out of reach. There is no recovery service that can help, and people who claim to offer one are usually scammers.
Multi-Signature Wallets
A multi-signature wallet needs more than one key to approve a transaction. In a 2-of-3 setup, any two of three keys must sign. One lost or stolen key is not enough to lose the funds. Companies, DAOs and careful individuals use this to remove a single point of failure. Safe, formerly called Gnosis Safe, is the most widely used multi-signature wallet on Ethereum.
Security Practices
- Keep long-term holdings on a hardware wallet and only spending money in a hot wallet.
- Store the seed phrase offline, in more than one safe place.
- Turn on two-factor authentication for exchange accounts, with an authenticator app instead of SMS.
- Bookmark the sites you use. Search ads often lead to fake copies.
- Read what you sign. Be wary of requests for unlimited token approvals, and revoke approvals you no longer need.
- Send a small test amount before a large transfer.
- Check the address and the network on the device screen before confirming.
Bitcoin.org's guide to securing your wallet covers backups and offline storage in more detail.
Common Mistakes
- Taking a photo or screenshot of the seed phrase
- Entering the phrase on a site that claims to "validate" or "sync" the wallet
- Sending coins on the wrong network, for example to an exchange address that does not support it
- Copying an address from transaction history, where scammers plant lookalike addresses
- Keeping a single copy of the seed phrase that a fire or flood could destroy
Nothing in this article is financial advice.
Key Wallet Facts
- A wallet stores keys, not coins
- Seed phrase: 12 or 24 words that regenerate every key in the wallet
- Hot wallet: keys on an internet-connected device
- Cold wallet: keys kept offline, usually on a hardware device
- Custodial: a company holds the keys for you
- Multi-signature: several keys required to spend
Track on CoinMarketGuy
Before moving coins between wallets and exchanges, the exchange list lets you compare trading platforms and the converter shows what an amount is worth in dollars or another coin. Live prices and supply data for each asset are on its coin page, such as the Bitcoin page.