One sentence prevents most crypto disasters: a wallet does not store your coins, it stores your keys. Your coins only ever exist as entries on the blockchain. The wallet’s job is to hold the secret that proves those entries belong to you and to authorise moving them.
Once that clicks, terms like “hot wallet”, “cold storage” and “self-custody” stop being intimidating and start being practical choices about how to protect a secret.
Keys, not coins
Every wallet is built around a pair of cryptographic keys:
- A private key — a secret number that controls the funds. Whoever knows it owns the coins.
- A public key, from which your address is derived — this is what you share so people can send you crypto.
Sending crypto means using your private key to sign a transaction. The network can verify the signature came from the right key without ever seeing the key itself. So protecting your private key is the entire game — anyone who copies it can drain your funds, and nobody can help you reverse it.
Hot wallets vs cold wallets
Wallets are usually grouped by whether the keys touch the internet.
| Hot wallet | Cold wallet | |
|---|---|---|
| Where keys live | On an internet-connected device (phone, browser, app) | Offline (hardware device, paper) |
| Best for | Small amounts, frequent use, everyday spending | Long-term savings, larger balances |
| Convenience | High — ready in seconds | Lower — you plug in and confirm on a device |
| Attack surface | Larger; exposed to malware and phishing | Much smaller; keys never leave the device |
A common approach mirrors real life: a hot wallet is your pocket cash, while a cold wallet is your savings vault. You keep a little where it is handy and the bulk somewhere hard to reach.
Custodial vs self-custody
The other big distinction is who holds the keys.
- Custodial: a third party — usually an exchange — holds the keys for you. You log in with a password like any website. Convenient, recoverable if you forget your password, but you are trusting the company to stay solvent, secure and accessible.
- Self-custody: you hold the keys yourself. Nobody can freeze your funds or lose them on your behalf — but nobody can rescue you either. The responsibility is entirely yours.
The well-worn crypto saying captures the trade-off: “not your keys, not your coins.” Neither choice is wrong; they simply move responsibility to different places.
Seed phrases: your master key
Most self-custody wallets show you a list of 12 or 24 plain English words when you set them up. This seed phrase (or recovery phrase) is a human-friendly encoding of your private keys. From it, the wallet can regenerate every key and address you own.
That makes the seed phrase the single most important thing to protect:
- Write it down offline. Paper or metal — never a screenshot, cloud note, or email, all of which can be hacked.
- Store copies in more than one safe place. Fire and floods are as much a threat as thieves.
- Never type it into a website. No legitimate service, support agent, or “wallet validation” will ever ask for it.
If anyone — by email, DM, pop-up, or phone — asks for your seed phrase, it is a scam. Always. There are no exceptions.
Staying safe: the common mistakes
Most losses are not exotic hacks; they are a handful of avoidable errors:
- Phishing sites that imitate a real wallet or exchange and capture what you type. Bookmark official sites and check the address bar.
- Approving malicious transactions. Read what you are signing; a vague approval can hand a contract permission to move your tokens.
- Fake “support”. Scammers lurk in social media replies pretending to help. Real support never DMs first.
- Too-good-to-be-true offers — guaranteed returns, surprise airdrops that need a “small deposit”, or projects engineered as a rug pull.
Choosing your setup
There is no single right answer. A reasonable starting point for many people: keep day-to-day spending money in a reputable custodial account or hot wallet, and move anything you would be upset to lose into self-custody — ideally a hardware wallet — with the seed phrase backed up offline in two locations. Start small, practise a test transaction, and scale up only once the process feels routine.
Security in crypto is a habit, not a product. The technology is sound; the weak point is almost always a rushed click. Slow down, verify, and your keys stay yours.