Crypto wallets explained: custody, keys, and safety

A wallet holds keys, not coins

Your coins are entries on a blockchain. They never leave it and they are never inside an app. What a wallet stores is the private key that authorises moving those entries — and what everyone means by "my crypto was stolen" is that somebody else used that key.

Once you hold that idea, most wallet advice stops being a list of rules and becomes obvious. Anything that can reach your key can spend your funds. That is the entire threat model.

Custodial or self-custody

Custodial — an exchange or app holds the keys, you hold an account with them. You get password resets, support, and recovery if you lose your phone. You also depend entirely on that company remaining solvent, honest, and unhacked, and on it not freezing your account. Every large exchange failure of the past decade was a custodial failure.

Self-custody — you hold the keys yourself, usually as a seed phrase: 12 or 24 words that regenerate every key in the wallet. Nobody can freeze it and nobody can reset it. Lose the phrase and the funds are gone with the same finality as if they were stolen.

Neither is safer in the abstract. Custodial replaces the risk of your own mistakes with the risk of someone else's conduct. Self-custody does the reverse. Most people end up with both: an exchange for trading, self-custody for holdings they do not intend to touch this month.

Hot and cold

A hot wallet runs on an internet-connected device — a browser extension, a phone app. Convenient, and exposed to everything that device is exposed to.

A cold wallet keeps the key on a device that never goes online, typically a hardware wallet. Transactions are signed on the device and only the signature leaves it, so malware on your computer can propose a transaction but cannot sign one — provided you read the screen on the device before approving.

The practical split for a trader: a hot wallet with what you would be annoyed to lose, and cold storage for what you would be devastated to lose. Keeping the entire balance somewhere convenient is the most common form of this mistake, and it has no upside except saving a few minutes a month.

The seed phrase rules

Short, absolute, and responsible for most preventable losses:

• Never type it into anything. Not a website, not a support chat, not a wallet "validation" tool, not a phone note, not a screenshot, not a password manager you access from a compromised device. Legitimate software asks for it exactly once — when you restore a wallet you already own.
• Nobody legitimate ever needs it. Not exchange support, not a wallet developer, not a "migration" process, not an airdrop claim, not a moderator who direct-messaged you first. There is no exception to this and there never will be.
• Write it down offline, twice, in two places. Fire and theft are real; so is a failed hard drive.
• A wallet that arrives pre-filled with a seed phrase is a trap. Whoever generated it kept a copy and is waiting for a deposit.

What actually drains wallets

Wallets are rarely "hacked" in the cinematic sense. Four patterns cover most of it:

1. Phishing for the phrase. A support agent appears minutes after you post about a problem, or a site clones your wallet's interface and asks you to "verify". The urgency is the tell: a real problem does not expire in ten minutes.

2. Malicious approvals. On smart-contract chains, connecting a wallet and signing an approval can grant a contract permission to move a token from your wallet indefinitely — no further confirmation needed. This is how most "I only connected my wallet" losses happen. Review what a transaction asks for, prefer limited approvals over unlimited ones, and revoke old approvals periodically.

3. Blind signing. Approving a transaction whose contents you cannot read is a signature on a blank cheque. If your hardware wallet cannot display what is being signed, the safe answer is to decline.

4. Address substitution. Malware that swaps a copied address in your clipboard, or a "test transaction" from a lookalike address that trains you to reuse it. Verify the first and last characters of any address you paste — and for a first transfer to a new address, send a small amount first.

Where trading fits

Two rules specific to anyone following signals or copy traders:

Keep the trading balance separate from the holding balance. A trading account exists to be at risk; a savings wallet does not. Mixing them means a bad week reaches money that was never meant to be exposed.

Never share private keys or trading credentials with a service. For exchange connections there is a middle path — an API key restricted to read-only — which lets a platform verify a record without ever being able to trade or withdraw. That distinction, and how to set the permissions correctly, is covered in API keys and account security for traders.

A five-minute check

Ask yourself, right now: if the laptop in front of you were stolen tonight, could the thief move your funds? If the answer is yes for an amount you cannot afford to lose, that is the thing to change first — before any question about which chain, which wallet brand, or which yield.

If you are evaluating the people whose calls you follow rather than where you store funds, the checks are in 10 red flags of a signal channel. Nothing here is financial advice.