What is a crypto wallet? Keys, seed phrases and safety

A crypto wallet is software or a device that keeps the private keys that control your cryptocurrency. Despite the name, it holds no coins: the coins exist only as entries on a blockchain, and what a wallet stores is the secret that lets you spend them. That is why losing the keys loses the money, and why anyone who learns them can take it.

In short

• The coins live on the blockchain; the wallet holds the keys that can sign for them and reads the chain to show your balance.
• Wallets differ in two ways: online (hot) or offline (cold), and whether you hold the keys yourself or a company holds them for you.
• The seed phrase, usually 12 or 24 words, can rebuild all your keys, so anyone who has it owns your crypto; no real service ever asks for it.

If a wallet doesn't hold coins, what does it hold?

A Bitcoin balance is not stored anywhere as a file you could copy. The blockchain records that certain amounts can be spent only by whoever can produce a valid signature for a particular address. A wallet holds the key that makes that signature.

The keys come in pairs, built with public key cryptography. The chain runs one way:

Step	What it is	Who can see it
Private key	A secret random number, 256 bits long	Only you, ever
Public key	Calculated from the private key; the reverse calculation is practically impossible	Anyone, once you spend
Address	A shorter code derived from the public key, which you give to people who pay you	Anyone
Signature	Made with the private key for one specific transaction	Anyone; it proves you hold the key without revealing it

When you send crypto, the wallet builds a transaction, signs it with the private key, and broadcasts it. Every node checks the signature against the public key before accepting the payment. The network never asks who you are, only whether the signature is valid. The Ethereum Foundation puts it plainly: a wallet is a tool for using your account, and wallet providers don't have custody of your funds. You can move the same keys to a different wallet app and see the same balance.

What is a seed phrase?

Most wallets today don't make you back up each key. They generate one master secret and derive every key from it, then show it to you as a list of ordinary words, the seed phrase or recovery phrase. The common standard, BIP-39, uses a list of 2,048 words. A 12-word phrase encodes 128 bits of randomness plus a 4-bit checksum; a 24-word phrase encodes 256 bits plus 8.

How hard is a seed phrase to guess?

The arithmetic is what makes it safe, as long as the words were picked at random by the wallet.

1. A 12-word phrase carries 128 bits of randomness, so there are 2^128 possible phrases: about 340 followed by 36 zeros.
2. Suppose an attacker could test 1 trillion phrases every second.
3. Trying them all would take about 3.4 × 10^26 seconds, which is roughly 10^19 years.
4. The universe is about 1.4 × 10^10 years old. The search would take hundreds of millions of times longer.

So nobody steals a seed phrase by guessing it. They steal it by getting you to reveal it: a fake support agent, a fake wallet app, a website asking you to "verify" or "sync" your wallet, or a photo of the words in your cloud storage. A phrase you made up yourself, or picked from a song lyric, is far weaker than the wallet's random one.

Hot or cold, custodial or self-custody?

Two separate questions describe any wallet: is it connected to the internet, and who holds the keys?

	You hold the keys (self-custody)	A company holds the keys (custodial)
Hot (online)	A phone app or browser extension; convenient for spending, exposed to malware and phishing	An account on an exchange; easy to use and recover, but you hold a claim on the company, not the coins
Cold (offline)	A hardware wallet or keys kept on paper or metal, offline; hard to hack remotely, but you must protect the backup	A custody service that keeps keys offline for clients; common for institutions

Custodial accounts feel like a bank: you log in with a password, and the company can reset it. But the company's records are all you have. When the exchange FTX collapsed in November 2022, its customers found that the coins behind their balances had been used by a sister firm, and they became creditors in a bankruptcy. Self-custody removes that risk and adds another: there is no one to call if you lose the keys. As the Ethereum Foundation notes, "There's no customer support in crypto."

Many people split the difference, the approach bitcoin.org recommends: a small amount in a hot wallet for everyday use, and most savings in cold storage.

How do you keep a wallet safe?

• Never share the seed phrase or private key with anyone, for any reason. No exchange, wallet maker, support team or government agency needs it. Anyone asking for it is trying to steal from you.
• Write the seed phrase on paper or metal, and keep it offline. Not in a photo, an email, a notes app or cloud storage. Keep more than one copy, in separate safe places.
• Get wallet software only from the maker's official site or app store listing, and bookmark it. Fake wallet apps and lookalike websites are a common way to steal phrases, a form of phishing.
• Buy hardware wallets new, from the maker or an authorized seller. A device that arrives with a seed phrase already printed or set up has been tampered with.
• Check the address before you send. Crypto payments can't be reversed. Malware can swap a copied address for the attacker's.
• Be wary of anyone who wants you to move crypto to a new app or "platform". That is the setup for scams such as pig butchering, and as the Federal Trade Commission warns, only scammers demand payment in crypto.
• Plan for someone else to find it. If you die or are incapacitated, your family needs to know the wallet exists and how to reach the backup safely.

Not advice

This note explains how wallets work. It doesn't recommend any wallet, brand or way of holding crypto, and it isn't financial advice.

Check yourself

• Without looking back, explain where your coins actually are, and what the wallet contributes.
• Why is a randomly generated 12-word seed phrase impossible to guess, and how do thieves get one anyway?
• What do you gain and give up by holding crypto on an exchange instead of in your own wallet?

Sources

• BIP-39: Mnemonic code for generating deterministic keys — Marek Palatinus, Pavol Rusnak, Aaron Voisine and Sean Bowe, Bitcoin Improvement Proposals, 2013
• Ethereum wallets — Ethereum Foundation, ethereum.org
• Secure your wallet — Bitcoin.org
• What to know about cryptocurrency and scams — U.S. Federal Trade Commission