The word wallet is the most misleading term in cryptocurrency. A leather wallet holds cash; a crypto wallet holds nothing of value. The coins live on the blockchain, a public ledger copied to thousands of computers. What your wallet holds is the key that lets you move them. Lose the key and the coins stay on the ledger forever, visible to everyone and usable by no one. Give the key to someone else and they own the coins, whatever your phone says.
Three things with confusing names
Private key
A private key is a very large random number, so large that guessing it is not a realistic threat: there are more possible keys than atoms in the observable universe. Software uses it to sign transactions. Anyone with the number can sign, so it must never be typed into a website, sent in a chat or photographed.
Public key and address
From the private key, mathematics derives a public key, and from that an address, the string you share to receive funds. The derivation works in one direction only: knowing the address or public key tells an attacker nothing useful about the private key. That asymmetry is the whole trick. You can publish an address on a billboard; you can never publish the private key.
Seed phrase
Managing one random number per address would be unbearable, so modern wallets start from a single master secret and derive every key from it in a predictable way. That master secret is written down as a seed phrase: 12 or 24 ordinary words picked from a fixed list of 2,048, in a standard called BIP-39. Any wallet that follows the standard can rebuild all your keys, all your addresses and therefore all your funds from those words. The seed phrase is not a password to your wallet; it is your wallet.
Custodial or self-custody: who holds the key?
Every wallet product answers one question: who holds the private key?
| Type | Who holds the key | You get | You risk |
|---|---|---|---|
| Custodial (exchange, broker app) | The company | Password resets, support, easy trading | Their bankruptcy, hack, freeze or error is your loss; you hold a claim, not coins |
| Software wallet (phone, desktop) | You, on an internet-connected device | Full control, free, convenient | Malware and phishing on that device |
| Hardware wallet | You, on a device that never goes online | Keys isolated from your computer; transactions signed inside the device | Losing both device and backup; buying a tampered unit; firmware bugs |
| Multisig | Split across several keys, e.g. 2 of 3 | No single point of failure | Complexity; losing the wallet configuration |
The phrase “not your keys, not your coins” summarises the first row. Keeping coins on an exchange is not automatically wrong, it is a decision to trust that company with an unsecured claim, the same way a bank deposit is a claim on the bank. The difference is that crypto custodians rarely carry deposit insurance.
What “hot” and “cold” mean
A hot wallet has its key on a device connected to the internet: a phone app, a browser extension, an exchange account. It is convenient and exposed. A cold wallet keeps the key on something that never connects: a hardware wallet, or in the extreme case, a paper or metal backup of the seed phrase with no device at all. The sensible pattern is the same one people use with cash: a small amount in the hot wallet for everyday use, the bulk in cold storage.
How keys get stolen in practice
Almost no one loses bitcoin because the cryptography was broken. Coins are lost through five mundane routes:
- Typing the seed phrase into something. A fake wallet update, a “verification” page, a support agent in a chat. No legitimate service ever needs your seed phrase. Not to verify you, not to fix a bug, not to unlock a bonus.
- Photos and cloud backups. A picture of the words in a phone gallery is synced to the cloud, indexed and one account breach away from an attacker.
- Malware that swaps addresses. Clipboard hijackers replace the address you paste with the attacker's. Verify the first and last characters on the receiving device's screen.
- Losing the only copy. A single paper in a house that floods or burns. No backup, no coins.
- Bad randomness at creation. Rare but devastating: if a wallet generates keys with a weak random source, attackers can enumerate them. Our Coldcard entropy report analyses a 2026 case where a single firmware flag reduced seed strength from 128 bits to 40 and hundreds of millions of dollars were drained.
The habits that work
Why the design is worth the responsibility
Self-custody feels harsh because it removes the safety net. It also removes the people who could freeze your account, lose your deposit in a bankruptcy or block a payment they disapprove of. Keys turn ownership into a mathematical fact rather than a company's promise. The trade is control for responsibility, and the good news is that the responsibility reduces to a short list of habits that, once learned, take minutes a year.
Frequently asked questions
What is the difference between a private key and a seed phrase? A private key signs transactions for one address. A seed phrase is the master secret from which a wallet derives all of its private keys and addresses, written as 12 or 24 words. Backing up the seed phrase backs up everything.
If I lose my hardware wallet, are my coins gone? No, as long as you have the seed phrase. Restore the words on a new device from any manufacturer that supports the BIP-39 standard and your addresses and funds reappear. If you lose both the device and the words, the coins are unrecoverable.
Is it safe to keep bitcoin on an exchange? It is a decision to trust the exchange with a claim rather than holding coins yourself. Exchanges can be hacked, freeze withdrawals or go bankrupt, and in most countries there is no deposit insurance. Many people keep trading amounts on an exchange and long-term holdings in self-custody.
Can someone steal my bitcoin if they know my address? No. An address only lets people send coins to you and see the history of that address. Spending requires the private key, which cannot be derived from the address.