Contents8 sections
A crypto wallet is a tool that stores the private keys used to approve transactions, not a container that holds coins. The SEC's investor education office puts it plainly: crypto wallets do not store crypto assets themselves; they store the private keys. Your coins are entries on a blockchain, and whoever controls the key can move them. This guide, based on official sources checked as of October 2026, covers how a crypto wallet address relates to private keys and seed phrases, how custodial and self-custody wallets differ, when a hot or cold wallet makes sense, and how to avoid the most common and most expensive transfer mistakes.
How a crypto wallet works: address, private key, seed phrase
Ethereum's documentation describes an account as a pair of cryptographic keys, public and private, and adds that "you never really hold cryptocurrency, you hold private keys." The wallet app is simply the interface that manages those keys, shows your balance and signs transactions. That is why you can switch wallet apps and still see the same funds, as long as you bring the keys with you.
Wallet address
- What it does
- Where people send you crypto, like an email address
- Safe to share?
- Yes
- If you lose it
- Just display it again from the same keys
Private key
- What it does
- Signs withdrawals and transactions
- Safe to share?
- Never
- If you lose it
- Without a backup, access is lost for good
Seed phrase (recovery phrase)
- What it does
- A word list that restores the whole wallet on any device
- Safe to share?
- Never
- If you lose it
- If the device is also gone, nothing can restore it
Wallet app or device
- What it does
- Interface that manages keys and shows balances
- Safe to share?
- Not applicable
- If you lose it
- Restore it elsewhere using the seed phrase
What does a crypto wallet address look like?
Formats vary by blockchain. On Ethereum, an address is the last 20 bytes of a hash of the public key with 0x in front, so it is 42 characters long: 0x plus 40 hexadecimal characters. Many other networks reuse the same Ethereum-style format, which is exactly why an address can look valid on the wrong network. You can derive a public key and address from a private key, but not the other way round, so sharing an address never exposes your key.
Why the seed phrase matters most
Most wallets generate a seed phrase, usually 12 to 24 words. The SEC describes it as a random sequence of words that lets you restore your wallet if the device or key is lost. Anyone who sees those words can rebuild your wallet on their own device. Ethereum.org advises you to write it down and not store it on a computer. Screenshots, cloud notes and chat messages are the most common ways seed phrases leak.
Custodial vs self-custody wallets
When you keep crypto in an exchange account, the exchange holds the private keys. The SEC calls this third-party custody, as opposed to self-custody, where you hold the keys. The bulletin warns that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your assets. Self-custody removes that platform risk, but ethereum.org notes that there's no customer support in crypto: you alone are responsible for backups.
Who controls the keys
- Custodial (exchange)
- The platform
- Self-custody wallet
- You
Forgot your password
- Custodial (exchange)
- Recover through identity checks
- Self-custody wallet
- No seed phrase, no recovery
Main risks
- Custodial (exchange)
- Hacks, insolvency, withdrawal freezes
- Self-custody wallet
- Lost or leaked seed phrase, phishing, mis-sends
Convenience
- Custodial (exchange)
- Easy fiat on-ramp and trading
- Self-custody wallet
- Full control, connects to dapps and many networks
What to check
- Custodial (exchange)
- Storage practices, insurance, fees
- Self-custody wallet
- Backup method, supported networks, genuine hardware
Before trusting a custodian, the SEC suggests asking how and where it stores keys, whether it uses hot or cold wallets, whether it lends out or commingles customer assets (rehypothecation), and what insurance terms apply. Rules differ by country. In South Korea, for example, the Financial Services Commission's Q&A on the Virtual Asset User Protection Act says that since July 19, 2024, licensed virtual asset service providers must keep at least 80% of the economic value of users' crypto in cold storage at all times. A storage rule like that lowers some risks but does not guarantee every loss will be covered.
Hot wallet vs cold wallet: which should you use?
A hot wallet is connected to the internet: mobile apps, browser extensions and desktop apps. A cold wallet keeps keys offline, typically on a hardware wallet. According to the SEC, hot wallets are convenient but expose your assets to cyberthreats, while cold wallets are generally more secure from online attacks but can be lost, damaged or stolen, which may mean permanent loss.
Connection
- Hot wallet
- Online
- Cold wallet
- Offline; connects only to sign
Common forms
- Hot wallet
- Mobile, browser extension, desktop app
- Cold wallet
- Hardware wallet, air-gapped device
Upfront cost
- Hot wallet
- Usually free
- Cold wallet
- Device purchase
Strengths
- Hot wallet
- Fast transfers, easy dapp access
- Cold wallet
- Far less exposure to malware and remote hacks
Weaknesses
- Hot wallet
- Phishing, malware, key leaks
- Cold wallet
- Loss or damage, slower to use
Typical use
- Hot wallet
- Small amounts you spend often
- Cold wallet
- Larger amounts held long term
Many people use both: a hot wallet for day-to-day amounts and a cold wallet for long-term holdings. Either way, transactions carry network fees, and a cold wallet is only as safe as its seed phrase backup. If the device breaks but the phrase is safe, you can restore everything; if the phrase is gone, the device is your single point of failure.
Buy hardware wallets new, directly from the manufacturer or an authorized reseller, and generate the seed phrase yourself during setup. If a device arrives with a pre-filled recovery card, don't use it.
How to check a crypto wallet address before you send
Coinbase's help center is direct: crypto transactions are final and cannot be canceled or reversed, and if you don't know who owns the wrong address, recovery isn't possible. For assets available on several chains, such as USDC, it also states that the same network must be used on both ends (with a narrow Ethereum/Polygon exception for supported assets) and that funds lost on an incorrect network can't be recovered. A short routine prevents most errors.
- 1
Get a fresh deposit address
On an exchange, pick the asset and network first, then copy the address shown. In a self-custody wallet, use the Receive screen or QR code. Don't reuse an old note.
- 2
Match the network on both sides
The network you choose when sending (Ethereum, Solana, Tron and so on) must match the receiving screen exactly. Similar-looking addresses on different networks are a common trap.
- 3
Compare the whole address
Don't check only the first and last few characters. Clipboard-swapping malware and address-poisoning scams rely on lookalike addresses.
- 4
Check for a memo or tag
Some assets need a memo or destination tag when depositing to an exchange. If the deposit screen shows one, include it.
- 5
Send a small test first
For a new address, send a small amount, confirm it arrives, then send the rest. You pay one extra fee in exchange for much lower risk.
If you are moving coins between exchanges because of a price gap, factor in transfer time and withdrawal fees, which can erase the difference. You can compare cross-exchange prices on the arbitrage page and the Korea premium on the Kimchi premium page, but prices can move while your transfer is pending.
Common wallet risks and how to respond
- Seed phrase phishing: no wallet provider, exchange or support agent will ask for your seed phrase. Treat any request as a scam.
- Fake wallet sites and apps: avoid ads and links. Ethereum.org recommends you bookmark web wallets and open them only from that bookmark.
- Unlimited token approvals: approving unlimited spending for a dapp can let it drain tokens later. Revoke approvals you no longer need.
- Oversharing: the SEC advises not sharing the amount or types of crypto you hold. Remember that a public address reveals its balance.
- Weak account security: use strong passwords and multi-factor authentication on exchange accounts, and enable withdrawal address allowlists if available.
News about new wallet drainers and phishing kits often spreads first in community channels. Skimming the most-discussed topics in crypto Telegram trends can help you spot a new scam early, but never connect a wallet or type a seed phrase from a link posted in a channel.
Quick checklist
- Know whether each holding is custodial (exchange) or self-custody.
- For self-custody, confirm your seed phrase is written down offline and not in photos or cloud notes.
- Split spending money and long-term holdings between hot and cold storage.
- Before every transfer, verify the full address, the network and any memo, and test with a small amount.
- Turn on multi-factor authentication and withdrawal allowlists on exchange accounts.


