The short answer
- A crypto wallet doesn't store coins. It stores the keys that let you move them.
- If an exchange holds the keys, the exchange controls your coins. If you hold them, you do, and losing them means losing the coins.
- Your recovery phrase, usually 12 or 24 words, is the master key. Anyone who sees it can take everything. Never type it into a website or share it with "support".
- For larger long-term holdings, a hardware wallet is the safest everyday option.
"Not your keys, not your coins" is one of the oldest sayings in crypto, and it keeps proving true. Exchanges get hacked, freeze withdrawals, or go bust, and customers wait months or years to get some of their money back. Indian users saw this with WazirX in 2024. Global users saw it with FTX in 2022. This guide explains what wallets are, which type fits which job, and how to set one up without making the mistakes that cost people money.
What a wallet actually is
Your coins live on the blockchain, a public record shared across thousands of computers. What you own is a private key, a secret number that proves you're allowed to move the coins at a particular address.
A wallet is the software or device that keeps that private key and uses it to sign transactions. Your public address is like a bank account number. You can share it so people can pay you. Your private key is like a signature that can't be revoked. Anyone who has it can spend your coins, and there's no bank to call.
Most wallets create your keys from a recovery phrase, a list of 12 or 24 ordinary words. If you lose your phone or device, those words restore everything. If someone else gets them, they can restore everything too.
Custodial vs self-custody
| Custodial (exchange holds keys) | Self-custody (you hold keys) | |
|---|---|---|
| Examples | Your balance on any exchange | Hardware wallets, mobile wallet apps |
| If you forget your password | Reset it through support | Restore from your recovery phrase. If you've lost that too, the coins are gone. |
| If the company fails | You become a creditor and wait | Unaffected |
| Main risk | Hacks, frozen withdrawals, insolvency | Losing your phrase, or being tricked into revealing it |
| Best for | Small amounts you trade often | Larger amounts you hold for months or years |
Many people use both. They keep a small trading balance on a licensed exchange and keep the rest in self-custody.
Types of self-custody wallet
Mobile and browser wallets ("hot" wallets)
These are apps on your phone or browser extensions. They're free and convenient, but the keys sit on a device that's connected to the internet, so malware or a fake app can steal them. They're fine for small amounts and for using apps.
Hardware wallets ("cold" wallets)
A hardware wallet is a small device that keeps your keys offline. To send coins, you confirm the transaction on the device's own screen with its buttons. Even if your computer is infected, an attacker can't move funds without physically holding the device and knowing its PIN.
The best-known makers are Ledger, Trezor and OneKey. Prices start at roughly the cost of a mid-range pair of headphones. If you hold more crypto than you'd be comfortable losing, it's worth it.
Buy hardware wallets only from the maker's official store or authorised resellers. Second-hand or marketplace devices can be tampered with. A genuine device never arrives with a recovery phrase already printed inside the box. If yours does, it's a scam.
Setting up a hardware wallet safely
- Download the companion app only from the maker's official website. Type the address yourself rather than clicking ads or links.
- Let the device generate a new recovery phrase. Never use a phrase someone gave you.
- Write the phrase on paper, or stamp it into a metal backup plate, in the exact order. Don't photograph it, store it in notes or email, or save it to the cloud.
- Confirm the phrase when the device asks you to check it.
- Store the backup somewhere safe and private, away from the device. Many people keep two copies in two different places.
- Test with a small amount first. Send a little crypto in, then send a little out, before moving larger amounts.
The recovery phrase rules
Almost every wallet theft comes down to someone getting the recovery phrase. So:
- No real support agent, exchange, or wallet company will ever ask for your recovery phrase.
- No website needs your phrase to "validate", "sync", "unlock" or "claim an airdrop".
- Don't type it into any computer or phone except when restoring a wallet you control.
- Think about inheritance. If something happened to you, could your family find and use the backup?
Sending crypto without losing it
- Check the network. USDT, for example, exists on several blockchains. If you send it on one network to an address that expects another, the funds can be lost.
- Check the whole address on the device screen, not just the first and last few characters. Some malware swaps addresses you copy.
- Send a test amount first when using a new address.
Not financial advice. This guide explains how crypto wallets work. It doesn't recommend buying any crypto. Self-custody puts you in full control, and that also means full responsibility for your keys.
Further reading: Bitcoin.org, securing your wallet.