Wallets and custody: the complete guide

What a wallet really is

The word “wallet” is misleading. A crypto wallet does not hold your coins the way a physical wallet holds cash. Your assets exist as entries on the blockchain itself; the wallet holds the keys that prove you control the addresses those entries are recorded against. A more accurate name would be a key manager. It stores your private keys (or the seed phrase they derive from), presents your balances by reading the public ledger, and — most importantly — signs transactions on your behalf when you authorise them.

This reframing has a direct consequence for custody. Because control of the keys equals control of the funds, the central question for any wallet is: who can access the keys? Everything else — the interface, the supported networks, the convenience features — is secondary to that question. If you have not read it yet, /how-blockchains-work/ explains how keys and signatures actually authorise movement of value; this guide focuses on the models and hardware you use to protect them.

Custody models: who holds the keys

There are two fundamental custody models, and the difference between them is the single most important decision you make.

Custodial custody. A third party — typically an exchange or a hosted-wallet provider — holds the private keys on your behalf. You have an account with a login, much like online banking, and the provider executes transactions for you. The advantages are familiar recovery (a forgotten password can be reset) and convenience. The trade-off is counterparty risk: you do not control the keys, so your assets depend on that company’s solvency, security, and willingness to let you withdraw. If it is hacked, becomes insolvent, or freezes accounts, your funds are exposed. The industry maxim “not your keys, not your coins” captures this precisely.

Self-custody. You alone hold the keys, usually via a seed phrase. No third party can freeze, seize, or lose your funds through their own failure — and equally, no third party can help you recover access if you lose your keys or fall for a scam. Self-custody removes counterparty risk and replaces it with personal responsibility. Most experienced users adopt a blend: custodial accounts for active trading or fiat on- and off-ramps, and self-custody for holdings they intend to keep. The security implications of self-custody are the subject of /crypto-security/.

Software (hot) wallets

A self-custody wallet can be either “hot” or “cold,” describing whether its keys ever touch an internet-connected device. Software wallets — browser extensions, mobile apps, and desktop applications — are hot wallets: the private keys are stored on a general-purpose device that is online. Popular examples include browser and mobile wallets used to interact with decentralised applications.

Hot wallets are convenient and free, and they are the practical choice for everyday transactions and for interacting with applications. Their weakness is their environment: because the keys live on an internet-connected computer or phone, they are exposed to malware, malicious browser extensions, clipboard hijackers, and phishing that operates through the same device. A compromised device can, in principle, exfiltrate the keys or manipulate what you see when signing. The sensible posture is to treat a hot wallet like the cash in your pocket: useful for spending, but not where you keep your savings. Keeping a modest balance in a hot wallet bounds the damage if that wallet is compromised — a practice reinforced throughout /crypto-security/.

Hardware (cold) wallets and secure elements

A hardware wallet is a dedicated physical device whose defining feature is that the private keys are generated and stored inside it and never leave the device. When you want to transact, the unsigned transaction is sent to the device, the device signs it internally, and only the signature is returned to your computer or phone. The keys themselves are never exposed to the online machine, which is why a hardware wallet remains safe even when used with a malware-infected computer: the malware may see the signature, but it cannot extract the key.

Leading devices from vendors such as Ledger and Trezor build on this principle, and higher-end models incorporate a secure element — a tamper-resistant chip, of the kind used in passports and payment cards, designed to protect secrets against physical extraction attacks such as voltage glitching. The device is unlocked by a PIN, and critically, it has its own screen. That screen is what enables trustworthy verification: because you confirm the recipient address and amount on the hardware device’s own display, malware on the connected computer cannot deceive you, even if it alters what the computer shows. Always verify that the details on the device match your intent before approving — this on-device check is one of the strongest protections available to any user, and it is the reason hardware wallets are the standard recommendation for holdings of meaningful value.

A hardware wallet is not magic, however. It protects the key, but you can still be tricked into signing a malicious but validly presented transaction, so the transaction-hygiene practices in /crypto-security/ still apply. And the seed phrase generated during setup remains the ultimate backup — and therefore the ultimate vulnerability if mishandled, as the next section explains.

Seed phrases, backup, and recovery

Nearly all modern wallets, hot and cold alike, are hierarchical deterministic (HD) wallets built on a set of open standards. Understanding the chain of standards clarifies both how recovery works and why the seed phrase is so sensitive.

• BIP-39 defines the seed phrase itself. Random entropy is encoded as an ordered list of words drawn from a fixed 2,048-word list, where each word represents eleven bits. 128 bits of entropy plus a short checksum produces a twelve-word phrase; 256 bits produces a twenty-four-word phrase. The phrase, optionally combined with a passphrase, is stretched via the PBKDF2 function into a 512-bit master seed.
• BIP-32 defines how that master seed becomes a whole tree of key pairs, so a single phrase can derive effectively unlimited addresses.
• BIP-44 defines a common layout for that tree — a standard derivation path — so different wallets agree on where to find accounts for each network. This is why one seed phrase can back up addresses across many chains and be restored in a different compatible wallet.

Because the phrase deterministically regenerates every key, recovery does not depend on any specific device or company: if your hardware wallet is lost or destroyed, you buy a new compatible one and restore from the phrase. The flip side is that the phrase is a complete, portable copy of your wallet, so its storage is the whole ballgame. Record it on durable physical media, keep redundant copies in separate secure locations, never create a digital copy or type it into any online system, and test a restore before relying on it. The full backup discipline, including what to do if a phrase may have leaked, is detailed in /crypto-security/.

The optional passphrase (the “25th word”)

BIP-39 supports an optional user-chosen passphrase that is combined with the seed phrase to derive an entirely different set of keys. Sometimes called the “25th word,” it is a distinct secret that is never stored alongside the written words. Its security value is significant: someone who finds your twenty-four words alone cannot access the passphrase-protected funds, because a different passphrase (including an empty one) produces a completely different wallet.

The trade-off is unforgiving. The passphrase has no recovery mechanism and is case- and character-sensitive; if you forget it or mistype it, the funds it protects are unrecoverable, and there is no “wrong passphrase” error — you simply land in a different empty wallet. It also creates a second secret to back up securely and separately from the phrase. Used carefully, a passphrase is a powerful defence against physical discovery of your written backup; used carelessly, it is a reliable way to lose access. Treat it as an advanced feature, and only adopt it once your basic backup discipline is solid.

Verifying addresses and signing safely

Custody is not only about where keys live; it is about controlling the act of signing, because a signature is what actually moves value. Several habits translate directly into custody security regardless of which wallet you use.

1. Verify on-device. With a hardware wallet, always confirm the recipient address and amount on the device’s own screen, not just on the computer. This defeats malware that alters the display on the connected machine.
2. Verify full addresses. Check the entire address, not just the first and last few characters, to defeat address-poisoning attacks that rely on lookalike endpoints. Prefer a saved address book over copying from history.
3. Understand approvals and signatures. A signing request may grant a contract ongoing permission over your assets rather than performing a one-off transfer. Never approve a request whose effect you cannot read. Approval hygiene is covered in /how-to-revoke-token-approvals/.
4. Segment by purpose. Keep a separate wallet for interacting with unfamiliar applications, so a malicious signature there cannot reach the wallet holding your reserves.

These practices matter even with the best hardware, because hardware protects the key but cannot decide, on your behalf, whether a transaction is one you actually want.

Multisig: removing the single point of failure

Every setup discussed so far has a single point of failure: one key (or one seed phrase) controls the funds. Multisignature (multisig) custody removes that weakness by requiring multiple independent keys to authorise a transaction. A multisig is configured as “M-of-N”: for example, a 2-of-3 setup has three signer keys, any two of which must approve before funds move.

The most widely used implementation on Ethereum and compatible chains is Safe (formerly Gnosis Safe), a smart-contract wallet. Rather than a single private key, the funds live in a contract account that stores a list of owner addresses and a threshold number. To execute a transaction, the contract verifies that valid signatures from at least the threshold number of owners are present. Safe originated as Gnosis Multisig in 2017, was rewritten as Gnosis Safe in 2018, and was rebranded to Safe in 2022; it is widely used to secure organisational treasuries.

The security benefits are substantial. No single compromised key can move funds, so a phishing attack or a lost device does not, by itself, cause a loss. If one signer key is lost, the remaining signers can still operate the account and replace the missing signer. Multisig is well suited to larger personal holdings and essential for shared funds such as a company treasury or a DAO. The cost is added complexity and, for smart-contract wallets, transaction fees to deploy and operate the contract — so it is generally reserved for amounts and use cases where the extra robustness justifies the overhead. Distributing signer keys across different devices, locations, and even people is what turns multisig from a formality into genuine resilience.

Smart-contract wallets and account abstraction

Multisig hints at a broader shift. Traditionally, only an externally owned account controlled by a single private key could initiate a transaction, as explained in /how-blockchains-work/. Smart-contract wallets, and the emerging model of account abstraction, let a programmable contract account define its own rules for what counts as a valid authorisation.

This makes possible features that plain key-pair wallets cannot offer: social recovery (a set of trusted guardians can help restore access if you lose your key, without any of them controlling your funds), spending limits, session keys for specific applications, allow-lists of approved destinations, and the multisig thresholds described above. The trade-off is that security now also depends on the correctness of the wallet’s contract code, adding a layer of smart-contract risk on top of key management. For many users these programmable safeguards meaningfully reduce the “single mistake, total loss” fragility of traditional wallets, and adoption is growing as the standards mature.

Watch-only wallets and air-gapped signing

Two techniques extend custody security for users who want stronger separation between viewing and spending. A watch-only wallet is loaded with your public addresses but none of the private keys, so it can display balances and incoming transactions on an everyday device without any ability to spend. This lets you monitor holdings on a phone or laptop while the keys that could move them remain isolated on a hardware device that you connect only when you actually need to sign.

Air-gapped signing takes isolation further: the signing device never connects to an online machine at all, even by cable. The unsigned transaction is transferred to it by QR code or microSD card, the device signs internally, and the signed transaction is transferred back the same way. Because no data channel exists between the key and the internet, an entire class of remote attacks becomes impractical. Air-gapping adds friction and is aimed at larger or long-term holdings rather than daily use, but it illustrates the core custody principle taken to its conclusion: the further your keys are from any online system at the moment of signing, the smaller the surface an attacker can reach.

Planning for redundancy and inheritance

Self-custody shifts a responsibility onto you that a custodian would otherwise carry: making sure funds are not lost through your own single point of failure. Two scenarios are easy to overlook until it is too late — the loss of your only backup, and your own incapacity or death.

For redundancy, keep more than one physical copy of your seed phrase in separate secure locations so that a single fire, flood, or theft cannot simultaneously destroy the funds’ backup and your access. Multisig offers a more robust structure still, because losing any one key below the threshold is survivable by design rather than catastrophic. For inheritance, consider — carefully and without ever exposing the secret prematurely — how a trusted person would gain access if you could not act. Approaches range from sealed instructions held with legal documents to multisig arrangements where a family member or lawyer holds one key. Each involves trade-offs between security and recoverability, and the wrong approach can either expose funds while you are alive or strand them permanently after you are gone. The point is to make a deliberate decision rather than to leave the outcome to chance.

Common custody mistakes

Most losses in self-custody come from a short list of recurring errors rather than exotic attacks. Being aware of them is itself a defence:

• Storing the seed phrase digitally — a photo, cloud note, password-manager field, or email — which turns an offline master key into an online-exposed one.
• Keeping the only backup in one place, so a single accident destroys both the funds’ backup and any means of recovery.
• Never testing a restore, then discovering during an emergency that the backup was recorded incorrectly.
• Adopting a passphrase before mastering basic backup, and losing access by forgetting or mistyping it.
• Buying hardware wallets second-hand or from unofficial sellers, risking a tampered device or a pre-generated seed; always buy new from the vendor or an authorised reseller and generate the seed yourself.
• Using one wallet for everything, so a single malicious signature can reach long-term holdings.
• Confusing the device PIN with the seed phrase, and assuming a lost device means lost funds (it does not, if the phrase is safe) or that the PIN can substitute for the backup (it cannot).

Each of these is fully avoidable, and avoiding them matters more than any single product choice.

Choosing and layering your custody

There is no single “best” wallet; there is a setup appropriate to what you are protecting, which is why the threat-model approach in /crypto-security/ comes first. A practical, layered structure that suits most people looks like this:

• Everyday spending: a software (hot) wallet holding a modest balance, used for routine transactions and interacting with applications. Convenience is the priority; exposure is bounded by keeping the balance small.
• Long-term holdings: a hardware (cold) wallet whose keys never touch an online device, used rarely and verified on-device every time. This is where meaningful value lives.
• Large or shared funds: a multisig, so that no single key compromise or lost device can cause a loss, with signer keys distributed across devices and locations.
• Active trading or fiat conversion: a reputable custodial exchange, understood as carrying counterparty risk, from which you withdraw to self-custody anything you are not actively using.

The unifying principle is to match the strength and inconvenience of the custody method to the value and the risk. Convenience and security trade off against each other, and the right answer is usually not to pick one extreme but to layer several models so that the failure of any one does not become catastrophic. For definitions of the terms used here, see the /glossary/, and pair this guide with /crypto-security/ for the day-to-day habits that keep any custody setup safe.

Sources

• ethereum.org — Crypto wallets overview
• ethereum.org — Security and custody best practices
• BIP-39 — Mnemonic code for generating deterministic keys
• BIP-32 — Hierarchical Deterministic Wallets
• BIP-44 — Multi-account hierarchy for deterministic wallets
• Ledger — Why secure elements matter for hardware wallet security
• Trezor — What is a hardware wallet
• Safe — Documentation: what is Safe (multisig smart accounts)
• ethereum.org — Account abstraction