Crypto Wallets: Types, Security, and How to Choose One

The word "wallet" is the source of most crypto confusion. A crypto wallet does not contain coins the way a leather wallet holds cash. Your assets are entries on a public ledger; the wallet holds the cryptographic keys that prove you control the addresses those entries sit against. Whoever holds the keys controls the funds. A more honest name would be a key manager.

That reframing changes the only questions worth asking about any wallet. Not "which is best" but who holds the keys, where are those keys exposed, and how do you recover if something goes wrong? Every wallet type below is a different answer to those three questions, with different trade-offs in custody, attack surface, and recovery. None is universally best. The right choice depends on what you are protecting and from whom.

The types of crypto wallets

Wallets are usually sorted along two axes at once: custody (do you hold the keys, or does a third party?) and connectivity (is the signing key ever exposed to an internet-connected device?). The eight categories below are the practical shapes those axes produce. Read each on its own terms rather than as a ranking.

1. Hardware (cold) wallets

What it is. A dedicated physical device — such as those from Ledger, Trezor, or Coldcard — whose sole job is to generate and store private keys and to sign transactions internally. The keys are meant never to leave the device.

How it works. On first setup the device generates a seed following the BIP-39 mnemonic standard, from which all keys are derived using the BIP-32 hierarchical-deterministic scheme and BIP-44 account paths. When you want to move funds, a companion app on your phone or computer builds an unsigned transaction; the device displays the details on its own screen, you approve on the device, and only the finished signature leaves. Many modern devices add a certified secure element — Ledger uses secure-element chips, and Trezor's Safe series adds an EAL6+ Optiga secure element — to resist physical extraction.

Strengths. The signing key is isolated from your internet-connected computer, so ordinary malware on that computer cannot read it. The on-device screen lets you verify the real recipient and amount before you sign, which defeats many host-side tampering attacks.

Trade-offs. A hardware wallet does not eliminate the seed phrase — it just moves where the seed is created; you still must back that seed up, and that backup becomes the weakest link. Supply-chain tampering is a real risk, so buy direct from the manufacturer and run the vendor's authenticity check. Firmware is a trust point: the Trezor One and Model T used a general-purpose microcontroller with no secure element and were shown to be vulnerable to physical voltage-glitching, and Ledger's 2023 "Recover" announcement revealed that closed firmware can, in principle, be written to export key material — a reminder that the device is only as trustworthy as its firmware and your handling of it.

Who it's for. Anyone holding meaningful value for the medium to long term, especially funds you rarely move.

Firmware openness is a meaningful differentiator within this category. Fully open-source firmware can be independently reviewed, so its behaviour is auditable; closed firmware asks you to trust the vendor's claims about what the chip will and will not do. Neither is automatically safer — an audited design still depends on correct handling — but it changes who has to be trusted, which is exactly the kind of assumption a security-conscious buyer should make deliberately rather than by default.

The security reality. A hardware wallet protects the key, not you. If a malicious site tricks you into approving a transfer, the device will faithfully sign it. Cold storage stops key theft; it does not stop you from authorising a bad transaction. The device's screen is your defence here — treat every detail it displays as the only trustworthy version of what you are about to sign.

2. Mobile wallets

What it is. A smartphone app — for example MetaMask Mobile, Trust Wallet, or Phantom — that stores keys on the phone and signs transactions there. It is a "hot" wallet: the signing key lives on a networked device.

How it works. The app generates a BIP-39 seed on the phone and encrypts the derived keys inside the operating system's protected key store (the iOS Secure Enclave or Android Keystore), unlocked by biometrics or a passcode. It connects to dApps through QR codes or WalletConnect and reads balances from public nodes.

Strengths. Convenient, always with you, good for in-person payments and light on-chain activity. Modern phones offer hardware-backed key storage and a reasonably sandboxed app model.

Trade-offs. The key sits on an internet-connected device that also runs your browser, messaging, and email — a large attack surface. Threats include malicious or cloned apps in the stores, clipboard-hijacking malware that swaps a pasted address, screen-overlay attacks, and simple loss or theft of the phone. A rooted or jailbroken device weakens the OS protections the app relies on.

Who it's for. Everyday spending and small-to-moderate balances you actively use.

The security reality. Treat a mobile wallet like the cash in your pocket: convenient, and sized so that losing it is survivable. Pair it with a hardware wallet for larger holdings rather than keeping everything hot.

3. Desktop wallets

What it is. A program installed on a laptop or desktop — such as Electrum, Exodus, or Sparrow — that stores an encrypted key file locally and signs on the machine.

How it works. Keys are derived from a BIP-39 seed and held in an encrypted wallet file on disk, decrypted with a password when you transact. Many desktop wallets can also act as a "watch-only" front end that pairs with a hardware wallet or an air-gapped signer, so the desktop never touches the private key at all.

Strengths. A large screen makes it easier to read transaction details and manage more complex operations, coin control, or multisig setups. Desktop wallets often expose advanced features that mobile apps hide.

Trade-offs. Desktop operating systems are a rich target for info-stealer malware that hunts for wallet files, browser data, and clipboard contents. A general-purpose computer accumulates far more software — and therefore more risk — than a phone. If the machine is compromised, a software-only desktop wallet is exposed.

Who it's for. Power users, node operators, and people building multisig or watch-only workflows.

The security reality. A desktop wallet is safest when it holds no keys at all — used as a watch-only coordinator that hands transactions to a hardware or air-gapped signer for approval.

4. Browser-extension wallets

What it is. A wallet that lives inside your web browser — MetaMask, Rabby, or Phantom's extension — and injects a provider so websites can request signatures. It is the primary way people interact with DeFi, NFT marketplaces, and other dApps.

How it works. The extension stores encrypted keys in browser storage and exposes an interface that web pages call to request a connection, a message signature, or a transaction. You approve or reject each request in a pop-up.

Strengths. Unmatched convenience for on-chain applications. It is the connective tissue of the DeFi ecosystem and supports a huge range of chains and dApps.

Trade-offs. This category has the largest and most hostile attack surface of any wallet. It operates inside the browser alongside every website you visit, and it is the primary target of wallet drainers, signature-phishing pages, fake or trojanised extensions, and malicious dApp front ends. Because approvals and off-chain signatures are requested in-flow, users routinely authorise things they do not understand.

Who it's for. Active DeFi and NFT users — ideally with the extension connected to a hardware wallet so the actual signing happens on a device with its own screen.

The security reality. Most catastrophic self-custody losses happen here, not through key theft but through the user signing a malicious approval or permit. See how wallet drainers work and how signature phishing exploits this surface.

5. Web / exchange (custodial) wallets

What it is. An account on a centralised exchange or hosted-wallet service that holds the private keys for you. You log in with an email and password, much like online banking.

How it works. The provider controls the keys and records your balance in its internal database, settling on-chain in aggregate. You request withdrawals and the provider signs on your behalf. You never touch a seed phrase.

Strengths. Familiar recovery — a forgotten password can be reset — plus fiat on- and off-ramps, and no seed phrase to lose. For many people it is the least error-prone way to begin.

Trade-offs. This is not your custody. You hold a claim against the provider, not the coins, and you inherit counterparty risk: insolvency, withdrawal freezes, account lockouts, internal fraud, and platform breaches. It also requires identity verification (KYC).

Who it's for. Active traders, beginners, and anyone using the platform as a fiat bridge — not as long-term storage.

The security reality. Secure the account with phishing-resistant two-factor authentication. Prefer a FIDO2/WebAuthn passkey or hardware security key over SMS codes, because passkeys are bound to the real site's origin and cannot be handed to a lookalike phishing page, and because SMS is exposed to SIM-swap attacks. Enable a withdrawal-address allowlist, and move anything you are not actively trading into self-custody. Remember that a custodial balance is a claim on a company, not insured deposits — "proof of reserves" statements and audits reduce, but do not remove, the risk that the platform cannot honour withdrawals.

6. Paper & air-gapped wallets

What it is. Two related ideas that keep keys entirely off any online device. A paper wallet is a printed private key or seed (often with a QR code). Air-gapped signing uses a device or computer that never connects to the internet — such as a Coldcard signing via microSD, QR, or NFC.

How it works. With air-gapped signing, an online watch-only wallet builds an unsigned transaction and exports it — for Bitcoin, as a Partially Signed Bitcoin Transaction (the BIP-174 PSBT format) — onto a microSD card or QR code. You carry that to the offline signer, review it on the signer's own screen, sign, and carry the signed transaction back to broadcast. The private key never touches a connected machine.

Strengths. The strongest isolation available: the signing key is provably never exposed to an online system. Air-gapped PSBT workflows use open, interoperable file formats rather than a single vendor's channel.

Trade-offs. Paper wallets are largely deprecated and error-prone: paper degrades, burns, and is easily photographed; printers can leak; and importing ("sweeping") a paper key into software exposes it and invites change-address mistakes. Air-gapped setups demand discipline — a correct watch-only configuration, careful verification on the device screen, and secure handling of the transfer medium.

Who it's for. Large, rarely-moved cold storage held by technically confident users.

The security reality. Prefer a modern air-gapped hardware signer over a printed paper key. The goal — keys that never meet the internet — is sound; a bare printout is a brittle, outdated way to reach it.

7. Smart-contract / multisig wallets

What it is. A wallet whose account is itself a smart contract rather than a single key — most prominently Safe (formerly Gnosis Safe). Control is defined by programmable rules, the most common being multisignature: several owners, of whom a threshold must approve.

How it works. A Safe stores a list of owner addresses and a numeric threshold on-chain. To execute a transaction, the contract verifies that valid signatures from at least the threshold number of owners are present — for example 2-of-3 or 3-of-5. On Ethereum, the ERC-4337 account-abstraction standard (live on mainnet since 2023) lets such smart accounts add programmable features like spending limits and gas sponsorship without changing the base protocol.

Strengths. No single point of failure. One compromised or lost signer key cannot move funds or lock you out — the remaining owners can still transact and can replace the missing signer. Rules such as spending limits and time delays can be enforced on-chain.

Trade-offs. Added complexity and cost: the contract must be deployed (and separately per chain), and you must safeguard several signer keys instead of one. Smart contracts carry code risk — bugs or flawed configurations are their own attack surface — and support is not universal across every chain or dApp.

Who it's for. Treasuries, DAOs, teams, and individuals securing high-value holdings who want distributed control.

The security reality. Multisig removes the single-key catastrophe but introduces governance and contract risk. Distribute signer keys across different devices and locations, or the "multi" in multisig is cosmetic.

8. MPC / social-recovery wallets

What it is. Two approaches that aim to remove the single seed phrase as a point of failure. MPC (multi-party computation) wallets — such as ZenGo, or institutional platforms like Fireblocks — split signing across parties. Social-recovery wallets — such as Argent — let trusted "guardians" restore access.

How it works. An MPC wallet uses a threshold signature scheme so that key shares are generated and held separately and combine to produce a signature without any party ever assembling the full private key; ZenGo, for example, uses a 2-of-2 scheme split between your device and the provider's server. Social recovery instead keeps a normal signing key but assigns guardians (other devices, friends' wallets, or a provider service); if you lose your key, a required number of guardians approve rotating to a new one, usually behind a built-in time delay so you can cancel an unwanted recovery.

Strengths. No seed phrase to write down and lose, and no single device whose compromise drains everything. Recovery is designed to be human-friendly rather than a one-shot 24-word backup, and time delays on sensitive actions give you a window to cancel an unauthorised recovery or transfer before it completes.

Trade-offs. You depend on the availability and honesty of the other share-holder or guardians, and on the provider's implementation — some schemes are proprietary and less independently audited than a plain BIP-39 wallet. A provider that holds one MPC share is a liveness and partial-trust dependency. Chain and dApp support varies.

Who it's for. Users who want self-custody without the seed-phrase single point of failure and are comfortable relying on a newer model.

The security reality. These systems trade the "lose your seed, lose everything" failure for a "depend on your shares and guardians" model. That is often a better trade for ordinary users — but it is a different set of assumptions, not the absence of assumptions.

Comparing wallet types at a glance

The table condenses the trade-offs above. "Custody" is who holds the keys; "connectivity" is whether the signing key is exposed to an online device. Read the "main risk" column as the failure this type is most prone to, not its only risk.

Hot vs cold, custodial vs non-custodial

Two distinctions cut across all eight types, and confusing them is a common and expensive mistake. They are independent: a wallet can be any combination of the two.

Hot vs cold describes whether the signing key is ever exposed to an internet-connected device. A hot wallet keeps the key on an online device — fast and convenient, but reachable by remote attackers. Cold storage keeps the key on a device that signs offline, trading convenience for a far smaller remote attack surface.

Custodial vs non-custodial describes who holds the keys at all. In custodial arrangements a third party holds them and you hold an account; in non-custodial (self-custody) you hold the keys and bear full responsibility for them. Our deeper explainer on custodial vs non-custodial walks through what each means for recovery and risk.

Security note: "custodial" and "cold" are not opposites, and neither is a synonym for "safe". A custodial account can be well secured or poorly run; a self-custody hot wallet can be drained in one signature. Decide the two questions — who holds the keys, and are they exposed online — separately.

How to choose a wallet

There is no single best wallet, only a best fit for a threat model. Most experienced users run more than one — a small hot wallet for daily activity and cold storage for savings — rather than forcing everything into one tool. Work through four questions.

Amount at stake. The value you are protecting sets the floor. Pocket-money balances can live in a mobile wallet; life-changing sums belong in cold storage, and often in multisig. Match the defence to what its failure would cost you.

Frequency of use. Funds you touch daily need to be reachable; funds you hold for years should be deliberately hard to move. Splitting balances by how often you use them is usually safer than one wallet that compromises on both.

Chains and assets. Confirm the wallet genuinely supports the networks and assets you use. Bitcoin-only signers, EVM-focused extensions, and multi-chain apps differ sharply in coverage, and "supported" on a marketing page is not the same as a mature, well-tested integration.

Threat model. Name your realistic adversary. Remote malware and phishing argue for cold storage and hardware-backed signing. Physical theft or coercion argues for a passphrase and geographically separated backups. Counterparty failure argues against leaving long-term holdings on an exchange. You cannot defend against everything at once, so decide what you are actually defending against.

Layer, do not compromise. The single most useful pattern is to stop looking for one wallet that does everything. A small hot wallet for daily activity, a hardware wallet for the bulk of your holdings, and — for large or shared funds — a multisig arrangement is a common layering that lets each tool do the one job it is good at. Keeping your everyday spending wallet separate from your savings also limits the blast radius: a mistake in the hot wallet cannot reach the cold one.

A short checklist to run before you commit:

• Custody: Am I comfortable holding the keys myself, or do I want a third party to — and do I accept that party's risk?
• Recovery: If my device is lost or destroyed tomorrow, exactly how do I recover — and have I tested that path?
• Attack surface: Is the signing key online, and does the wallet show me transaction details on a trusted screen before I sign?
• Source of truth: Is the wallet open-source or independently audited, and is the vendor's security track record public?
• Chains: Does it properly support every network I actually use?
• Backup: Can I store the recovery material safely and redundantly, offline?

Setting up a wallet safely

Most losses trace back to setup, not to breaking cryptography. Two things matter above all: how the recovery secret is created and stored, and whether the software you installed is genuine.

Seed-phrase generation and backup. A self-custody wallet generates a recovery phrase under the BIP-39 standard — typically 12 or 24 words plus a checksum — from which every key is derived via BIP-32 and organised by BIP-44 account paths. Whoever reads that phrase controls the funds, so how you generate and store it is the whole game:

• Let the device generate it. Accept the words the wallet produces on its own screen. Never use a phrase from a website, a shared list, or one someone gave you.
• Keep it offline. Do not photograph it, type it into a phone or computer, paste it into a password manager, or store it in the cloud. A phrase that touches an online device is a hot secret.
• Write it down, ideally on metal. Paper survives neither fire nor flood; steel backup plates exist for this reason. Store redundant copies in separate physical locations.
• Consider a passphrase. An optional BIP-39 passphrase (a "25th word") creates a separate hidden wallet, but if you forget it the funds are unrecoverable — there is no reset. Understand that trade-off before using it.
• Test recovery. Before funding heavily, wipe and restore from your backup, or restore onto a spare device, to prove the backup actually works.

Our step-by-step guide to backing up a seed phrase covers the mechanics in detail.

Security note: no legitimate wallet, exchange, or support agent will ever ask for your seed phrase or private key. Anyone who does is running a scam — including fake "wallet validation", "synchronisation", or "migration" prompts. There is no situation in which typing your seed into a website is correct.

Verifying the app is genuine. Attackers publish convincing fake wallet apps, cloned extensions, and sponsored search ads that lead to malware. Download only from the vendor's official domain or its officially linked store pages, confirm the developer name, and where the vendor publishes checksums or signatures, verify them. For hardware, buy directly from the manufacturer and run the device's built-in authenticity check — Trezor's device authentication and Ledger's genuine check exist precisely to catch tampered or counterfeit units. Our guide on how to verify a wallet app is genuine details the checks.

Keeping a wallet secure

Once a wallet is set up, the threat shifts. On self-custody wallets — especially browser extensions used with dApps — the dangerous moment is rarely someone stealing your key. It is you being persuaded to sign something. Three attack patterns dominate.

Approvals and drainers. To use most DeFi apps you grant a token approval — an on-chain permission letting a smart contract spend a specific token up to an allowance. Approvals persist until revoked, so a malicious or later-compromised contract with a standing allowance can drain that token at any time. Review and revoke stale approvals: revoking sends a transaction that sets the allowance back to zero. Tools like Revoke.cash list your active approvals across many networks; our walkthrough on how to revoke token approvals shows the process, and how wallet drainers work traces the full heist.

Signature phishing. Not everything you sign is an obvious transaction. Off-chain signatures — the ERC-2612 "permit", or an NFT setApprovalForAll — can authorise a contract to move your assets with no gas and nothing appearing on-chain at the moment you sign. Drainers exploit this because a signature request feels harmless next to a transaction. Read what you are signing: a request to approve a spender, permit a transfer, or set approval for all of a collection is granting spending power, not "logging in". Our explainer on signature phishing with permit, approve and setApprovalForAll breaks down each prompt.

Address poisoning. Attackers send tiny or zero-value transfers from an address engineered to share the first and last characters of one you use, so it appears in your history. Later you copy the recipient from history and paste the attacker's lookalike by mistake. Some explorers began hiding zero-value token transfers by default, but wallets and history views still surface them. Verify the entire address, not just the ends, and use a saved address book rather than copying from transaction history. See address poisoning explained.

Security note: your wallet's confirmation screen is the last honest checkpoint. On a hardware wallet, verify the recipient and amount on the device's own screen, not the computer's — malware can lie about what a transaction does right up until the device shows you the truth.

If you are compromised. Act on the assumption that on-chain transactions are irreversible: move any remaining assets to a fresh wallet with a new seed immediately, revoke approvals from the compromised address, and be aware that "recovery services" promising to reverse a theft are almost always a second scam. Our incident guide, what to do if your wallet is compromised, lists the steps in order, including reporting to bodies such as the FBI's IC3.

Routine hygiene. Security is a habit, not a one-time setup. Periodically review and revoke approvals you no longer use, disconnect wallets from dApps you have finished with, and keep a dedicated "burner" wallet with minimal funds for connecting to new or unaudited sites so your main holdings are never exposed to an unknown contract. Keep wallet and device firmware current, since updates patch real vulnerabilities, but install them only from official sources. Above all, slow down: nearly every drainer relies on urgency — a countdown, a "limited" mint, an airdrop expiring — to push you past the point where you would normally read the prompt.

Common wallet mistakes

Almost every avoidable loss is one of a short list of mistakes, and they repeat across beginners and experienced users alike. None of the fixes below require technical skill — they require treating a few specific moments with more suspicion than feels natural. The pattern to notice is that the costly errors cluster around two events: how you handle the recovery secret, and what you agree to sign.

1. Storing the seed phrase digitally. Photos, notes apps, cloud drives, and password managers are all reachable by malware or a cloud breach. Fix: keep the phrase strictly offline, on paper or metal.
2. Entering the seed into a website or app that asks for it. This is the single most common drain vector. Fix: never type your seed anywhere except when restoring into a genuine wallet on your own device — no legitimate service asks for it.
3. Granting unlimited approvals and never revoking them. A standing allowance to a contract that is later exploited drains that token. Fix: prefer limited approvals where possible and periodically revoke stale ones.
4. Blind-signing. Approving prompts without reading them means signing away spending power you did not intend. Fix: read every approval, permit, and transaction, and verify details on the device screen.
5. Buying a hardware wallet second-hand or from a marketplace. A tampered device or a pre-recorded "seed" can be waiting. Fix: buy direct from the manufacturer and run the authenticity check; only ever use a seed the device generates itself.
6. Copying the recipient from transaction history. Address poisoning relies on exactly this. Fix: verify the full address and use a saved address book.
7. Using an exchange as long-term storage. Custodial balances carry counterparty risk. Fix: keep only actively-traded funds on a platform and move the rest to self-custody.
8. Never testing recovery. An untested backup is a hope, not a plan. Fix: restore from your backup before you rely on it.
9. Keeping a single copy of the seed. One flood or fire and it is gone. Fix: keep redundant backups in separate secure locations.
10. Trusting unsolicited "support" in DMs. Fake support agents and recovery experts appear the moment you post about a problem. Fix: ignore unsolicited help; real support never messages first and never needs your keys.

Sources

• Ethereum.org — Crypto wallets
• Ethereum.org — Security and scam prevention
• Ethereum.org — Account abstraction
• Bitcoin.org — How it works
• BIP-39 — Mnemonic code for generating deterministic keys
• BIP-32 — Hierarchical deterministic wallets
• BIP-44 — Multi-account hierarchy for deterministic wallets
• BIP-174 — Partially Signed Bitcoin Transaction format
• Ledger — Why secure elements matter for hardware-wallet security
• Trezor — Secure elements in Trezor Safe devices
• CoinDesk — Ledger postpones key-recovery service after criticism
• Coldcard — Air-gap signing methods
• Safe{Wallet} — What is Safe
• Safe{Wallet} — Choosing a signer setup and threshold
• Argent — About wallet recovery (guardians)
• ZenGo — What is an MPC wallet
• Revoke.cash — What are token approvals
• Revoke.cash — How to revoke token approvals
• MetaMask — Address-poisoning scams
• FIDO Alliance — Passkeys and phishing-resistant authentication
• FBI Internet Crime Complaint Center (IC3)