Lesson 5 of 6 · 7 min

Wallets and Private Keys

A crypto wallet doesn’t hold coins. Coins are records on a blockchain. The wallet stores what lets you dispose of them: the private key.

Three things to tell apart

• The private key is a long secret number you use to sign transactions. Whoever has it can spend the funds.
• The public key is derived mathematically from the private one, but cannot practically be calculated in the opposite direction.
• The address is derived from the public key, and you can freely give it to others, just as you give out an IBAN. The difference is that everything linked to an address is publicly visible.

Because long numbers would be hard to copy by hand, most wallets show them as a seed phrase (recovery phrase): most often 12 or 24 ordinary words. From that phrase the wallet can calculate all of your keys. If a device breaks, you enter the phrase into a new wallet and access is restored. If someone else enters it, they have access too.

Who holds the keys?

Custodial wallet: the exchange holds the keys. You log in with an email and password, and your balance is a record in its books. You can recover a forgotten password, but you depend on the company: its solvency, its honesty and its rules. Examples are the Japanese exchange Mt. Gox, which stopped operating in 2014 after losing a large quantity of bitcoin, and FTX, which collapsed in November 2022. Clients waited for years and depended on bankruptcy proceedings.

Self-custody wallet: you hold the keys yourself. Nobody can freeze your access on an exchange, but nobody can restore it for you either. You cannot report a mistake in safeguarding the phrase to customer support, because there is none.

Self-custody wallets are divided by whether the key sits on a device connected to the internet. A hot wallet (an app or browser extension) is convenient but exposed to malware. A cold wallet, usually a hardware device, keeps the key away from the computer and signs transactions inside the device. It is harder to compromise remotely, but it too can be lost, and the user can still sign a fraudulent transaction.

Follow us on Facebook