MECHANISM
How a wallet actually works, and what a wallet is not
A wallet holds no coins. Once that sentence is genuinely understood, custody, backups and most of the scams stop being separate topics.
The sentence that does most of the work
A crypto wallet does not contain your coins. It contains keys. The coins — to the extent the word means anything — are entries in a ledger that thousands of machines keep a copy of, and your keys are the only thing that can authorise a change to the entries assigned to you.
This is not a pedantic distinction. Almost every practical question people have turns on it. Why can the same wallet be restored on two phones at once? Because neither phone held anything; both derived the same keys. Why does deleting the app not destroy your money? Same reason. Why is a screenshot of your recovery phrase as dangerous as handing someone your bank card and PIN? Because the phrase is not a reminder of where the money is. It is the money's only lock, and a photograph of a lock is a working copy of it.
Keys, addresses, and the direction they work in
A private key is a very large number. From it, a public key is derived by a one-way operation, and from the public key an address is derived by another. The arrows only point one way: given the private key you can compute the address in milliseconds, and given the address you cannot compute the private key before the sun burns out.
That asymmetry is the entire security model. You can publish an address on a billboard and lose nothing. Publish the private key for a fraction of a second anywhere — a support chat, a cloud backup, a photo library that syncs — and the funds are gone, usually within minutes, because there are automated systems doing nothing but watching for exactly that.
What a seed phrase actually is
Modern wallets do not store one key. They store a seed — usually presented as twelve or twenty-four ordinary English words — from which an effectively unlimited tree of keys is derived by a published algorithm. The words come from a fixed list of 2,048, which is why a misspelling is detectable and why the order matters as much as the words themselves.
Two consequences follow, and they are the two people get wrong. First, the phrase is not specific to the app that showed it to you: any wallet implementing the same standard can restore it, which is what makes the phrase portable and also what makes it dangerous. Second, there is no recovery process, no support desk and no override. The words are not a hint that lets a company verify you. They are the credential itself.
Custodial and non-custodial, stated without the slogans
When you hold coins on an exchange, the exchange holds the keys and you hold a claim against the exchange. That is a real, enforceable-in-principle relationship with a company, with the ordinary risks of any such relationship: it can freeze your account, it can be hacked, it can fail, and it can be compelled by a court.
When you hold your own keys, none of those risks apply and a different one replaces them entirely: you. There is no fraud department, no chargeback and no reset. Both arrangements are defensible for different amounts and different people, and anyone who tells you one of them is simply correct is selling something — including the people selling hardware wallets.
For active traders, the modern architecture bridging custody and execution is non-custodial API automation. Rather than depositing funds into an opaque third-party platform or sending crypto to a Telegram bot, you keep assets inside your own verified exchange account, generate an API key with withdrawal rights strictly disabled, and let automated algorithms execute trades. Our affiliated platform Segnals is built around this exact principle: algorithmic trading bots execute disciplined strategies while custody of your funds remains 100% under your control. For German and European traders seeking a guided, step-by-step curriculum to deploy these automated systems, KI Academy provides structured blueprints with demo-mode testing.
What a wallet is not
It is not a bank account, because nothing is held. It is not an investment product, because it does nothing but sign. It is not a vault, because a vault protects an object and this protects a number. And it is not proof of ownership in any legal sense — possession of the key is the whole of it, which is why the word "stolen" is so much less useful here than it is elsewhere.
Addresses are not accounts, and reuse leaks more than people expect
An address is not an account you own in the way an email address is. On most chains you can generate an effectively unlimited number of them from the same seed, and wallets do this automatically — which is why the "receive" screen often shows a different address each time and why that is not a malfunction.
The reason is privacy rather than security. Every transaction is public forever. If you reuse one address for your salary, your exchange withdrawals and a payment to a shop, anyone who learns one of those connections can read the rest of your financial history backwards. Fresh addresses do not make you anonymous — analysis firms are good at clustering — but reuse removes even the modest privacy the design offers, and it is free not to reuse.
Fees, and why a transaction can sit unconfirmed
A transaction is a request, not a settlement. It is broadcast, sits in a queue, and is included in a block when someone chooses to include it — and they choose by fee. When the network is busy, a transaction with a low fee can sit for hours or be dropped entirely.
This matters practically because it produces the most common moment of panic in the subject: money has left the wallet and arrived nowhere. In almost every case it has not been lost; it is queued. Most wallets can replace a stuck transaction with a higher-fee version of the same one. What you must not do in that moment is send it again from somewhere else, which is how one stuck payment becomes two real ones.
The practical upshot
If you remember one thing: the phrase is not a backup of your wallet, it is your wallet. Treat any request to type it anywhere — a support agent, a "wallet validation" page, a browser extension, a migration tool — as final proof of fraud. There is no legitimate circumstance in which a piece of software you did not deliberately open needs those words, and there is no exception.
Last reviewed: 11 September 2026