What Is a Wallet — and Why You Control It

A wallet is not what you think

When most people hear the word "wallet," they picture something that holds money. A leather fold with bills inside it. A digital payment app with a balance. That mental model is reasonable, but it is completely wrong when it comes to crypto.

A crypto wallet does not hold your money. It does not store your tokens. It does not contain your balance. What it stores is something far more important: your keys. Specifically, the cryptographic keys that prove you are the rightful owner of assets recorded on a blockchain.

Think of it this way. Your email password does not "store" your emails. Your emails sit on servers operated by Google or Microsoft or whoever provides your email service. Your password simply proves that you are the person authorized to access that inbox. If someone else gets your password, they can read your messages, send emails as you, and lock you out — but at no point were your actual emails "inside" the password.

A crypto wallet works the same way. The blockchain is the server. Your tokens are the emails. Your wallet is the password that proves you can access them. The crucial difference is that in crypto, there is no "Google" in the middle. There is no company that can reset your password, verify your identity, or recover your account. You hold the keys. You are the only one who can use them. If you lose them, no one can help you get them back.

This is what people mean when they talk about "self-custody." You are the custodian of your own assets. Not a bank. Not an exchange. Not a company. You. And that single idea — that you can own and control financial assets without asking anyone for permission — is the foundation of everything that follows in this course.

Public keys and private keys

Every crypto wallet is built on a pair of cryptographic keys. Understanding these two keys is essential because they define how ownership and access work on a blockchain.

Your public key — or more precisely, the wallet address derived from it — is the one you share with others. It functions like an email address. When someone wants to send you crypto, you give them your wallet address. Anyone can look it up on a blockchain explorer and see what assets are associated with it. Sharing your public address is perfectly safe. It cannot be used to take your funds.

Your private key is the one you never share with anyone, under any circumstances. It functions like your email password — except there is no "forgot password" link. Your private key is a long string of characters (usually 64 hexadecimal characters) that mathematically proves you own the assets at your public address. When you send a transaction, your wallet uses the private key to create a digital signature that the blockchain verifies. Without that signature, no one can move your funds.

The relationship is one-directional: your public key is derived from your private key through a mathematical function that is easy to compute in one direction but practically impossible to reverse. This means anyone who has your private key can derive your public key and access your funds, but no one who only has your public key can work backward to discover your private key.

Here is a simple comparison that makes the relationship clear:

The last row is the most important one. In email, if you forget your password, you can verify your identity through a phone number, a backup email, or customer support. In crypto, there is no recovery flow. Your private key — or the seed phrase that generates it — is the only way to access your funds. There is no alternative.

What is a seed phrase

When you create a new wallet, the software generates something called a seed phrase (also known as a recovery phrase or mnemonic phrase). This is a sequence of 12 or 24 ordinary English words — for example, "apple river mountain clock silver notebook gate horizon puzzle garden frost breeze."

These words are not random poetry. They are a human-readable encoding of the master key from which all of your private keys are mathematically derived. One seed phrase can generate an essentially unlimited number of wallet addresses and private keys, all linked back to that same set of words.

It is critical to understand that your seed phrase is not a "backup" in the way most people think of backups. When you back up your phone photos to the cloud, you are creating a copy. The original photos still exist on your phone. A seed phrase is different. The seed phrase IS your wallet. The app on your phone or computer is just a window into it. If your phone breaks, you can enter your seed phrase into any compatible wallet app on any device, and all your assets will appear — because they were never "on" your phone in the first place. They were always on the blockchain, accessible to whoever holds those words.

This also means that anyone who obtains your seed phrase has complete and immediate control over everything in your wallet. There is no two-factor authentication protecting it. There is no notification that someone else has imported it. There is no way to "revoke" a compromised seed phrase except to create a brand-new wallet and move all your assets to it as fast as possible — assuming the attacker has not already drained them.

These rules may sound extreme, but they match the reality of self-custody. There is no fraud department to call. There is no insurance. If someone gets your words, they get your money, and there is nothing anyone can do about it.

Types of wallets

Not all wallets work the same way. They differ in where your private keys are stored, how they connect to the internet, and who ultimately controls access. Understanding these differences helps you choose the right tool for what you are doing.

Hot wallets are the most common starting point. If you are learning DeFi with small amounts — say five to fifty dollars — a hot wallet like Rabby or MetaMask is perfectly fine. It installs as a browser extension, generates your keys in seconds, and lets you interact with decentralized applications immediately. The risk is real but proportional: if you are only holding a small amount while learning, the convenience outweighs the security trade-off.

Hardware wallets become important when you start holding amounts you would not want to lose. The key advantage is that your private key never leaves the device. When you want to send a transaction, your computer sends the unsigned transaction to the hardware wallet, the device signs it internally, and sends back only the signed result. Even if your computer is infected with malware, the attacker cannot extract your private key because it never appears on the computer.

Exchange wallets are not really "your" wallet at all. When you buy crypto on Coinbase or Binance and leave it there, the exchange holds the private keys. You access your funds through a traditional username-and-password account. This is convenient and familiar, but it means you are trusting the exchange to be honest, solvent, and secure. The crypto community summarizes this with a phrase: "Not your keys, not your crypto." If the exchange gets hacked, goes bankrupt, or freezes your account, you may lose access to your funds — and history shows this has happened repeatedly.

Your wallet across networks

Blockchains are independent networks, each with their own set of validators, transaction history, and rules. Ethereum, Solana, Arbitrum, Base, Polygon — these are all separate networks. Your wallet needs to connect to each one individually.

The good news is that a single seed phrase can work across multiple networks. When you set up a wallet with one seed phrase, the wallet software can derive different addresses for different networks from that same master key. However, your address may look different on each network, and your assets on one network are completely separate from your assets on another.

Some wallets are built to work across many networks. Others specialize in one ecosystem. Here is how the most popular wallets compare:

If you are just starting out, pick one wallet and one network. Rabby on Ethereum (or an Ethereum Layer 2 like Arbitrum or Base) is a solid choice. You can always add more networks later. The important thing is to understand that your wallet address on Ethereum is not the same account as your wallet address on Solana — even if both were generated from the same seed phrase.

What happens when you "connect" a wallet

You will encounter this constantly in DeFi. You visit a website — a decentralized exchange, a lending platform, a portfolio tracker — and it says "Connect Wallet." What exactly happens when you click that button?

When you connect your wallet to a website, you are sharing your public address. That is it. The site can now see which tokens you hold, your transaction history, and your balances — all of which is already publicly visible on the blockchain anyway. Connecting your wallet does not give the site any ability to move your funds or access your private key.

The critical distinction is between connecting and signing. Connecting is passive — it is like showing someone your business card. Signing is active — it is like putting your signature on a contract. When a site asks you to sign a transaction, you are authorizing a specific action: sending tokens, approving a smart contract to spend your tokens, or interacting with a protocol. Your wallet will show you a confirmation popup describing what the transaction does, and nothing happens until you explicitly approve it.

This is why reading transaction details matters. Most of the time, the transaction does exactly what you expect — swap these tokens, deposit into this pool, approve this contract. But malicious sites can craft transactions that do something different from what the interface implies. A swap page might actually be asking you to approve unlimited spending of your tokens. A "claim airdrop" button might be asking you to transfer your NFTs.

The rule is simple: always read what your wallet asks you to sign. If you do not understand the transaction, do not sign it. If a site asks you to sign something that looks different from what you expected, close the tab. Legitimate applications will never rush you or pressure you into signing something you do not understand.

Common mistakes and how to avoid them

Most crypto losses are not caused by sophisticated hackers breaking encryption. They are caused by ordinary people making preventable mistakes. Here are the most common ones and how to avoid them.

Sharing your seed phrase. This is the number one cause of crypto theft. The attack is almost always social engineering — someone pretending to be support, a fake website asking you to "verify" your wallet, a DM on Discord claiming you won a prize. No legitimate wallet, protocol, or company will ever ask for your seed phrase. If someone asks for it, they are trying to steal from you. Full stop.

Signing malicious transactions. Every transaction your wallet asks you to confirm deserves scrutiny. Be especially careful with "approval" transactions — these grant a smart contract permission to spend your tokens. A legitimate swap on Uniswap might ask you to approve the Uniswap contract to spend your USDC. That is normal. But a random airdrop site asking you to approve unlimited spending of all your tokens is a red flag.

Using the same wallet for everything. Many experienced users maintain separate wallets for different risk levels. They might use one wallet for holding long-term savings (ideally a hardware wallet), another for regular DeFi activity, and a third "burner" wallet for trying new protocols or claiming airdrops. If the burner wallet gets compromised, the other wallets are unaffected because they have completely separate keys.

Not checking token approvals. When you approve a smart contract to spend your tokens, that approval often stays active indefinitely — even after you have finished using the protocol. Over time, your wallet may have dozens of active approvals, any of which could become a vulnerability if the approved contract is compromised. Periodically reviewing and revoking unnecessary approvals is good security hygiene.

Simulation: What happens if someone gets your seed phrase

To understand why everything above matters, let us walk through exactly what happens when a seed phrase is compromised. This is not theoretical — it happens to real people every day.

Step 1: The attacker obtains your seed phrase. Maybe you typed it into a fake MetaMask support page. Maybe someone photographed the piece of paper on your desk. Maybe you stored it in your iCloud notes and your Apple account was compromised. However it happens, someone now has your 12 or 24 words.

Step 2: They import it into their own wallet. This takes about thirty seconds. They open any wallet application — MetaMask, Rabby, Phantom, anything compatible — and select "Import wallet using seed phrase." They type in your words. The wallet derives all of your private keys and addresses automatically.

Step 3: They see everything you own. Every token. Every NFT. Every position in every DeFi protocol. All of it appears in their wallet, because the same seed phrase generates the same keys, which control the same addresses on the blockchain.

Step 4: They transfer everything to their own address. They send your ETH, your stablecoins, your governance tokens, your memecoins — everything that can be moved, they move. This might take a few minutes for multiple transactions across multiple networks, but there is nothing stopping them.

Step 5: You can do nothing. You might not even realize what happened until you open your wallet and see zero balances. There is no bank to call. There is no fraud protection. There is no chargeback. The transactions are final and irreversible, recorded permanently on the blockchain. The police can file a report, but recovering stolen crypto is exceptionally rare.

This scenario is not designed to scare you away from crypto. It is designed to make you take seed phrase security seriously from day one. Self-custody is powerful. It means no one can freeze your account, censor your transactions, or prevent you from accessing your own money. But that power comes with responsibility. You are the only line of defense, and the defense is straightforward: protect your seed phrase, read what you sign, and use the right wallet for the right purpose.