Wallets & Self-Custody

Hot vs Cold Wallets

Your coins are entries on the blockchain. A wallet just stores the private key that proves those entries are yours. The big choice is where that key lives. A hot wallet (MetaMask, Phantom, a mobile app) is connected to the internet — convenient for daily use, but exposed to phishing, malware, and malicious apps. A cold wallet (Ledger, Trezor) keeps the key on a sealed offline device; you approve each transaction by pressing a physical button.

• Hot wallet — software, always online. Great for small, active balances and DeFi.
• Cold wallet — hardware, key stays offline. Best for long-term savings you rarely touch.
• Golden line — never type your seed phrase into any website, never message it, never photograph it. No legitimate company ever asks for it.

The most important thing a hardware wallet does is keep the private key inside a secure element — a tiny tamper-resistant chip, the same family of chip used in passports and bank cards. The secret never leaves that chip. When you approve a transaction, the app on your laptop hands the unsigned transaction to the device; the chip signs it inside itself and hands back only the finished signature. So even if your computer is riddled with malware, the malware sees a signature but never the key that made it. This is called air-gapped signing, and it's the whole reason a $79 device protects six-figure balances.

There's one modern trap even cold wallets can't fully block: blind signing. If a wallet just shows you a wall of hex code instead of plain words like "send 0.5 ETH to this address," you can't tell what you're approving. Good wallets now show a human-readable summary; when yours doesn't, that's your cue to stop. This is exactly the kind of pre-signature check Brigitte leans on before any swap.

• Secure element — a certified chip that signs inside itself; the key is designed to be physically unextractable.
• Approve on the device — the little screen and buttons exist so the machine you trust least (your internet-connected computer) never sees the secret.
• Read before you sign — an address, an amount, a token. If a wallet only shows raw hex, treat it as a red flag, not a formality.

The Seed Phrase Is the Wallet

Most wallets generate a 12 or 24-word recovery phrase (the BIP-39 standard). Those words deterministically regenerate every private key under that wallet. If your phone falls in a river, you buy a new device, type the words, and recover everything. If a stranger reads those words, they can recover everything too. The phrase is the wallet.

The words aren't random poetry — they come from a fixed list of 2,048 English words (the BIP-39 wordlist), and the list is deliberately built so no two words share the first four letters. That means your device only needs those first four letters to know which word you meant, which makes recovery forgiving of typos. Behind the scenes, your wallet rolled a giant random number — 128 or 256 coin-flips' worth of pure entropy — and chopped it into chunks of 11 bits each; every chunk points to one word. Even the last word is special: part of it is a built-in checksum, so if you write down a wrong word, the wallet can often tell you the phrase is invalid instead of silently opening an empty account.

Because that number is astronomically large — a 12-word phrase has more possible combinations than there are atoms in a mountain — nobody guesses their way in. Every real theft happens because a human handed over the words: typed them into a fake site, saved them to the cloud, or photographed them. The math is unbreakable; people are the soft spot.

• Entropy is the source — the security comes from true randomness at creation, not from the words themselves.
• The checksum word — the final word double-checks the rest, so a single transcription error usually gets caught.
• Optional passphrase (the "25th word") — advanced users add a secret word of their own on top; it creates a separate hidden wallet, but lose it and those funds are gone with no recovery.

The Golden Rules

There is no situation where a legitimate company, support agent, or "wallet validator" needs your seed phrase. Anyone who asks is trying to rob you. Keep the phrase offline and physical, and the most common attacks simply can't reach you.

• Never type it into any website — not even one that looks like your wallet.
• Never send it in a message, email, or chat.
• Never photograph it or keep it in a screenshot, notes app, or the cloud.

Attackers almost never "crack" a wallet — they trick a person into signing. The three big cons are worth naming so you can spot them mid-attack. First, the approval trap: a shady dApp asks you to sign an approve that quietly grants unlimited permission to move one of your tokens forever; weeks later a bot drains it. Second, address poisoning: a scammer sends you a tiny worthless transaction from an address that looks almost identical to one you use, hoping you'll later copy their address from your history instead of the real one. Third, the oldest of all — fake support: someone in a Discord DM offers to "sync" or "validate" your wallet and asks for your phrase.

Two habits neutralize most of it. Keep a separate "burner" wallet with a little gas money for connecting to new, unproven apps, so a bad approval can only reach pocket change. And periodically visit a revocation tool (like revoke.cash) to cancel old approvals you no longer need — it lists every contract that can touch your tokens and lets you switch them off.

• Unlimited approvals age badly — a permission you granted a year ago is still live today. Revoke what you don't use.
• Copy addresses from the source, never your history — that's how address-poisoning gets you.
• "Support" never DMs first — real teams don't slide into your messages, and none of them ever need your seed.

Custodial vs Self-Custody

Funds on an exchange like Coinbase or Binance are custodial — the exchange holds the keys for you. That's convenient for buying with cash, but if the exchange freezes withdrawals or fails, you can lose access to your own money. Self-custody means you hold the keys and the responsibility: no support line, and no password reset on the funds themselves. Lost keys equal lost coins, period.

When your coins sit on an exchange, you don't actually own coins — you own an IOU, a promise the exchange will give them back when you ask. That's fine until it isn't. The 2022 collapse of FTX is the textbook lesson: customers thought their crypto was sitting safely in their accounts, but the company had quietly lent it out and gambled with it. When everyone tried to withdraw at once — a bank run — the coins weren't there, and roughly eight billion dollars of customer money evaporated. Every dollar of it was self-custodiable. "Not your keys, not your coins" stopped being a slogan and became a eulogy.

The grown-up answer isn't "never use exchanges" — it's use them for what they're good at and don't leave money parked there. Exchanges are excellent on-ramps: turning dollars into crypto. Once you've bought, withdraw meaningful amounts to a wallet you control. A useful test before trusting any custodian: does it hold proof of reserves, is it regulated somewhere real, and would you be okay if you couldn't withdraw for a month? If any answer is shaky, sweep to self-custody.

• An account balance is a promise — self-custody is possession. Only one survives the custodian failing.
• Withdraw after you buy — treat exchanges as a doorway, not a vault.
• Counterparty risk stacks silently — the same lesson applies to "earn" products and lending apps that pay yield on your idle coins.

A Practical Setup

A common, healthy setup splits your crypto by job. And remember: your device password is just a local lock on that one device. As long as you have the seed phrase, you can reinstall any wallet and re-import everything — the password never touches the funds.

A good practical rule is the 3-2-1 backup, borrowed from professional data protection: keep 3 copies of your seed, on 2 different kinds of media, with at least 1 stored somewhere else physically. In practice that might be a metal plate in a home safe, a second metal plate at a trusted relative's house, and the wallet device itself. Paper is fine until there's a fire or a flood — which is why serious holders stamp their words into steel. The goal is a setup that survives a house fire, a burglary, and your own bad memory a decade from now.

There's a harder problem nobody likes to think about: what happens to your crypto if something happens to you? Because there's no company and no password reset, an unshared seed phrase means the funds are gone forever. Thoughtful holders leave sealed instructions with a lawyer or a trusted person — enough to recover the funds, split so no single person can quietly take them. Newer multisig and social-recovery wallets automate this: they require, say, 2 of 3 keys to move money, so losing one key isn't fatal and no single person holds total control.

• 3-2-1 — three copies, two media types, one off-site. Simple, and it defeats fire, flood, and theft together.
• Steel over paper — for any serious balance, a metal backup is cheap insurance against the elements.
• Plan for inheritance — an unshared seed is a promise your family can never collect. Multisig or sealed instructions solve it without exposing the phrase today.