Crypto Wallets: Custody, Types and Security

A crypto wallet does not hold coins. The coins exist only as entries on a blockchain; the wallet holds the private keys that allow those entries to be moved. Whoever controls the keys controls the assets. This page explains the types of wallet, how their security works and which mistakes cost money most often. It does not recommend specific products.

Custodial or self-custody

• Custodial wallet. An exchange or app manages the keys. Logging in works like online banking, and a forgotten password can be reset. The customer depends on the provider staying solvent and honest, as described on the page about crypto exchanges .
• Self-custody wallet. The keys stay with the owner. No company can freeze or lose the coins, but no one can restore access either. Losing the keys means losing the assets for good.

The choice is a trade between two risks: trusting a company, or trusting one’s own care.

Hot and cold wallets

A hot wallet is software on a phone, computer or in a browser that is connected to the internet. It is convenient for frequent transactions and exposed to malware and phishing. A cold wallet keeps the keys offline, usually on a hardware device that signs transactions internally, so the key never touches an internet-connected computer. Paper backups of the keys also count as cold storage. Many owners split holdings: a small amount in a hot wallet for daily use, the rest offline.

The seed phrase

Most wallets derive all keys from a recovery phrase of 12 or 24 words, based on a common standard (BIP-39). Anyone who knows these words can rebuild the wallet on any device and move the coins. Some rules follow from that:

• The phrase is written down offline and kept in a place protected from fire and water, not stored as a photo or in cloud notes.
• No legitimate support team, exchange or wallet provider ever asks for it.
• An optional additional passphrase creates a separate wallet; without it, the words alone are not enough, but forgetting it has the same effect as losing the phrase.

For larger amounts, multi-signature setups require several keys to approve a transaction, so a single lost or stolen key is not fatal.

Common scams

• Phishing. Fake websites, apps or emails imitate a wallet provider and ask for the seed phrase or a login.
• Fake support. Accounts on social media or messaging apps offer help with a problem and then request the recovery phrase or remote access.
• Malicious approvals. On decentralized apps, signing a contract permission can allow a “wallet drainer” to move tokens later. Permissions can be reviewed and revoked.
• Address poisoning. Attackers send tiny amounts from an address that looks similar to one used before, hoping the victim copies it from the transaction history.
• Clipboard malware. Malicious software swaps a copied receiving address for the attacker’s address.

Checking the first and last characters of an address before sending, and testing with a small amount, prevents many of these losses.

Rules for transfers in the EU

Since 30 December 2024, the EU Transfer of Funds Regulation also covers crypto-assets. Regulated providers must send and receive information about the sender and recipient with every transfer. When coins move between an exchange and a self-custody wallet and the amount exceeds 1,000 euros, the provider has to verify that the wallet belongs to its customer, for example through a signed message or a small test transfer.