In simple terms — A crypto wallet does not hold coins like a physical wallet. The assets remain recorded on the blockchain; the wallet manages keys and prepares the signatures used to control associated addresses.
The term covers very different products: mobile and browser applications, hardware devices, exchange-integrated services, and systems with several signers. An interface may show balances and history, but those data come from the network or a service that indexes it. An identical screen does not imply the same custody model.
Who controls the keys
A private key can produce valid digital signatures. In many systems, a public key is used to derive an address that can receive assets; knowing the address alone does not allow someone to spend them. The wallet builds a transaction request, presents available details, and asks the user to authorise a signature.
With a self-custody wallet, the user directly controls the keys or a mechanism that replaces them. In a custodial service, the provider may control the keys and record the user's balance in its own system. In that case, account access and an on-chain transfer are not the same operation.
Software, hardware, hot, and cold
A software wallet signs on a connected device. A hardware wallet aims to keep secret material inside a dedicated component and display details for confirmation. Hot and cold mainly describe network exposure; neither label certifies security. An offline device can still be used unsafely if its backup, firmware, or address-verification process is compromised.
Many wallets derive several accounts from a recovery phrase. The seed phrase is not the app password: someone who obtains it may recreate the derived keys, as explained in seed phrase theft. Other systems use multiple signatures, hybrid custodians, or social recovery. Each design changes both theft risk and loss-of-access risk.
Signing without understanding is the central risk
Before sending, verify network, asset, address, amount, and cost. For a material amount, a test transfer can check format and network, but it does not guarantee the following transaction. A dApp may also request persistent approvals or signatures whose effects are less obvious than a simple payment: a wallet-drainer exploits permissions granted by the user.
The wallet is therefore a control point, not protection against every error, malware, phishing attempt, or risky contract. The decentralized finance map shows where wallets, custody, and protocols meet.
Sources
- NIST IR 8301 — Blockchain Networks: Token Design and Management Overview — Distinguishes tokens, wallets, transactions, interfaces, and self-hosted, externally hosted, and hybrid custody models.
- IOSCO — Policy Recommendations for Crypto and Digital Asset Markets — Frames custody, client-asset protection, conflicts, and operational risks in crypto services.
Links
Self-custody · Seed phrase theft · Wallet drainer · Stablecoin