What Is A Crypto Wallet, And Who Controls The Keys?

You replace a broken phone, install your wallet again and want your crypto back on the screen. Did the coins disappear with the old device?

The assets were never inside the phone. They are recorded on the blockchain, the network's shared transaction record. The wallet helps you see them and, when it has the required authority, spend them.

What matters is whether you can recover that authority. A password reset and a wallet recovery phrase do very different jobs.

What does the wallet actually do?

A wallet is software or a device that helps you use a blockchain account or the coins you can spend. It can show a balance, prepare a payment and send the signed transaction to the network.

A private key is secret information used to create a digital signature. That signature lets the network check that a transaction was authorised, without receiving the private key itself. Bitcoin's wallet documentation explains how keys and signing work.

An address is the destination you share to receive a payment. Your private key is what must stay secret. Knowing someone's receiving address does not give you permission to spend their coins.

The word wallet can cover several pieces working together. A phone app might prepare a transaction while a separate hardware device signs it. A wallet can also be set up just to watch a balance, without the keys needed to spend it.

Who controls the keys?

Imagine two apps showing the same amount of crypto. In one, you control the keys. In the other, a company holds the assets for you. The screens might look similar, but moving the money works differently.

With self-custody, you control the means of approving transactions. You can sign a payment without asking a company to process a withdrawal. You also take responsibility for protecting that authority and its backup.

With custody, the company controls the keys and you access its service through an account. Your withdrawal request asks it to send funds. It may offer a familiar login recovery process, but you depend on its security, honesty and ability to provide access.

An exchange can freeze withdrawals or run into financial trouble. Self-custody avoids that particular dependency, but a stolen key or missing backup can leave you with no company able to put things right. Neither arrangement makes every other risk disappear.

What happens when your phone breaks?

For a wallet that uses a recovery phrase, the phrase can recreate the keys on a compatible wallet. It is a backup of access, rather than a copy of coins being moved from the broken phone.

Some wallets give you 12 or 24 words. One standard, BIP-39, turns computer-generated randomness into a word sequence, which is used to derive keys. It is not an invitation to invent a memorable sentence yourself.

Not every wallet uses this method. Some need a wallet file backup. Other setups require several approvals. Recovery depends on the wallet's design, so the instructions for that wallet matter more than a general rule about saving some words.

A BIP-39 wallet can also use an extra passphrase alongside its recovery words. The same words with a different passphrase create different keys. In that setup, keeping the words but losing the passphrase is not enough to recover the intended wallet.

An app's unlock password may only protect access on that device. Ethereum's wallet guide distinguishes exchange account recovery from managing your own keys. Being able to reset a login does not mean a provider can replace a lost private key.

Is a hardware wallet different?

A hardware wallet keeps the signing keys on a separate device, away from the connected phone or computer. The computer can prepare a transaction, and the device can authorise it without handing over its private keys.

That separation helps protect against a compromised computer. It does not make every payment request safe. If you approve a transaction sending funds to a scammer, keeping the key secret does not undo that approval.

“Hot” and “cold” describe whether keys are kept on a connected system or offline. “Custodial” and “self-custodial” describe who controls them. These labels answer different questions. Ethereum's wallet overview describes the different forms an app or signing device can take.

What can still go wrong?

A recovery phrase that can restore your wallet can also let someone else restore it. A fake support agent asking for those words is asking for access to your assets. Ethereum's security guidance warns against sharing recovery phrases or private keys.

You can also lose assets without revealing a key. On Ethereum, an approval can let a smart contract, a program running on the network, spend tokens within an allowance. A harmful approval may give it far more access than you intended. The same security guide explains why spending limits matter.

A backup protects against losing a device. Keeping that backup secret protects against someone else taking control. Those are two separate problems, and a wallet needs to account for both.