Crypto Wallet: What It Is and How It Works

How a crypto wallet works

Every blockchain account is controlled by a pair of keys:

• a private key, a large secret number that authorizes spending;
• a public key, mathematically derived from it, from which the wallet address you share with others is computed.

When you create a wallet, the software generates a private key from strong randomness and, in almost every modern wallet, encodes the master secret as a seed phrase of 12 or 24 words. From that one seed the wallet can derive an unlimited number of addresses, a design called a hierarchical deterministic (HD) wallet, standardized in Bitcoin's BIP-32 and BIP-39 proposals and now used across most chains.

To send funds, the wallet builds a transaction (recipient, amount, network fee), signs it with the private key and broadcasts it to the network. Nodes check the signature, and once miners or validators include the transaction in a block, the balance moves. Nobody, including the wallet maker, can reverse a valid signed transaction.

This is why the phrase "not your keys, not your coins" is common: control of the key is ownership, as far as the blockchain is concerned.

On Bitcoin and Ethereum a private key is a random 256-bit number. The number of possible keys is so large that guessing a properly generated key is not practical; the real risks are theft or loss of the key or seed phrase.

Two account types are worth knowing on Ethereum: externally owned accounts (EOAs), controlled directly by a private key (the classic MetaMask account), and smart-contract accounts, whose rules are code and can add recovery or spending limits.

Types of crypto wallets

Wallets are sorted along two independent lines: who holds the keys and whether the keys touch the internet.

• Hot wallets are convenient for daily use and DeFi, but the keys live on a connected device, so malware and phishing are the main threats.
• Cold wallets keep keys offline and sign transactions in isolation; they suit larger, long-term holdings.
• Custodial wallets remove the burden of key management but add the risk that the provider fails, freezes withdrawals or is hacked.
• Smart-contract wallets (account abstraction on Ethereum) add features such as multi-signature approval, spending limits and social recovery. MPC wallets split the key into shares held by different parties or devices.

A short history

The first Bitcoin wallet was part of the original Bitcoin software released by Satoshi Nakamoto in January 2009: it stored a file of loose keys on the user's computer, which had to be backed up after every few transactions. HD wallets and mnemonic seed phrases, introduced through Bitcoin's BIP-32 and BIP-39 standards, replaced that with a single backup.

Dedicated hardware signers, browser-extension wallets for smart contracts and mobile wallets followed as Ethereum and DeFi grew. More recent designs focus on making self-custody easier through smart-contract accounts, passkeys and multi-party computation.

A timeline of how wallets changed:

• 2009: the first Bitcoin wallet was part of Satoshi Nakamoto's original client, a desktop program that was node and wallet in one.
• 2014: the collapse of Mt. Gox, then a major exchange, showed the danger of leaving coins in custodial accounts. The same year SatoshiLabs' Trezor, generally cited as the first commercial hardware wallet, appeared; Ledger's Nano S followed in 2016.
• 2016: MetaMask launched as a browser extension and became the default way to use Ethereum apps. Mobile wallets such as Trust Wallet and, later, Phantom for Solana, and extensions such as Rabby followed.
• 1 March 2023: the EntryPoint contract for ERC-4337 went live on Ethereum mainnet, enabling account abstraction without a protocol change. Smart-contract wallets such as Safe (formerly Gnosis Safe) and Argent, and newer passkey-based wallets, can offer social recovery, multisignature approval and gas paid by a third party.
• MPC wallets split a key into shares held by several parties or devices, so that no single device ever holds the whole key.

How to keep a wallet safe

• Back up the seed phrase offline, on paper or metal, and store it where only you can reach it. Anyone who sees it can empty the wallet.
• Never type the seed phrase into a website, chat or form. Legitimate wallets and support staff never ask for it.
• Split holdings by purpose: a hot wallet for small, active amounts and a cold wallet for savings.
• Check addresses before sending, including the first and last characters, and send a small test amount first for large transfers.
• Review token approvals in DeFi. A malicious approval lets a contract drain tokens without a new signature; avoid blind signing.
• Download wallets only from the official site or store listing, since fake wallet apps are a common scam.

If you keep funds on an exchange, you rely on its security and solvency rather than your own; the choice between convenience and control is yours to make.

Approvals are a common phishing route: signing an approval lets a contract move your tokens later, sometimes without limit. Review and revoke old approvals, and read what you sign.

A typical first setup: a new user installs a wallet, writes the 12- or 24-word seed phrase on paper and keeps no digital copy, buys crypto on an exchange and withdraws it to their own address. From there they can connect to apps such as a DEX or a lending market directly. At no point does a company hold their funds, which is the core idea of self-custody, and also why there is no support desk to recover a lost seed phrase.

Wallet vs exchange account

An exchange account shows a balance in the exchange's database, and the exchange controls the underlying keys. A non-custodial wallet gives you the keys directly: you can use DeFi, NFTs and any compatible app, but there is no password reset if the seed phrase is lost. Many users hold both, moving funds between them as needed.