Crypto Wallets and Seed Phrases: How to Keep Your Coins Safe

A crypto wallet does not store coins; it stores the private keys that prove you own coins recorded on the blockchain. A seed phrase of 12 or 24 words is a human-readable backup of those keys: anyone who sees it can take everything, and if you lose it, no one can restore your funds. Keeping crypto safe mostly means protecting that phrase and your exchange logins.

Custodial vs self-custody

There are two ways to hold crypto:

	Custodial (exchange account)	Self-custody (your own wallet)
Who controls the keys	The exchange	You
If you forget your password	Account recovery is usually possible	Only your seed phrase can restore access
If the company fails or freezes accounts	Your funds may be stuck	Not affected
Main risk	Exchange failure, account takeover	Losing or leaking your seed phrase
Good for	Active trading	Long-term holdings

Most traders use both: a trading balance on an exchange and savings in a self-custody wallet.

Hot wallets and cold wallets

• Hot wallets are apps on a phone or browser extensions on a computer. They are convenient and free, but they live on a device that connects to the internet, so malware, fake apps and phishing are real risks.
• Cold wallets keep the keys offline. The usual example is a hardware wallet, a small device that signs transactions inside itself, so the keys never touch your computer. You approve each transaction on the device's own screen.

A sensible rule: amounts you would be upset to lose belong in a hardware wallet. Buy one only from the manufacturer's official website or an authorised seller, never second-hand, because a tampered device can come with a pre-set seed phrase that the seller already knows.

The seed phrase

When you create a wallet, it shows you 12 or 24 words chosen from a standard list of 2,048 words. Those words can recreate every key in the wallet on any compatible device. The number of possible combinations is so large that guessing a phrase is not realistic; seed phrases are lost through carelessness and tricks, not guessing.

Rules to follow without exception:

1. Write it on paper or stamp it on metal. Never photograph it, never store it in email, cloud notes, chat apps or password-protected documents on a phone.
2. Never type it into a website or a form. A real wallet only asks for it when you restore that wallet yourself, inside the wallet app or device.
3. Never share it. No exchange, wallet company, developer, signal group admin or "support agent" needs it. A request for it is always a scam.
4. Keep two copies in separate safe places, so a fire, flood or move does not destroy your only copy.
5. Check the backup. Some wallets let you verify the words; do it before you deposit serious money.

Securing your exchange account

Most beginners lose money through a hijacked exchange account rather than a hacked blockchain. Turn on:

• A unique, long password stored in a password manager. Never reuse your email or social-media password.
• Two-factor authentication (2FA) with an authenticator app rather than SMS. With a SIM swap, criminals persuade a mobile operator to move your number to their SIM card and then receive your SMS codes.
• An anti-phishing code. You choose a word that the exchange includes in every real email it sends; an email without it is fake.
• A withdrawal address whitelist, so funds can only go to addresses you saved earlier, often with a waiting period for new ones.
• Email security. Your email account is the key to resetting everything else, so give it its own strong password and 2FA.

Review logged-in devices and active API keys every month. If you use API keys for trading tools, never enable withdrawal permission on them.

Sending crypto without mistakes

Most losses on transfers come from three errors:

1. Wrong network. The withdrawal network must match what the receiving wallet supports, as explained in the previous lesson.
2. Wrong or poisoned address. In address poisoning, scammers send you a tiny transaction from an address that looks almost like one you use, hoping you copy it from your history later. Always copy the address from the source, not from your transaction history, and check the first and last five or six characters.
3. Missing memo or tag. Some coins and exchange deposits require an extra memo or tag. Leaving it out can leave funds stuck.

Token approvals: the hidden permission

When you connect a wallet to a DeFi app and approve a token, you often give that app's contract permission to move that token, sometimes in unlimited amounts. If the app is malicious or later hacked, it can drain the approved tokens without asking again. Approve only the amount you need, use a separate wallet with small balances for experiments, and review and revoke old approvals with a reputable approval-checking tool from your wallet provider or block explorer. More on this in DeFi and Staking Risks.

Next, learn to spot the tricks used against crypto users in Common Crypto Scams and How to Avoid Them.