Wallets, keys and protecting digital assets

What a wallet really is

A common misunderstanding is that a wallet "contains" money. It does not. Balances live on the blockchain. A wallet is software or hardware that stores private keys and uses them to sign transactions. The matching public key is used to create an address that others can send to. If someone copies your private key, they can sign transactions as you, and the network cannot tell the difference. That is why key protection is the heart of digital asset security. This note is educational and is not investment advice.

Recovery phrases and HD wallets

Most modern wallets are hierarchical deterministic (HD). They start from a large random number, which is shown to you as a recovery phrase (also called a seed phrase) of usually 12 or 24 words from a standard word list (BIP-39). From that single seed the wallet can derive millions of key pairs in a predictable way (BIP-32). The benefit is simple backup: write the words down once and you can restore every account on a new device. The risk is equally simple: anyone who sees those words owns everything.

• Write the phrase on paper or stamp it into metal. Never photograph it, email it, or store it in cloud notes.
• Keep it somewhere safe from fire, flood and casual visitors. Some people split backups across two secure locations.
• Some wallets support an optional extra passphrase that adds a further secret on top of the words.

Types of wallet

Organisations usually combine cold storage for most funds, a small hot wallet for daily operations, and multisig or MPC (multi-party computation) with separation of duties so no single employee can move funds alone.

Common attacks and how to stop them

• Phishing and fake support: lookalike websites and "helpdesk" messages ask for your recovery phrase. No genuine service ever needs it.
• Clipboard hijacking: malware swaps a copied address for the attacker's. Always check the full address on the hardware wallet screen.
• Address poisoning: attackers send tiny amounts from addresses that look like ones you use, hoping you copy from history.
• Malicious approvals: on smart contract chains, signing an "approve" can let a contract spend your tokens later. Read what you sign and review and revoke old approvals.
• Fake hardware: buy devices only from the manufacturer or authorised sellers and set them up yourself.

1. Generate keys on a trusted device; never accept a pre-filled recovery phrase.
2. Back up the phrase offline and test a restore with a small amount first.
3. Use MFA (multi-factor authentication) on any exchange account; see passwords and MFA.
4. Verify every address and amount on a trusted screen before signing.
5. Keep only what you need in hot wallets.

Tip: confirmed blockchain transactions are almost never reversible. Prevention is the only reliable control, so slow down whenever anyone creates urgency.