How wallets work
Every crypto wallet manages three things:
- A seed phrase — 12 or 24 words that generate all your keys deterministically (BIP-39 standard).
- Private keys — the cryptographic keys that sign transactions. Derived from the seed phrase.
- Addresses — public identifiers derived from private keys. Where people send you crypto.
When you send a transaction, the wallet signs it with your private key and broadcasts it to the network. The network verifies the signature and executes the transaction. The wallet stores your keys locally (or derives them from hardware) — it doesn’t contact a “wallet server.”
Wallet categories
- Browser extensions (MetaMask, Rabby, Frame) — hot wallets, keys stored encrypted in browser local storage. Convenient for DeFi interaction; riskier than hardware.
- Mobile wallets (Trust Wallet, Phantom, Coinbase Wallet) — same category as browser; app-based. WalletConnect bridges them to desktop dApps.
- Hardware wallets (Ledger, Trezor, Keystone, GridPlus) — keys never leave a dedicated device. You connect and sign transactions physically. The safest mainstream option.
- Custodial wallets (exchange accounts, Coinbase consumer app) — the exchange holds the keys. Convenient but means you don’t really control the assets.
- Smart-contract wallets (Safe, Argent, Ambire) — the wallet is a smart contract with programmable security (multisig, session keys, spending limits, social recovery). Account abstraction (ERC-4337) is making these more common.
What a wallet lets you do
- Hold crypto — receive and store any asset on the supported chains.
- Sign transactions — send, swap, stake, borrow, or interact with any smart contract.
- Connect to dApps — via WalletConnect, browser injection, or direct integration.
- Prove identity — sign arbitrary messages as proof of key ownership (ENS domain ownership, etc.).
Risks and considerations
The wallet is the user’s single largest operational risk surface:
- Seed phrase theft — typed into a phishing site, photographed, or stored in cloud backup. Common retail loss pattern.
- Malicious dApp transactions — approving
transferFromorsetApprovalForAllon a malicious contract can drain assets days or weeks later. - Drainer injection — compromised front-ends can replace the legitimate transaction with a drain-wallet call before you sign.
- Device compromise — malware on the computer running the wallet can intercept or modify signing.
- Supply-chain attacks — fake wallet apps on app stores, compromised wallet binaries downloaded from unofficial sources.
Practical security posture:
- Hardware wallet for significant holdings. Hot wallets for active DeFi, hardware for custody.
- Separate addresses for different uses — airdrop farming, DeFi experiments, long-term holdings. A compromise of one doesn’t affect others.
- Revoke unused approvals. Use Revoke.cash, Rabby’s built-in, or Debank to audit and clear old token approvals.
- Verify URLs before signing anything. Bookmark trusted dApps; don’t click into them from Discord/Twitter links.
- Never paste your seed phrase anywhere except into the wallet at setup or recovery. No legitimate service asks for it.