Module 2: Wallets, Custody, and Security
What a Wallet Really Is
Chapter 1 of 14 · about 7 minutes
1.1 Where is my bitcoin?
At the end of Module 1, Mint owned about 0.001 BTC, sitting on an exchange. Hash suggested it was time to learn about self-custody, and Mint asked what seemed like a simple question.
"If I move my bitcoin into a wallet, where does it actually go? Into my phone?"
"Nowhere," said Hash. "It stays exactly where it's always been: on the blockchain. A crypto wallet doesn't hold any crypto at all."
Mint stared. "Then why is it called a wallet?"
"Bad name," said Hash. "It should be called a keychain."
This chapter explains what a wallet really is. Every other chapter in this module builds on it, so it's worth getting right.
1.2 Crypto lives on the blockchain
Remember the shared ledger from Module 1, Chapter 3. Every node holds a copy of a record showing which address owns how much. Your crypto is an entry in that ledger. It doesn't exist anywhere else. It can't be stored on a phone, a USB stick, or a piece of paper.
What you can store is the thing that gives you control over that ledger entry: your private key.
Think back to the glass mailboxes from Module 1. The mailboxes and their contents are in a public building, visible to everyone. Your wallet is the key ring in your pocket. If you lose your key ring, the mailbox and its contents are still there. You just can't open it anymore. And if someone copies your key, they can open your mailbox as easily as you can.
1.3 What a wallet actually does
A crypto wallet is software (or a device running software) that does four main jobs.
Generates and stores your keys. It creates your private keys and keeps them safe, ideally encrypted.
Shows your addresses and balances. It derives your public addresses from your keys and reads the blockchain to display what those addresses hold.
Builds and signs transactions. When you want to send crypto, it creates the transaction and signs it with your private key, proving you authorised it.
Connects you to applications. It lets you interact with decentralised exchanges and other smart contracts, like the ones in Module 1, Chapter 8.
| What people think a wallet does | What it really does |
|---|---|
| Holds your coins | Holds the keys that control your coins |
| Is where your money lives | Is a window into the blockchain plus a signing tool |
| If you lose it, your coins are gone | If you lose it but have your backup, you can restore access anywhere |
| If it's stolen, the thief needs your device | If your private key or seed phrase is copied, the thief needs nothing else |
Chapter 1 · A wallet is a keychain
The blockchain ledger holds addresses and balances. The wallet holds the private key, which signs a transaction message to produce a signature. The network verifies the signature and updates the ledger. The coins never sit inside the wallet app.
1.4 Keys and addresses
Let's go one level deeper, without any heavy maths.
Your private key is an enormous random number. It's the secret. Anyone who knows it controls the funds.
From the private key, your wallet mathematically calculates a public key, and from that, an address. This calculation only works in one direction. You can go from private key to address easily, but there's no practical way to go from an address back to the private key. That's what makes it safe to share your address publicly.
Addresses look different on different blockchains.
| Blockchain | Example address format |
|---|---|
| Bitcoin | Starts with 1, 3, or bc1, followed by a string of letters and numbers |
| Ethereum and EVM-compatible chains | Starts with 0x, followed by 40 characters using 0 to 9 and a to f |
| Others | Each blockchain has its own format |
"So my address is like my account number?" Mint asked.
"Close," said Hash. "It's like an account number that you can create yourself, for free, as many times as you like, without asking anyone."
1.5 Signing: proving it's you
When Mint sends crypto, the wallet creates a message that says, roughly, "Send this amount from this address to that address." Then it signs the message using the private key.
A digital signature is proof that whoever created the message knows the private key, without revealing the key itself. Every node on the network can check the signature using the public address. If it matches, the transaction is valid. If it doesn't, it's rejected.
Think of it like a wax seal on a letter, made with a unique ring only you own. Anyone can look at the seal and confirm it came from your ring, but nobody can make a copy of your ring by looking at the seal.
This is a crucial idea for the rest of the module: the blockchain only checks signatures. It doesn't check who you are, whether you meant to do it, or whether someone tricked you. A valid signature is a valid transaction. That's why Chapters 7 and 8 are dedicated to understanding what you're signing.
1.6 Custodial and non-custodial
Node had been following closely. "So when I kept bitcoin on the exchange, who had the keys?"
"The exchange," said Hash. "Which is why we call that a custodial setup. They're the custodian. They hold the keys for you."
| Custodial | Non-custodial (self-custody) | |
|---|---|---|
| Who holds the private keys | A company | You |
| Can the company freeze or lose your funds? | Yes | No |
| Can you recover a forgotten password? | Usually yes | Only with your seed phrase |
| Who's responsible for security | Mostly the company | Entirely you |
| Example | Crypto held on a centralised exchange | A self-custody wallet app or hardware wallet |
Neither option is risk-free. Custodial means trusting a company, with the risks we saw in Module 1, Chapter 7. Self-custody means trusting yourself, with risks that this entire module is designed to help you manage.
There are also newer models in between, where keys are split between you and a provider, or where a smart contract adds recovery options. We'll cover these in Chapters 2 and 13.
1.7 One wallet, many addresses, many chains
Mint opened a self-custody wallet app for the first time and noticed it could show balances on several different blockchains.
Most modern wallets are generated from a single master secret, the seed phrase, which we'll cover in Chapter 3. From that one seed, the wallet can create many private keys, and therefore many addresses, across many blockchains.
On Ethereum and EVM-compatible chains, the same address works on all of them. If your address is 0xABC... on Ethereum, it's also 0xABC... on other EVM chains. But balances are separate on each network. ETH on one network isn't automatically on another, which can confuse beginners. Chapter 9 explains how to handle networks safely.
1.8 What you're now responsible for
"Okay," said Mint. "So if I use a self-custody wallet, nobody can freeze my money, but nobody can save me if I make a mistake either."
"That's the deal," said Hash. "It's not scary once you understand it. Most losses in self-custody come from a handful of mistakes: losing the seed phrase, sharing the seed phrase, signing something harmful, or sending to the wrong place. This module covers each one."
Node crossed both arms. "And if I'd rather not take on that responsibility?"
"Then keeping funds with a reputable custodian is a legitimate choice," said Hash. "What matters is that you choose it knowingly."
1.9 Try it yourself
Look up the address of any well-known public figure or organisation that has published a donation address. Paste it into a block explorer. You can see its balance and full transaction history, even though you have no access to its funds. That's the difference between an address, which is public, and a private key, which is not.
Then explain to yourself, in one sentence, why a wallet app being deleted from your phone doesn't delete your crypto.
Key takeaways from this chapter
- Crypto lives on the blockchain. A wallet doesn't hold coins; it holds the keys that control them.
- A private key is a secret number. An address is derived from it and is safe to share.
- Wallets generate keys, display balances, sign transactions, and connect to applications.
- A digital signature proves you authorised a transaction, and the blockchain only checks signatures, not intentions.
- Custodial means a company holds your keys. Non-custodial means you do, along with full responsibility.
- One seed phrase can generate many addresses across many blockchains, with separate balances on each network.