Crypto wallet, address and seed phrase: how not to lose your money

The word "wallet" misleads: a crypto wallet contains no money. Money is records on the blockchain. The wallet stores keys that prove you are entitled to dispose of those records. Lose the keys - lose access. Have the keys stolen - have the money stolen.

Three things: key, address, seed phrase

The private key is a huge random number, a secret. It signs transactions. Whoever knows the key controls the money.

The public key and address are computed from the private key one way: from the key the address is easy to get, from the address the key is impossible. An address looks like 0x6462…90aD and acts as an "account number". You can safely show it to anyone: it is like a public email address, not a password.

The seed phrase (mnemonic phrase) is 12 or 24 English words from which the wallet creates all your keys. It is the "master key": knowing the phrase you can restore the wallet on any device and take all the money.

How a wallet signs actions

When you press "Confirm" in an app, the wallet shows a window describing the action and offers to sign it with the private key. A signature is mathematical proof that the key's owner approved the action, without revealing the key itself.

That is why a website or service needs no password or registration: your address and signature are enough. The service can do nothing without a signature, and you sign only actions you have read.

Types of wallets

Software (hot) - an app on a phone or a browser extension: MetaMask, Rabby, Trust Wallet, Coinbase Wallet, Rainbow. Keys are stored on the device. Convenient, but if the device is infected the keys are at risk.

Hardware (cold) - a separate device like Ledger or Trezor. The key never leaves the device and signing needs a press on a physical button. For large amounts it is the security standard.

Custodial - when an exchange or service keeps the keys for you. It is not quite "your" wallet: you trust a company as you would a bank. "Not your keys, not your coins" is exactly about this.

Smart wallets and multisig - wallets controlled by a program: for instance requiring signatures from two of three participants. Handy for teams and companies.

Golden security rules

1. The seed phrase only on paper or metal, offline. Not in notes, not in the cloud, not in a photo, not in a messenger.
2. Never tell the phrase to anyone - not support, not a "security specialist", not a "recovery form" on a website.
3. Check the site address. Scammers create copies of real services with similar addresses. Bookmark the sites you need.
4. A test transaction. Before a large transfer to a new address, send a small amount and make sure it arrived.
5. A separate wallet for experiments. It is better to separate long-term storage from a "working" wallet for deals.
6. Be sceptical of "urgent" messages asking you to connect a wallet or sign something "to receive a payout".
7. Periodically revoke old approvals for tokens - see the article on approve.

What happens if you lose access

A wallet cannot be restored without the seed phrase: there is no "forgot password", no support that resets a key. That is why the phrase must be stored reliably and, ideally, in two places. There are many stories of people permanently losing access to money because of a lost phrase.

How this relates to guarantor deals

Your wallet is the only "identity" in a smart-contract deal: buyer, seller and guarantor are defined by addresses. So for deals it matters that access to the wallet stays only with you. How all the keys come from one phrase is in the article on HD wallets, the protection rules in the security checklist. Next - what really happens behind the scenes: what a smart contract is.