A blockchain wallet is a software or hardware tool that manages cryptographic keys and enables users to interact with a blockchain network. Despite the name, a wallet does not "store" cryptocurrency in the way a physical wallet holds cash. Instead, it stores the private keys that prove ownership of assets recorded on the blockchain. The assets themselves never leave the chain; the wallet simply provides the means to authorize transactions involving those assets.
How Wallets Work
At the most fundamental level, a wallet performs three functions:
- Key generation: The wallet generates a cryptographic key pair—a private key and its corresponding public key. The public key is used to derive the wallet's address (the identifier others use to send you funds).
- Transaction signing: When you want to send a transaction, the wallet uses your private key to produce a digital signature. This signature proves that the transaction was authorized by the holder of the private key without revealing the key itself.
- Blockchain interaction: The wallet submits signed transactions to the network (via an RPC node) and queries the blockchain for account balances, transaction history, and other data.
The cardinal rule of blockchain wallets: whoever controls the private key controls the assets. There is no password reset, no customer support, and no recovery mechanism built into the protocol. Loss of the private key means permanent loss of access.
Hot Wallets vs. Cold Wallets
The primary classification of wallets is based on their connection to the internet:
Hot Wallets
Hot wallets are connected to the internet and allow for immediate transaction signing and submission. They prioritize convenience and speed at the expense of security exposure.
- Browser extensions: MetaMask, Rabby, Phantom. Run as browser add-ons and enable direct interaction with decentralized applications (dApps).
- Mobile wallets: Trust Wallet, Rainbow, Coinbase Wallet. Optimized for mobile devices with QR code scanning and WalletConnect support.
- Desktop wallets: Exodus, Electrum. Standalone applications running on desktop operating systems.
Hot wallets are suitable for day-to-day transactions and active DeFi participation but should not be used to store large amounts of value due to their exposure to online attack vectors (malware, phishing, browser vulnerabilities).
Cold Wallets
Cold wallets store private keys in an environment that is never directly connected to the internet. They prioritize security at the expense of convenience.
- Hardware wallets: Ledger, Trezor, GridPlus Lattice. Dedicated physical devices that store keys in secure elements and require physical interaction to sign transactions.
- Air-gapped computers: Machines that have never been connected to the internet, used to generate and store keys. Transaction signing is done offline and transferred via QR code or USB drive.
- Paper wallets: Private keys printed on paper. Once common, now largely obsolete due to the risk of physical damage and the difficulty of secure generation.
| Factor | Hot Wallet | Cold Wallet |
|---|---|---|
| Internet connection | Always connected | Offline / air-gapped |
| Transaction speed | Immediate | Requires physical device interaction |
| Attack surface | Broad (malware, phishing, exploits) | Narrow (physical theft, supply chain) |
| Best use case | Active trading, dApp interaction | Long-term storage, large holdings |
| Cost | Free | $50–$400 for hardware devices |
Custodial vs. Non-Custodial
A second critical distinction is who controls the private keys:
Custodial Wallets
A third party (typically an exchange like Coinbase, Binance, or Kraken) holds the private keys on your behalf. You access your funds through the custodian's platform using traditional authentication (username, password, 2FA). The custodian is responsible for key management, security, and backup.
Custodial wallets are convenient but introduce counterparty risk. If the custodian is hacked, becomes insolvent, or freezes your account, you may lose access to your funds. The collapses of FTX (2022), Mt. Gox (2014), and others underscore this risk.
Non-Custodial Wallets
You hold the private keys directly. No third party can access, freeze, or confiscate your funds. This is the model used by MetaMask, Ledger, and most DeFi-oriented wallets. The tradeoff is that you bear full responsibility for key management and security. There is no "forgot password" option.
Seed Phrases (Mnemonic Recovery Phrases)
Modern wallets use hierarchical deterministic (HD) key derivation, standardized in BIP-39 and BIP-44. Instead of generating a single key pair, the wallet generates a seed phrase—a sequence of 12 or 24 English words selected from a standardized 2,048-word list.
This seed phrase encodes a master secret from which an effectively unlimited number of key pairs can be derived deterministically. This means:
- One backup covers everything. If your device is lost or destroyed, you can restore all accounts and their keys from the seed phrase alone.
- Multiple accounts from one seed. A single seed phrase can generate separate addresses for different blockchains (Ethereum, Bitcoin, Solana, etc.) using standardized derivation paths.
- Portability. You can import the same seed phrase into any compatible wallet software.
Multi-Signature Wallets
For institutional use, multi-signature (multisig) wallets require multiple private keys to authorize a transaction. A common configuration is "2-of-3": three key holders are registered, and any two must sign a transaction for it to be valid. This eliminates single points of failure and is the standard for treasury management in DAOs, funds, and enterprises.
Gnosis Safe (now Safe) is the most widely used multisig wallet on Ethereum, securing tens of billions of dollars in assets. Multisig wallets are implemented as smart contracts, which means they benefit from the same transparency and auditability as any other on-chain program.
Security Best Practices
Regardless of wallet type, the following practices are essential:
- Use hardware wallets for significant holdings. Never store large amounts in a hot wallet.
- Verify transaction details on the device. Hardware wallets display transaction data on their screen—always confirm before signing.
- Use a dedicated device. Avoid using the same computer for browsing and wallet operations.
- Revoke unused approvals. ERC-20 token approvals grant smart contracts permission to spend your tokens. Revoke approvals for contracts you no longer use (via tools like Revoke.cash).
- Test with small amounts first. Before transferring significant value to a new address or interacting with a new protocol, send a small test transaction.
- Use multiple wallets. Segregate assets across wallets by purpose: a "hot" wallet for daily DeFi activity, a "warm" wallet for medium-term holdings, and a "cold" vault for long-term storage.
Key Takeaways
- A wallet manages private keys that control on-chain assets—it does not "store" cryptocurrency.
- Hot wallets prioritize convenience; cold wallets prioritize security. Institutional best practice uses both in a tiered architecture.
- Non-custodial wallets eliminate counterparty risk but require the user to bear full responsibility for key management.
- Seed phrases are the master backup for HD wallets and must be treated with the same care as the private key itself.
- Multi-signature wallets are the standard for institutional treasury management, eliminating single points of failure.