How Cryptocurrency Wallets Actually Work—And What You’re Really Owning
Sasha Reid
July 7, 2026
The word “wallet” in cryptocurrency is a metaphor, and like most metaphors in technical contexts, it’s both useful and misleading. A traditional wallet holds things—cash, cards—and the things it holds move from one wallet to another. A cryptocurrency wallet doesn’t hold anything in this sense. Your Bitcoin doesn’t live inside a wallet application or a hardware device. It lives on the blockchain—the shared ledger maintained across thousands of computers globally—and a wallet is really a tool for proving you have the right to move it.
Understanding what wallets actually are, and what you’re actually owning when you own cryptocurrency, requires grasping a few concepts in public-key cryptography. The concepts aren’t mathematically complex to understand at a basic level, and they’re essential to making sense of everything else: why losing your seed phrase is catastrophic, why exchange custody is different from self-custody, and what “not your keys, not your coins” actually means technically.
What the Blockchain Actually Stores
Bitcoin, Ethereum, and most other cryptocurrencies maintain a public ledger—a sequential record of all transactions ever made on the network. This ledger is stored redundantly across thousands of nodes (computers running the network software globally), and each node has a complete or near-complete copy of the entire history.
The ledger records transactions between addresses—long strings of characters that serve as the sending and receiving identifiers on the network. An address might look like: 1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf. The ledger doesn’t record names, identities, or ownership in a human sense. It records that certain amounts moved from certain addresses to other addresses, building up a complete picture of which addresses currently hold how much.
Importantly, anyone can see the balance at any address. Blockchains are public and permissionless—transparency is built into the design. What’s private is not the balance but the ability to authorize transactions from that address. That authorization requires cryptographic proof.
Public and Private Keys
Public-key cryptography, developed in the 1970s, uses mathematically linked pairs of keys: a public key and a private key. What the public key encrypts, only the private key can decrypt. And critically, what the private key signs can be verified by anyone with the public key—without revealing the private key.
In cryptocurrency, this asymmetry is used for transaction authorization. When you want to send funds from your address:
- You create a transaction (stating: from this address, to that address, this amount)
- You sign the transaction with your private key using a digital signature algorithm
- You broadcast the signed transaction to the network
- Every node can verify the signature using the corresponding public key—confirming that whoever controlled the private key authorized this transaction
- If the signature is valid and the balance is sufficient, the transaction is accepted and recorded
The private key is the critical secret. Whoever has the private key can sign transactions from the associated address. There is no central authority to reset it, no password recovery, no customer service call. The mathematics are deterministic: the right key produces a valid signature; no key produces an invalid one. Cryptographic systems used in practice are designed so that deriving the private key from the public key is computationally infeasible—it would take more time than the age of the universe with currently available computing technology.
What a Wallet Actually Is
A cryptocurrency wallet is software (or hardware) that stores private keys and uses them to create and sign transactions. That’s essentially the whole job. The wallet might also:
- Query blockchain data to show you current balances
- Help you construct transactions with the correct format
- Track your transaction history
- Manage multiple addresses or multiple currencies
But fundamentally: a wallet manages private keys. The coins don’t “go into” the wallet; they remain on the blockchain. What moves into the wallet is the key that controls them.
Modern wallets use Hierarchical Deterministic (HD) wallet standards, defined in Bitcoin Improvement Proposals 32, 39, and 44. An HD wallet generates a master private key from a random seed—a sequence of random bits—and then derives all child keys from that master using a deterministic algorithm. This means the entire wallet—potentially thousands of addresses across multiple currencies—can be completely reproduced from a single master seed.
The seed is typically represented as 12 or 24 ordinary English words—your seed phrase or mnemonic phrase. These words encode the random seed using a standardized wordlist. “Abandon abandon abandon… art” represents a specific seed value that generates a specific master key that generates all the specific address private keys. Writing down those words, in the correct order, in a physical location is the standard backup mechanism for self-custody cryptocurrency holdings.
What You’re Really Owning
When you own cryptocurrency in self-custody, what you actually own is a private key (or the seed phrase that generates it). Ownership, in the cryptocurrency sense, means exclusive knowledge of the key that can authorize transactions from an address. No other documentation, claim, or registration matters. Whoever controls the key controls the funds.
This is a significant departure from traditional financial asset ownership, where ownership is recorded in institutional databases and can be recovered or disputed through legal and administrative channels. There’s no crypto equivalent of a broker reconstructing your account records after you lose access. If the private key is lost—the device it was on fails without backup, the seed phrase is lost—the funds in that address are permanently inaccessible. They remain visible on the blockchain forever, but no one can move them. The estimated amount of Bitcoin permanently locked in lost wallets is in the millions of coins.
Conversely, if someone else gets your private key—through malware, phishing, physical theft of a device, or a compromised seed phrase storage location—they have complete and irrevocable control. There’s no dispute process. They sign a transaction, the network accepts it, the funds move. The blockchain doesn’t know or care about fraud.
Hot Wallets vs. Cold Wallets
The distinction between hot and cold storage refers to whether the private key is held on a device connected to the internet.
Hot wallets—software wallets running on a phone or computer—store private keys on internet-connected devices. They’re convenient for frequent transactions and daily use. They’re also the most vulnerable to compromise, since malware, phishing, or device compromise can expose the private key to a remote attacker.
Cold storage refers to keeping private keys on devices or media that are never connected to the internet. Hardware wallets—dedicated devices like Ledger or Trezor units—are the most common cold storage solution. They store private keys in secure elements (tamper-resistant chips) and are designed so that the key never leaves the device unencrypted. When you want to authorize a transaction, you connect the hardware wallet to a computer and approve the transaction on the device itself; the private key signs the transaction internally without being exposed to the connected computer.
Paper wallets—private keys printed on paper and stored physically—are another cold storage option. Simpler but less convenient for transactions.
Air-gapped computers (never connected to any network) running wallet software represent the highest level of security for very large holdings.
Exchange Custody: The Difference That Matters
When you buy cryptocurrency on an exchange (Coinbase, Kraken, Binance, etc.) and leave it in your exchange account, you don’t hold private keys. The exchange holds the keys and maintains its own internal ledger of customer balances. What you have is an exchange account balance—a number in the exchange’s database that says you own a certain amount of cryptocurrency.
This has significant implications:
Counterparty risk: You’re dependent on the exchange’s solvency, security, and honesty. Exchange hacks have resulted in the loss of hundreds of millions in customer funds. Exchange failures (FTX in 2022 being the most dramatic recent example) can result in customer funds being lost in insolvency proceedings.
Transaction dependence: You can only transact during exchange uptime. If the exchange suspends withdrawals—as several have done during liquidity crises—your access is interrupted regardless of market conditions.
Simplicity and recoverability: Exchange custody comes with account recovery mechanisms—email, phone, identity verification—that self-custody does not. For many users, particularly those holding smaller amounts, exchange custody may be the more practical choice despite the counterparty risk.
The phrase “not your keys, not your coins” is the self-custody community’s shorthand for this distinction. Technically accurate: exchange custody means the exchange holds the keys and you hold a claim against the exchange.
Multi-Signature Wallets
For organizations or individuals holding significant amounts, multi-signature (multisig) wallets distribute the signing requirement across multiple keys. A 2-of-3 multisig wallet, for example, requires any 2 of 3 designated private keys to sign a transaction. This means no single key compromise drains the wallet, and no single key loss locks it permanently. Keys can be held by different people, on different devices, in different locations.
Multisig is standard practice for institutional cryptocurrency custody and is increasingly accessible for individual users through wallets that support the relevant Bitcoin script types or Ethereum smart contract patterns.
The Security Responsibility You’re Taking On
Self-custody cryptocurrency ownership is fundamentally different from holding assets in a regulated financial institution because the security responsibility shifts entirely to you. Protecting private keys means protecting against malware on devices used to generate or store keys, phishing attacks designed to reveal seed phrases, physical theft or destruction of seed phrase backups, and social engineering attacks that trick you into revealing credentials.
Good seed phrase storage typically involves multiple physical copies (paper or metal) in geographically separate secure locations, with no digital copies in any form. Not stored in cloud services, not photographed on a phone, not typed into any connected device.
This is not a criticism of self-custody—it’s an accurate description of the trade-off. The security model that makes cryptocurrency censorship-resistant and requires no trusted third party is the same model that puts the security burden on the individual. Understanding that trade-off is the prerequisite for making a rational choice about how to hold cryptocurrency.
