Learning Objectives – after this chapter you will be able to:
- Explain what a blockchain wallet really stores.
- Compare custodial vs non-custodial and hot vs cold wallets.
- Explain seed phrases (BIP-39), HD wallets (BIP-32) and derivation paths (BIP-44).
- Apply security best practices to protect keys.
What is a Wallet?
A blockchain wallet is software or hardware that stores and manages your private keys, shows your balances, and signs transactions. Your coins and tokens are not inside the wallet – they are recorded on the blockchain. The wallet holds the keys that prove you can spend them.
- Losing the keys means losing access to the funds; anyone who copies the keys can take the funds.
- A wallet usually connects to a node (directly or through a provider) to read balances and broadcast signed transactions.
Types of Wallets
| Category | Description | Trade-off |
|---|---|---|
| Custodial | A third party (e.g. an exchange) holds the keys for you. | Easy recovery, but you must trust the custodian. |
| Non-custodial | You hold your own keys or seed phrase. | Full control, full responsibility. |
| Hot wallet | Keys on an internet-connected device – browser extension, mobile or desktop app. | Convenient for daily use; more exposed to malware and phishing. |
| Cold wallet | Keys kept offline – hardware wallet or securely stored paper backup. | Much safer for savings; less convenient. |
| Multisig / smart-contract wallet | Requires several keys (m-of-n) or programmable rules such as spending limits and social recovery. | Strong security and flexibility; more complex setup. |
Seed Phrases and HD Wallets
- BIP-39 seed phrase (mnemonic): a list of usually 12 or 24 words chosen from a standard list of 2,048 words. It encodes random entropy plus a checksum and can regenerate all of the wallet’s keys.
- BIP-32 hierarchical deterministic (HD) wallet: from one master seed, a tree of unlimited key pairs can be derived. Backing up the seed phrase once backs up every account.
- BIP-44 derivation path: a standard “address” inside the key tree, e.g.
m/44'/60'/0'/0/0for the first Ethereum account (60 is Ethereum’s coin type) andm/44'/0'/0'/0/0for Bitcoin. - An optional passphrase (sometimes called the “25th word”) can be added to create a completely different set of keys.
Seed phrase12/24 words (BIP-39)
Master seed512-bit seed
Key treeDerivation paths (BIP-32/44)
AccountsPrivate key → public key → address
Wallet Security Best Practices
Do
- Write the seed phrase on paper or metal and store it offline in a safe place.
- Use a hardware wallet for significant amounts.
- Verify the receiving address on the device screen before sending.
- Review and revoke unnecessary token approvals.
- Test with a small amount first.
Don’t
- Never type your seed phrase into a website or share it with “support staff” – genuine support will never ask for it.
- Don’t store the seed phrase in screenshots, e-mail or cloud notes.
- Don’t sign transactions or messages you do not understand.
- Don’t click wallet links from unknown messages (phishing).
Key Takeaways
- Wallets store keys, not coins; whoever controls the keys controls the funds.
- Custodial vs non-custodial = who holds the keys; hot vs cold = online or offline keys.
- A BIP-39 seed phrase backs up an entire BIP-32/44 HD wallet – protect it carefully.
Question / Answer (15 questions)
Answer : A wallet stores private keys (or the seed from which they are derived) and uses them to sign transactions. The coins and tokens themselves are recorded on the blockchain, not inside the wallet.
Answer : In a custodial wallet a third party, such as an exchange, holds the private keys on the user’s behalf. In a non-custodial wallet the user holds the keys or seed phrase and has full control and responsibility.
Answer : A hot wallet keeps keys on an internet-connected device, which is convenient but more exposed to attacks. A cold wallet keeps keys offline, for example in a hardware wallet, which is much safer for long-term storage.
Answer : A dedicated physical device that stores private keys offline and signs transactions internally, so the keys never leave the device even when it is connected to a computer.
Answer : A human-readable backup consisting of usually 12 or 24 words from a standard list of 2,048 words. It encodes random entropy and a checksum and can regenerate all keys of the wallet.
Answer : A hierarchical deterministic wallet derives an entire tree of key pairs from a single master seed. Backing up the seed once backs up all current and future accounts.
Answer : A derivation path identifies a specific key within an HD wallet’s key tree, following BIP-44. The first Ethereum account commonly uses m/44'/60'/0'/0/0, where 60 is Ethereum’s registered coin type.
Answer : The passphrase is combined with the seed phrase to produce a completely different master seed. It adds protection if the words are discovered, but if the passphrase is forgotten the funds cannot be recovered.
Answer : A multisig wallet requires m-of-n keys to approve a transaction, for example 2-of-3. It is used by organisations and security-conscious users so that a single lost or stolen key cannot cause loss of funds.
Answer : They can implement programmable rules such as spending limits, social recovery through trusted guardians, batching of transactions and paying gas in tokens – features ordinary EOAs lack.
Answer : Devices and cloud accounts can be hacked or synced to other devices. Anyone who obtains the seed phrase gains full control of every account in the wallet.
Answer : Attackers create fake websites, apps or support messages that trick users into revealing their seed phrase or signing malicious transactions or token approvals.
Answer : Malware on a computer can silently replace a copied address with an attacker’s address. The hardware wallet screen shows the true destination that will be signed.
Answer : It means setting previously granted ERC-20 or NFT allowances back to zero so that contracts no longer have permission to move your tokens, reducing risk if those contracts are malicious or compromised.
Answer : No. There is no central authority on a public blockchain that can reset keys. Without the seed phrase or private key, funds in a non-custodial wallet are permanently inaccessible.
MCQ Test : Check Your Understanding (5 questions)
Select an option and press Check Answer, or answer all questions and press Submit Test to see your score. Each answer comes with an explanation.
Bibliography/References
The notes, questions and MCQs on this page are original explanations written for this course. The works listed below were consulted and are cited for attribution and further reading. Product names, logos and trademarks belong to their respective owners. Short quotations, where used, are marked and attributed.
- Wuille, P. (2012). BIP-32: Hierarchical Deterministic Wallets. Bitcoin Improvement Proposals. https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki
- Palatinus, M., Rusnak, P., Voisine, A., & Bowe, S. (2013). BIP-39: Mnemonic code for generating deterministic keys. Bitcoin Improvement Proposals. https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
- Palatinus, M., & Rusnak, P. (2014). BIP-44: Multi-Account Hierarchy for Deterministic Wallets. Bitcoin Improvement Proposals. https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
- ethereum.org. (n.d.). Ethereum wallets. https://ethereum.org/en/wallets/
- Ethereum Improvement Proposals. (2021). ERC-4337: Account Abstraction Using Alt Mempool. https://eips.ethereum.org/EIPS/eip-4337
- Antonopoulos, A. M. (2017). Mastering Bitcoin: Programming the Open Blockchain (2nd ed.). O’Reilly Media.