Day 2 — Wallets, private keys, and what you actually own
If you remember one thing from this course, make it today's lesson: you do not 'own crypto', you own the key that controls it.
The most important thing a beginner can understand is the difference between holding crypto yourself (self-custody) and letting a company hold it for you (custodial / exchange). Almost every catastrophic crypto loss in history was a wallet mistake, an exchange failure, or a scam against the holder — not a market crash.
When you buy Bitcoin on Coinbase, Coinbase actually owns the Bitcoin. They keep a database entry that says 'this user is entitled to 0.1 BTC.' If Coinbase has a bug, gets hacked, freezes your account, or goes bankrupt, your access depends entirely on what they decide to do. This is called custodial holding. It is convenient and beginner-friendly, and it is fine for small amounts.
A self-custody wallet is different. It is software (or a small device) that generates a private key on your machine. Whoever knows the private key controls the funds. No company can freeze it, no government can directly seize it without your cooperation, but also no one can recover it if you lose it. That responsibility is the whole point.
The private key is usually represented as a 12 or 24-word phrase — the seed phrase. Anyone who types those words into another wallet gets your money. That is why scams that ask for a 'verification phrase' or 'wallet recovery' are scams: real wallets never need you to type those words anywhere except into a fresh wallet you are restoring.
Hot wallets (apps on your phone or browser, like MetaMask or Phantom) are convenient but live on internet-connected devices. Cold or hardware wallets (Ledger, Trezor) keep the private key on a separate device that never sees the internet, which makes them dramatically harder to attack remotely.
Example
In June 2022, the Celsius and Voyager lending platforms froze customer withdrawals before declaring bankruptcy. Customers who held their crypto on those platforms lost access for months and ultimately recovered only a fraction. Customers who had moved their holdings to self-custody wallets a week earlier kept full access throughout the entire collapse, because the platforms did not control their funds. The actual blockchains kept running normally. The lesson the survivors took away was not 'pick the right platform' but 'do not leave significant amounts on any platform.'
Common mistakes
- Writing your seed phrase in a notes app, password manager, or cloud document — any of those can be hacked. Use pen on paper, or metal.
- Storing your seed phrase in the same place as your hardware wallet. If a thief takes one, they get both.
- Typing your seed phrase into a website that claims to 'verify' or 'sync' your wallet. There is no such legitimate operation.
- Treating a $200 hardware wallet as overkill. The cost of a hardware wallet is trivial compared to even a small loss.
- Ignoring the 'passphrase' (25th word) feature on hardware wallets, then later wishing for plausible deniability. We cover this in the Self-Custody Masterclass.
Safety warning
Your seed phrase is your money. If anyone asks for it — support staff, an admin in a Telegram group, a 'wallet verification site,' a YouTuber — they are stealing from you. Real support never needs it. Ever.
Check your understanding
Which of the following is the only legitimate use of a seed phrase?
Key terms covered
Sources & further reading
- PrimaryBIP-39 — Mnemonic code for generating deterministic keys
The specification for the 12/24-word seed phrase used by virtually every modern wallet.
- SecondaryReuters — Celsius freezes withdrawals (June 2022)
Contemporaneous reporting on the Celsius freeze used in the example.
We prioritise primary sources. Where a topic moves quickly (regulation, security incidents), we re-check sources on the cadence shown by the page's "Next review" date.