Crypto wallets: keys, custody and recovery

Address, private key and phrase: three different roles

A public address is used to receive, among other things. A private key produces a signature. A recovery phrase can reconstruct several keys, so it is not just a login password.

In a traditional recovery-phrase wallet, the local password protects the app on that device. Resetting it does not change keys derived from the phrase. Support cannot create a backup that you have lost.

Who can authorize a transfer?

With custody, a provider manages access to assets under its contract. With self-custody, you control signing credentials or your account’s rules. Each model shifts responsibilities.

• Custodial service: check the legal entity, account recovery and withdrawal terms.
• Self-custody: understand backups, signing and granted permissions.
• Programmable account: check recovery rules, authorized parties and possible delays.

Hardware protects the key, not your intention

A hardware wallet can hold the key and sign without exposing it to the connected computer. Assets are not stored inside the device. Its confirmation screen helps you check what you authorize.

If you approve a transfer to a scammer or an excessive permission, key isolation does not make that action safe. A backup still matters if the device is lost or damaged.

Prepare recovery before using the wallet

Not every wallet shows a recovery phrase. Some use passkeys, account logins or contract-based recovery. Ask what happens if you lose both the phone and access to the login service.

• Read the chosen wallet’s recovery documentation.
• Check that the backup restores the correct accounts and networks.
• Prepare a recovery procedure before holding assets.
• Never enter secrets in a form received through a message or presented as support verification.

The same address does not mean the same network

A 0x-format address can appear on Ethereum and several compatible networks. Its balance is separate on each network. A token can also share a symbol without sharing the same contract.

Before a transfer, the recipient should confirm the intended network and asset. A small test transfer can detect some errors, but does not prove that an app or permission is safe.