What Is a Crypto Wallet? How Keys, Addresses, and Transactions Actually Work

A crypto wallet is often described as a digital version of the wallet in your pocket. That analogy is convenient, but technically misleading. Your cryptocurrency is not stored inside a wallet application or hardware device. The blockchain keeps the record of assets and balances. A wallet manages the cryptographic credentials that let you authorize actions involving them.

This distinction explains much of what otherwise seems mysterious about crypto wallets: why losing a phone does not necessarily mean losing your assets, why exposing a private key can be catastrophic, why the same account can appear in more than one wallet interface, and why pressing “Send” involves much more than moving data from one device to another.

What is a crypto wallet?

A crypto wallet is software or hardware that helps a user manage cryptographic keys and interact with a blockchain. Depending on its design, it may generate keys, derive addresses, display balances, prepare transactions, sign messages and transactions, and communicate with blockchain networks.

The crucial point is that the wallet and the assets are separate things.

On Ethereum, for example, account balances are part of the network’s shared state. Ethereum’s documentation explicitly distinguishes an account from a wallet: an account exists within Ethereum’s state, while a wallet is an interface or application used to interact with an account.

That gives us a better mental model than the physical-wallet analogy.

If a wallet application disappears but you still possess the credentials required to reconstruct control of the account, the blockchain record has not disappeared. Conversely, having a wallet application installed does not give you control over an account unless the wallet has access to the appropriate signing authority.

Where is your crypto actually stored?

Cryptocurrency exists as records maintained according to the rules of its blockchain. Different blockchains organize those records differently, so there is no single data model shared by every cryptocurrency.

Ethereum uses an account-based model. Its network state includes accounts and their balances. Bitcoin uses a different model built around unspent transaction outputs, commonly called UTXOs.

In either case, the important idea for a beginner is similar: the authoritative record is maintained by the network, not inside your wallet.

Your wallet reads relevant blockchain data and presents it in a convenient form. When it displays a balance, it is effectively showing you information derived from the network’s state or transaction history.

This also explains why installing another compatible wallet and restoring the same cryptographic credentials can provide access to the same blockchain assets. The second wallet does not receive coins from the first wallet. It gains the ability to identify and control the same blockchain positions.

The three concepts to understand: private key, public key, and address

Wallets hide much of their cryptography behind buttons and confirmation screens, but three concepts sit underneath ordinary wallet use.

The private key

A private key is secret data generated according to the cryptographic rules of a blockchain. It is used to create digital signatures.

Those signatures allow the network to verify that an action was authorized by the holder of the appropriate key without requiring that private key itself to be revealed to the network.

This is the core mechanism behind ordinary self-custody.

On Ethereum, an externally owned account is controlled through a public-private key pair. The private key signs transactions, while the resulting signature can be verified cryptographically.

If another person obtains usable access to that private key, they can generally produce valid signatures for that account. The blockchain does not know whether the person creating the signature is the original owner, a thief, or someone who was intentionally given the key. It evaluates cryptographic validity.

The public key

A public key is mathematically related to its private key. It can be revealed without giving observers the practical ability to derive the corresponding private key under the security assumptions of the cryptographic system.

This asymmetry makes public-key cryptography useful for blockchains: one side can remain secret while the other can participate in public verification.

Exact key and address construction varies between networks. On Ethereum, for example, an externally owned account’s address is derived from its public key using Keccak-256 and taking the relevant 20-byte portion of the result.

The address

An address is the public identifier users interact with most often. If someone wants to send assets to you, you normally give them an address, not a private key.

An address is therefore closer to a destination label than to a password.

But addresses are network-specific structures. An address that looks valid in one ecosystem should not automatically be assumed to work on another. Wallet software may support many networks, which makes checking the selected network and destination especially important.

What happens when you send crypto?

Suppose Alice wants to send an asset to Bob. The interface may make this look like a simple sequence: paste an address, enter an amount, press Send, and confirm.

Underneath that interface, several separate things happen.

1. The wallet prepares a transaction

The wallet constructs data describing the requested action according to the rules of the network.

For a basic Ethereum transaction, relevant information can include the destination address, value, transaction nonce, fee-related parameters and optional input data. Transactions that interact with smart contracts can contain data instructing a contract to perform a particular operation.

2. You approve the request

The wallet shows some representation of what it intends to sign. A well-designed interface tries to make the important details understandable: which account is acting, what asset or value is involved, which destination or contract is being used, and what network fee may apply.

This review step matters because a cryptographically valid signature can authorize something the user did not actually intend if the interface is misleading or the request is malicious.

3. The transaction is signed

The wallet uses the private key to create a digital signature over the appropriate transaction data.

The private key itself does not need to be broadcast with the transaction. Instead, the signature supplies cryptographic evidence that the transaction was authorized by the relevant key.

This is one reason hardware wallets can improve key isolation. The signing operation can occur inside a dedicated device while the connected computer receives the signed result rather than the raw private key.

4. The signed transaction is broadcast

After signing, the transaction can be sent to the blockchain network. On Ethereum, transactions are broadcast so that network participants can validate them and validators can eventually include valid transactions in blocks.

The wallet interface is therefore not the blockchain itself. It is one participant in a larger process: preparing, signing and transmitting an instruction that the network independently evaluates.

5. The blockchain processes the result

If the transaction is valid and included according to the network’s rules, the blockchain’s agreed state changes.

For a simple transfer, that may mean updating balances or ownership records. For a smart-contract transaction, the consequences can be more complicated because the signed transaction may trigger program logic.

A practical example

Imagine Alice has an Ethereum account and wants to send ETH to Bob.

Bob gives Alice his public Ethereum address. Alice’s wallet reads relevant network information, prepares a transaction containing Bob’s address and the amount to send, and estimates the parameters needed for the transaction.

Alice reviews the request and approves it.

Her wallet signs the transaction using the private key controlling her account. The signed transaction is then broadcast to Ethereum. Network participants can verify the signature and other validity conditions without learning Alice’s private key.

Once the transaction is included and accepted by the network, Ethereum’s state reflects the result.

At no point did a file containing ETH travel from Alice’s phone to Bob’s phone. What changed was the blockchain’s shared record.

What is a seed phrase, then?

Many wallets do not expect users to manually store individual private keys. Instead, traditional self-custody wallets often use a recovery mechanism built around a sequence of words commonly called a seed phrase, recovery phrase, or mnemonic.

Depending on the wallet’s standards and architecture, that recovery material can be used to deterministically derive multiple keys and accounts. This is why restoring one wallet backup can sometimes reconstruct many addresses.

A seed phrase should not be confused with an ordinary app password.

A password may merely protect access to a particular local wallet application or encrypted key store. Recovery material can represent the underlying ability to reconstruct wallet keys. If someone obtains it, changing the local application password may not stop them from restoring those keys elsewhere.

Not every modern wallet uses the same recovery model. Smart-contract wallets, multisignature systems, social-recovery designs, passkeys and account-abstraction-based systems can distribute or express authorization differently. “Wallet” therefore describes a broad category rather than one universal architecture.

Custodial and self-custodial wallets are not the same

One of the most important questions is who ultimately controls the signing keys.

This distinction is more meaningful than whether the interface happens to be a mobile app, browser extension or website.

A polished application can still be self-custodial. A cryptocurrency account accessed through a website can still be custodial. The underlying question is who can authorize actions involving the assets.

Software wallets and hardware wallets

Self-custodial wallets can also differ in where and how their keys are protected.

A software wallet generally operates on a general-purpose device such as a phone or computer. This is convenient, but the device is also exposed to applications, browser activity, network connections and potentially malicious software.

A hardware wallet is designed to keep sensitive key operations in dedicated hardware. Transactions can be prepared on another device and passed to the hardware wallet for approval and signing.

Hardware isolation does not make every transaction safe. If a user approves a malicious contract interaction or fails to verify the destination shown by the device, valid signatures can still authorize unwanted actions.

Why transaction signing can be dangerous

“Never share your seed phrase” is important security advice, but it is incomplete. Users can lose assets without revealing a seed phrase or private key.

A malicious application can ask a wallet to sign a transaction or message that grants permissions or performs an unwanted action. Complex smart-contract interactions are particularly difficult because the raw data being signed may not be understandable to a human.

Ethereum documentation describes this problem in the context of “blind signing”: transaction data can be opaque, making it difficult for users to verify the real action before authorization.

The practical security boundary is therefore not merely possession of the private key. It also includes how safely the wallet presents signing requests and how carefully the user verifies them.

Common wallet misconceptions

“My coins are inside my wallet.”

Usually not. The blockchain maintains the authoritative record. The wallet provides access to the keys and interfaces needed to interact with that record.

“If I delete my wallet app, my crypto disappears.”

Deleting an interface does not delete blockchain records. But losing the only usable copy or recovery path for your signing credentials can make assets effectively inaccessible.

“My wallet password is my private key.”

Not necessarily. A local password may encrypt or unlock wallet data on one device. It should not automatically be treated as equivalent to the underlying private key or recovery material.

“Sharing my address lets someone take my crypto.”

A public address is intended to be shared when receiving assets. Knowing an address does not by itself provide the private signing authority needed to control it.

However, public blockchains can make address activity observable. Sharing an address can therefore have privacy consequences even when it does not create direct signing authority.

“A hardware wallet makes every Web3 interaction safe.”

No. Hardware can reduce exposure of private keys, but it cannot make a malicious transaction harmless after the user knowingly or unknowingly approves it.

The main risks and limitations

Crypto wallets replace some familiar financial security assumptions with a different set of responsibilities and dependencies.

• Key theft: malware, phishing or insecure backups can expose signing credentials.
• Recovery failure: losing the only recovery mechanism can permanently prevent access.
• Malicious signing: a user can authorize an unwanted transaction without exposing the private key itself.
• Wrong destination: blockchain transactions may be difficult or impossible to reverse after confirmation.
• Wrong network: using incompatible networks or asset representations can create recovery problems.
• Privacy leakage: public addresses and blockchain activity can sometimes be linked together.
• Software risk: wallet applications, browser environments and connected devices can contain vulnerabilities.
• Physical risk: backups and hardware devices can be lost, damaged, stolen or accessed by other people.

There is also no single wallet architecture that eliminates all of these risks. Designs make trade-offs among convenience, recoverability, isolation, decentralization and complexity.

What should you check before using a wallet?

• Understand whether the wallet is custodial or self-custodial.
• Know what information actually restores access.
• Never treat a private key or recovery phrase as something to paste into an ordinary website.
• Verify the blockchain network before sending assets.
• Check destination addresses carefully rather than relying only on the first or last few characters.
• Read wallet signing prompts and be suspicious when the requested action is unclear.
• Understand that an app password and the underlying recovery credentials may protect different things.
• Keep recovery material separate from devices and accounts that could fail together.

Why wallets matter

Wallets sit at the boundary between human intent and blockchain authorization.

A blockchain can verify signatures and enforce protocol rules, but it cannot know what a user meant to do. The wallet translates human actions such as “send this asset” or “interact with this application” into cryptographically authorized instructions.

That makes wallet design unusually important. It combines cryptography, identity, transaction construction, network communication, security and user experience in one place.

Understanding wallets also makes many other crypto concepts easier. Self-custody is fundamentally about controlling signing authority. A blockchain transaction is an instruction authorized by a signature. A wallet address is a public identifier, not a secret credential. And a seed phrase is valuable because it can represent a route back to the keys—not because the words themselves contain coins.