Self-custody basics: keeping your own crypto safe

Keys, seeds and what “your coins” means

A wallet does not store coins; it stores the keys that can move them on the blockchain. Most modern wallets derive every key from a single seed phrase (also called a recovery phrase) of 12 or 24 words, defined by the BIP 39 standard. Anyone with those words can recreate your wallet anywhere and spend everything in it.

Hardware wallets

A hardware wallet generates and keeps the keys on a dedicated device and signs transactions inside it, so the keys never touch your internet-connected computer. Its screen is the one to trust: check the address and amount there before approving. Buy from the manufacturer or an authorised reseller, and never use a device that arrives with a seed phrase already written down.

Backing up the seed

• Write the words on paper or stamp them into metal. Photos, cloud notes and emails are copied to places you do not control.
• Keep at least two copies in separate places that are safe from fire, flood and casual discovery.
• Consider a passphrase (sometimes called the 25th word) for extra protection, but a lost passphrase makes the funds unrecoverable, so back it up as carefully as the seed.
• Test the backup while amounts are small: restore it on a device, or check that it produces the same receive addresses.

Watch-only and multisig

An extended public key (xpub) lets software see every address in a wallet and its balance without being able to spend. It is how portfolio trackers and monitors watch cold storage safely, but it reveals your entire history, so share it only with services you trust. Our xpub address explorer shows what an xpub derives, entirely in your browser.

For larger amounts, a multisig wallet needs several keys (for example 2 of 3) to spend, kept on separate devices in separate places. No single stolen or lost key can cost you the funds.

Common scams

• Fake wallet apps and browser extensions that imitate popular ones. Install only from the official website or the store listing it links to.
• “Support” that contacts you first on social media or chat. Real support does not message you unprompted.
• Address poisoning: look-alike addresses planted in your history. See the guide.
• Token approvals to malicious contracts on EVM chains, which let them move your tokens later. Review and revoke approvals you no longer need; see token approvals.

Planning for the unexpected

If something happened to you, could someone you trust recover your funds, and could nobody else? Write down what exists and where it is, without writing down the secrets themselves, and consider a multisig or a professional arrangement for significant holdings.