How crypto wallets work: addresses, private keys and recovery phrases

Installing a crypto wallet can make it feel as though coins move into your phone. In reality, balances and transactions are recorded on the blockchain; the wallet is a tool for viewing those records and signing transactions. The keys controlling assets matter more than the app itself.

Four things that are easy to confuse

• Wallet address: A public address used to receive assets. It is not a password, but sharing it can link transaction history and activity to you.
• Private key: Secret information proving authority to transact. If exposed, someone else may be able to move the assets.
• Recovery phrase: Usually a set of words used to restore wallet keys. Some wallet designs do not use one, or have a different recovery process.
• App password: A lock for opening the wallet on a particular device. Changing it does not invalidate an already exposed recovery phrase.

Exchange accounts and personal wallets are different

Exchanges generally manage the private keys for assets kept with them. With self-custody, users manage the keys themselves. Resetting an exchange password and recovering a personal wallet are different processes.

Deleting a wallet app does not delete asset records from the blockchain. But losing a valid recovery method can make the assets inaccessible. Conversely, deleting the app does not solve the problem if the recovery phrase has been exposed.

Points to remember about storage

Do not comply with requests for your full recovery phrase, even from someone claiming to be official support. A website describing the request as “wallet verification”, “synchronization” or “claiming an airdrop” is no exception. When choosing where to keep recovery information, consider loss, fire, theft and compromise of a cloud account.

An unfamiliar token appearing in a wallet does not by itself mean the assets were hacked. Anyone can send tokens to a public address. Harm can occur when you follow a link attached to that token or comply with a request to sign something.

References

ethereum.org
support.metamask.io