Crypto wallets explained: what they are, how they work and which type you need

Let’s suppose you’ve bought $100 of Bitcoin. You can see it on your phone, but what happens if you lose the phone? If an exchange holds the Bitcoin, you’ll need to recover your account. If you moved it to a wallet you control, you’ll need whatever backup that wallet uses.

Where does your Bitcoin actually go?

The Bitcoin network keeps a public record of transactions and which amounts can still be spent. Your phone holds the app you use to see and access the balance.

A crypto wallet is a tool for using that system. It lets you see cryptocurrency associated with your addresses, receive payments and authorise transfers.

There is one important complication. When you buy Bitcoin through an exchange, the balance shown in your account may be the exchange's record of what it holds for you. You might not have a wallet that you control yourself.

To understand the difference, you need to know what a key is.

What are crypto keys?

When you create many self-custody wallets, the app gives you 12 or 24 ordinary words, in a particular order. You might be asked to write them down before you can finish setting up the wallet.

Those words are called a recovery phrase. They are your backup.

Behind the scenes, the wallet uses mathematical secrets called private keys to authorise transactions. The recovery phrase can recreate those private keys in a compatible wallet. You normally never need to see or type the private keys themselves.

Think about what happens if your phone breaks. You install a compatible wallet app on another phone, choose the recovery option and enter your words. The app can then recreate the keys needed to access your cryptocurrency. The Bitcoin was on the blockchain all along.

Now think about what happens if somebody else gets those words. They may be able to recreate the same keys on their own device and send the cryptocurrency away. They do not need your original phone, its PIN or your permission.

Never share your recovery phrase. Do not photograph it, email it to yourself, save it in cloud notes or enter it into a website asking to verify your wallet. Genuine support staff do not need it. If you believe somebody has obtained it, use a trusted device to move your assets to a completely new wallet with a new recovery phrase.

Some wallets use different recovery methods, and some add an extra passphrase. Before depositing money, find out exactly what you would need to recover that particular wallet.

What is a wallet address?

A wallet also gives you an address for receiving cryptocurrency. You can share a receiving address with someone who needs to pay you.

An address is a little like a bank account number. It tells the sender where to send the payment. Your private key is different: it provides the authority needed to spend cryptocurrency controlled by that key.

The address alone does not let somebody take your money. But cryptocurrency networks are not interchangeable, so always check that the sender is using the correct coin and network.

What is a hot wallet?

A hot wallet is a wallet whose signing system is connected to the internet. A wallet app on your phone or a browser extension is a common example.

You download the app, create a wallet, save its recovery phrase and can then send or receive cryptocurrency without asking an exchange to approve each transfer.

This is convenient if you use crypto regularly. Your phone or computer, however, can be exposed to malicious software, fake wallet apps and fraudulent websites. A criminal may try to steal your recovery words or persuade you to approve a payment.

A hot wallet can be self-custody, meaning you control the keys yourself. The word hot tells you how the wallet connects, not who owns or controls the funds.

What is a cold wallet?

A cold wallet keeps the information used to sign transactions offline or isolated from your everyday internet-connected device.

A common way to do this is with a hardware wallet, a small physical device made for protecting crypto keys. Ledger and Trezor are two well-known manufacturers.

You normally use the hardware device alongside an app on your phone or computer. The app prepares a payment and the device authorises it without exposing the private key to the computer. You should check the address and amount on the device before confirming.

Hardware wallets are often used for longer-term holdings because they reduce some of the risks of keeping keys on a general-purpose phone or computer. They cannot protect you if you give away your recovery phrase or approve a fraudulent transaction.

And the hardware device does not contain your Bitcoin. If it is damaged or lost, you can generally recover access using the correct backup and a compatible wallet. That is why protecting the recovery information is at least as important as protecting the device.

What happens when you leave crypto on an exchange?

Imagine buying Bitcoin on a cryptocurrency exchange. You sign in with your email address and password, buy £100 worth and see the balance on your screen.

On a typical custodial exchange, the exchange controls the private keys. It keeps the cryptocurrency and records what it owes or holds for customers. When you ask to withdraw Bitcoin to another wallet, the exchange must process that request.

This is called custody. It can make buying and selling easier, and the company may be able to help if you forget your account password.

It also creates a dependency. You need the exchange to remain secure, solvent and willing to honour withdrawals. If the company freezes accounts, is hacked or fails, you may be unable to access the cryptocurrency shown in your balance.

Why people say “not your keys, not your coins”

The phrase is a warning about control. If a company holds the keys, you cannot independently move the cryptocurrency it holds for you.

Exchange failures are not hypothetical. Mt. Gox collapsed in 2014 after major Bitcoin losses. FTX collapsed in 2022, leaving customers unable to withdraw, although its bankruptcy process later provided substantial creditor recoveries. The smaller exchange XeggeX also experienced a serious disruption in 2025, leaving customers facing uncertainty over access and recovery.

The consequences differ from one case to another. Some customers recover assets or money, sometimes years later. Others suffer major losses. A balance displayed in an exchange account is not a guarantee that the assets will be available when you need them.

“Not your keys, not your coins” is not a precise statement of legal ownership. You may have enforceable rights to cryptocurrency held by a company. The practical problem is that those rights may be difficult to enforce after a failure, and legal proceedings cannot guarantee recovery.

An exchange may advertise that it keeps customer assets in cold storage. That describes how the exchange protects its own keys. It does not mean you control them. The exchange still has to authorise your withdrawal.

What does self-custody mean?

With a self-custody wallet, you control the keys needed to authorise transfers. You do not need an exchange to approve a payment from that wallet.

That independence comes with responsibility. Lose the only way to recover the keys and you may permanently lose access. Reveal the recovery phrase and someone else may be able to steal the funds. There is usually no bank or customer service department that can reverse a completed blockchain payment.

This is the real choice between keeping cryptocurrency with a provider and holding it yourself. With an exchange, you depend on the company. With self-custody, you depend on your own security and backup arrangements.

Our separate guide to who owns your crypto and what private keys control explains the legal distinction in more detail.

Are you actually buying Bitcoin on a trading platform?

One more point matters before choosing a wallet: not every product advertised as a way to invest in Bitcoin gives you Bitcoin that can be sent to a wallet.

Some platforms sell actual cryptocurrency and let customers withdraw it to their own addresses. Others offer an investment product that follows Bitcoin's price, such as an exchange-traded note. With that product, you own the investment security, not Bitcoin that you can transfer from a wallet. Derivative contracts can also provide price exposure without ownership of the underlying crypto, although UK retail restrictions apply to crypto derivatives.

Before buying, look for the option to withdraw cryptocurrency to an external wallet. If the only option is to sell the position for pounds, read the product terms to understand what you have purchased.

We explain the different products in the guide to buying and cashing out crypto.

Which wallet should you choose?

For someone buying a small amount of cryptocurrency for the first time, an established exchange may be a convenient starting point, provided they understand the custody risk and the withdrawal rules. It is sensible to learn how transfers work before moving a large balance.

If you want to receive and send cryptocurrency yourself, a self-custody phone wallet can be a practical option. Set up its recovery method properly before adding funds.

If you are planning to hold a larger amount for a long time, a reputable hardware wallet may offer useful additional protection. Buy through a trustworthy channel, set it up yourself and never use a device supplied with recovery words already written down.

Whatever you choose, start with a small test. Check the receiving address and network, send an amount you can afford to lose and make sure you understand how to send it back. The guide to sending cryptocurrency explains the steps.

The important thing to remember is that hot and cold describe how a wallet protects keys, while custodial and self-custody describe who controls them. Once you know who holds the keys and how access can be recovered, you can make a much better decision about where to keep your cryptocurrency.

Sources

• Bitcoin Developer Guide: Wallets
• Ethereum: Security and recovery
• Ledger: What is a hardware wallet?
• Trezor: Hardware wallets
• XeggeX public statements