People talk about “putting bitcoin in a wallet” as if it were cash in a purse. That picture is useful until it is not. On a public blockchain, the coins are entries on a shared ledger. What you hold is the ability to create a valid instruction that says: move these coins from this address to that one.
That ability comes from a private key — a long secret number. Software can turn the key into addresses you can share, and into signatures you should never share. A wallet is the tool that stores keys, shows balances, and helps you sign without having to do the maths by hand.
The three jobs a wallet does
First, it derives keys. Modern wallets start from a recovery phrase (often twelve or twenty-four words) and generate many keys from that one backup. That is why losing the phrase is as serious as losing the keys themselves.
Second, it watches the network. Your balance is not a number stored inside the app. The app looks up the ledger, adds up unspent coins that your keys control, and displays a total. If two wallets use the same phrase, they should eventually show the same funds — because they are looking at the same public record.
Third, it signs. When you send, the wallet builds a transaction and uses the private key to prove it is allowed. The network then decides whether that proof is valid. The wallet vendor does not “approve” the payment in the way a bank might. If the signature is right and the coins are unspent, the move can go through.
Hot, cold, and “someone else holds it”
A hot wallet lives on a phone or computer that connects to the internet. Convenient, and more exposed to malware and phishing. A cold wallet keeps keys on a device or paper that does not sit online all day. Less convenient, and much harder to steal remotely — though still easy to lose, damage, or write down badly.
There is a third pattern: an exchange or app holds the keys for you. That can feel like a bank login. It is simpler for beginners, and it concentrates risk in one company: hacks, freezes, insolvency, or a forgotten password with no recovery phrase you control. Neither model is automatically “safe”. They fail in different ways.
Recovery phrases, without the folklore
The phrase is a human-readable form of the master secret. Anyone who has it can usually recreate the wallet and move the funds. Anyone. There is no customer-service reset if you pasted it into a fake “support” site.
Write it on paper or stamp it in metal if you are serious. Store it away from the device. Do not photograph it. Do not save it in the same cloud folder as your tax returns. If you need a second copy, make a second copy on purpose — not a trail of screenshots.
The phrase backs up keys, not “the app”.
A screenshot of the phrase is a spare key lying on the pavement.
If someone needs your phrase to “help you”, they are not helping you.
What to do before you buy anything
Practise with an empty wallet. Note the phrase, wipe the app, restore it, and confirm the addresses match. Send a tiny test amount to a second address you control before you ever move a sum you would hate to lose. Read the send screen slowly: asset, network, address, fee. The wrong network has stranded plenty of otherwise careful people.
Addresses are not accounts in the banking sense
An address is a destination derived from keys. You can have many. Some wallets generate a fresh receiving address each time to make it harder for strangers to cluster your activity. Reusing one address is not a moral failing; it is a privacy leak and a convenience. Payment apps that give you a QR code are usually giving you an address, sometimes plus extra data such as a destination tag on certain networks.
If you copy an address from a website, check the network badge. Bitcoin addresses and Ethereum addresses do not look alike, but USDT on Ethereum and USDT on another chain can look confusingly similar in a wallet’s token list. The wallet is showing a balance that exists on one ledger. Sending on another ledger is like posting a letter to the right house number in the wrong city.
Custodial apps, in slower motion
When a company holds keys, you are using their database plus, somewhere in the background, their wallets. Withdrawals are a request. Deposits are a credit. During an outage you may see a balance you cannot move. During a hack, the hole is in their vault, not in “the blockchain” as an abstraction. During insolvency, you are a creditor with a terms-of-service PDF.
None of that makes custody evil. It makes it a financial-services relationship. Read withdrawal limits. Try a small withdrawal. Enable the strongest two-factor option they offer. Do not keep a life-changing sum there because the app is pretty.
A short glossary you will actually meet
Seed / recovery phrase: the backup of the keys.
Public key / address: what you share so people can pay you.
Signature: proof you intended this particular send.
Fee: payment to whoever includes your transaction in the next block or batch.
Watch-only: a wallet that can see balances but cannot send, because it has no private keys.
If you can explain those five without a diagram, you already know more than most splash pages assume.
This is information, not a recommendation to self-custody or to use any particular brand. If the idea of being your own backup makes you uneasy, that is useful data. Start with education, not with a large purchase.
