How Do Crypto Wallets and Recovery Phrases Actually Work?
A wallet doesn't hold coins
The word "wallet" is misleading. Cryptocurrency balances live on the blockchain — a shared ledger — not inside any app or device. What a wallet holds is your private key: the secret that proves you control an address and lets you sign transactions from it. As the NIST blockchain overview explains, blockchain systems rest on public-key cryptography — a public address others can send to, and a private key only the owner should hold, used to produce digital signatures the whole network can verify.
So the real question when choosing a wallet is not "where do my coins go?" but "who holds the key?"
Custodial accounts vs. self-custody
There are two fundamentally different models, and the wallet comparison table on our home page lays them out side by side.
- Custodial: an exchange or platform holds the keys and shows you a balance, much like a bank shows you an account. You log in with a password; if you forget it, the company has a recovery process. The tradeoff is that you're trusting that company's security, solvency, and honesty. The SEC's crypto assets page is blunt about this category of risk: platforms holding customer assets can fail or be fraudulent, and crypto generally lacks the protections that apply to bank deposits or brokerage accounts.
- Self-custody: the keys live with you — in a phone app, a browser extension, or a dedicated hardware device. Nobody can freeze or lose your funds for you, and nobody can recover them for you either. The Ethereum Foundation's wallet documentation covers the main self-custody types and how they differ.
Neither model is "correct." They allocate responsibility differently, and plenty of people use both for different purposes.
What a recovery phrase is
Self-custody wallets almost universally generate a recovery phrase (also called a seed phrase) when first set up: a list of ordinary words, produced in a standardized way, from which the wallet derives your keys. The Ethereum wallet documentation describes how this phrase works as the master backup: enter it into a compatible wallet and your accounts are reconstructed, even if the original phone or device is gone.
Two consequences follow directly, and they explain most self-custody horror stories:
- Anyone with the phrase controls the funds. It doesn't matter who they are or how they got it. This is why no legitimate wallet, support agent, or website ever needs your phrase — a point U.S. regulators repeat in their fraud advisories, including the CFTC's digital-asset customer resources, because "give me your seed phrase to fix your account" is a standard scam script.
- Without the phrase (or the device), there is no recovery hotline. Self-custody means no company can reset anything for you.
How the pieces fit together
Hardware wallets keep keys on a device that stays offline except when signing. App and extension wallets keep keys on an internet-connected device, trading some exposure for convenience. Multi-signature and smart-contract wallets spread control across several keys or programmed rules, so no single lost or stolen key is fatal — at the cost of more setup complexity.
Whichever type you use, the key ideas are the same: the blockchain holds the balances, the key controls the address, and the phrase regenerates the key. Once that clicks, wallet documentation stops reading like jargon. To see what the key actually does when you hit send, read how a blockchain transaction works; for what those wallets typically hold, see what an ERC-20 token is.