Wallets and Private Keys: Not Your Keys Not Your Crypto

If you don't control your private keys, you don't own your crypto—you own a promise from someone else, and history keeps showing us what those promises are worth.

Let me tell you about a man who had eight hundred million dollars that didn't belong to him, and how thousands of people learned the hardest possible lesson about custody. His name was Sam Bankman-Fried, and when FTX collapsed in November of twenty twenty-two, people who thought they owned bitcoin and ethereum and everything else suddenly discovered they owned nothing at all. They had numbers on a screen. The actual crypto? That was somewhere else entirely, being gambled away in ways they never agreed to.

This keeps happening. Mt. Gox in twenty fourteen. QuadrigaCX in twenty nineteen. Celsius, Voyager, BlockFi, all in twenty twenty-two. Different names, different stories, same fundamental problem. People trusted someone else to hold their keys.

So let's talk about what keys actually are, because this isn't intuitive if you're coming from traditional finance. When you own crypto, you don't really own a coin that sits somewhere. You own the right to move an entry on a public ledger, and that right is controlled by mathematics. Specifically, by a private key, which is just a very large random number that corresponds to your wallet address. Think of your wallet address as your home address that anyone can see and send mail to. Your private key is the only key that opens that house. No master key exists. No customer service line can reset it. If you lose it, that's it. If someone else gets it, they own everything in that wallet, permanently.

This is why we say not your keys, not your crypto. When you buy bitcoin on Coinbase or Binance or any exchange, they generate a wallet address and they hold the private key. You have an account with them. You have a username and password, maybe two-factor authentication. But that's not crypto ownership. That's a traditional account relationship where you're trusting them to be honest, to be competent, to not get hacked, to not gamble your funds, to not freeze your account, to actually have the crypto they say they have. You're back in the old system wearing new clothes.

Self-custody means you hold your own keys. You are your own bank. And this comes in two main flavors: hot wallets and cold wallets. The difference is simple but crucial. Hot wallets are connected to the internet. Cold wallets are not.

A hot wallet might be an app on your phone like MetaMask or Trust Wallet or Exodus. You install it, it generates your private keys right there on your device, and you can interact with decentralized applications, swap tokens, send and receive crypto, all from your pocket. Convenient? Absolutely. But your keys exist on a device that touches the internet, which means they're exposed to every malicious website, every phishing attempt, every bit of malware that might be lurking. Hot wallets are like keeping cash in your regular wallet. Fine for walking-around money. Not where you store your life savings.

Cold wallets are offline. The most common type is a hardware wallet, a physical device like a Ledger or a Trezor that looks sort of like a thumb drive. Your private keys are generated and stored on this device, and they never leave it. When you want to make a transaction, you connect the device to your computer, the transaction is signed inside the device using your key, and only the signed transaction goes out to the network. Your actual key never touches the internet-connected machine. It's like keeping your wealth in a safe buried in your backyard instead of under your mattress.

But here's where it gets interesting. Your private key is essentially a huge number, too long to memorize or write down practically. So the standard now is something called a seed phrase, also known as a recovery phrase or mnemonic phrase. When you set up most wallets, you get twelve or twenty-four random words from a specific list. These words, in this exact order, are a human-readable version of your private key. From these words, your entire wallet can be reconstructed. Every address, every key pair, everything. This means you can write down these twelve or twenty-four words on paper, store that paper somewhere safe, and even if your hardware wallet gets destroyed or lost, you can buy a new one, enter those words, and your wallet is restored perfectly. It's beautiful mathematics working for human needs.

But it also means those words ARE your crypto. Anyone who has those words controls everything in that wallet forever. This is why you never type your seed phrase into a website, never take a photo of it, never store it in your email or cloud storage. There are people who run elaborate phishing schemes pretending to be wallet support, asking you to "verify" your seed phrase. The moment you hand it over, everything is gone. And there's no reversing crypto transactions. No calling the bank. No fraud department. Gone is gone.

So what does real self-custody look like in practice? For most people with significant holdings, it's a layered approach. Keep small amounts in a hot wallet for actual use, for interacting with applications, for transactions you want to make quickly. Keep the bulk of your holdings in cold storage, in a hardware wallet or even multiple hardware wallets with different seed phrases. Write those seed phrases on paper or stamp them into metal, store them in different physical locations. Maybe one copy in a safe at home, one in a bank safety deposit box, one with a trusted family member. You're thinking like someone protecting physical gold now, because functionally that's what you're doing.

Some people go even further with multisig wallets, where moving funds requires signatures from multiple private keys, say two out of three or three out of five. You keep these keys in different locations, maybe give them to different trusted parties. Now even if one key is compromised, your funds are safe. This is how institutions handle custody, and how individuals with large holdings should think.

Now here's why this matters beyond just protecting your own wealth. Every time an exchange collapses, it sets the entire space back. It erodes trust, it brings regulation written by people who don't understand the technology, it hurts people who could least afford to lose money. And it's entirely preventable. These collapses happen because of centralization, because people who control other people's keys face a irresistible temptation to do something with those assets. To lend them out for yield, to use them as collateral, to take risks that aren't disclosed. The whole point of crypto was to remove the need for this trust, to replace it with mathematics and transparency. But when you leave your coins on an exchange, you've opted right back into the trust game.

I'm not saying never use exchanges. They're useful for on-ramps, for converting fiat to crypto. But think of them as you would an airport. You pass through, you don't live there. Buy your crypto, then withdraw it to your own wallet. Yes, there's a learning curve. Yes, the responsibility is heavy. That's the price of actually owning something in a digital age.

See you Thursday.

The most dangerous phrase in crypto isn't "send me your seed phrase"—it's "let us hold it for you."