The distinction may sound technical. Yet it explains almost everything about crypto security.
A wallet can take the form of a mobile app, a browser extension, software installed on a computer or a small physical device that keeps keys offline. Some exchanges also offer an integrated “wallet,” but in that case the user generally does not directly control the private keys.
This is where the distinction between custodial and self-custody comes in.
Under the first model, a company holds the keys. Under the second, the user holds them personally. The first makes the experience much simpler. The second provides more control, with a fairly harsh consequence: losing the right recovery information can make the funds permanently inaccessible.
Choosing a crypto wallet is therefore not just a matter of comparing two apps.
You need to determine who actually controls the assets, which blockchains are used, how the keys are backed up and what would happen if the phone, computer or wallet provider disappeared tomorrow.
A crypto wallet does not actually contain your crypto
The first concept to understand is counterintuitive: Bitcoin or Ether are not physically “inside” the wallet. Our guide to the difference between a crypto exchange, a CEX and a DEX already explains why control of the keys matters more than where a balance is displayed.
Take Bitcoin.
The network maintains a ledger showing which quantities of BTC can be spent under certain cryptographic conditions. The wallet enables its owner to produce the signatures needed to prove that they are authorized to make a transaction.
On Ethereum, the general logic is similar: an address is linked to a pair of cryptographic keys, and the private key is used to sign transactions.
The wallet therefore serves as an interface between the user and the blockchain.
It displays a balance.
It generates addresses.
It prepares transactions.
It enables signing.
But the blockchain remains the primary ledger.
That is why a user can sometimes switch wallet apps without “moving” their crypto. If the keys are imported correctly or the wallet is restored using the compatible recovery phrase, the new software can find the same accounts recorded on the blockchain.
The previous wallet had never locked the coins inside its app.
It only held the cryptographic means to control them.
This distinction also explains why deleting an app does not automatically destroy the assets.
If the seed phrase was backed up correctly, the wallet can generally be restored.
If it was not, the story becomes much less pleasant.
Public address, private key and seed phrase: the three concepts to know
A crypto wallet becomes much easier to understand when three elements are kept separate.
The public address can be compared, with many caveats, to a number used to receive funds. It can be shared.
On Ethereum, an address generally begins with 0x. On Bitcoin, several formats exist depending on the type of address used.
Sharing an address does not allow someone to spend the associated crypto.
The private key, however, must remain secret.
It is what enables the creation of a cryptographic signature showing that the user has the authorization needed to move the funds.
You can think of the address as the location of a visible safe and the private key as the means of opening it. The analogy is not technically perfect, but it helps clarify the difference.
Then there is the seed phrase, also known as a recovery phrase or mnemonic phrase.
It often contains 12 or 24 words.
Its role is much more important than that of an ordinary password. In many wallets, this sequence can recreate the wallet’s keys.
Someone who obtains the seed phrase can therefore potentially reconstruct the wallet on another device and transfer the funds.
They do not need to steal the phone.
They do not need to know the PIN.
The seed may be enough.
Ethereum.org explicitly recommends never sharing your recovery phrase or private keys and even advises against storing them as a screenshot that could be synchronized to the cloud.
That is why a seed phrase should never be treated like an ordinary password.
It is closer to the master key to a crypto portfolio.
Custodial wallet or self-custody?
Suppose someone buys 1,000 euros worth of Bitcoin on an exchange.
Their app displays a BTC balance.
Do they have a wallet?
In a broad sense, the interface does allow them to manage their crypto. But they generally do not directly control the private keys for the bitcoins corresponding to their balance.
The exchange provides custody.
It is a custodial wallet.
If the user forgets their password, the company can often offer an account recovery procedure after identity verification.
That is extremely convenient.
But it also means trusting the intermediary to actually hold the assets, protect its systems and honor withdrawal requests.
Self-custody reverses the logic.
The user creates a wallet whose keys they alone control.
The company that developed the app should not be able to move the funds.
There is often no conventional account to reset.
And if the seed phrase disappears without another backup, no one can necessarily help.
The famous phrase “Not your keys, not your coins” comes from this principle.
It does not necessarily mean that leaving 30 euros on an exchange is a catastrophic mistake.
It mainly highlights that a balance held by an intermediary and bitcoins directly controlled by a key do not represent the same type of operational ownership.
Freedom increases.
So does responsibility.
Hot wallets and cold wallets serve different needs
A second classification distinguishes hot wallets from cold wallets.
A hot wallet is connected to or regularly exposed to the Internet.
A mobile app is the most common example. The same applies to an extension installed in a browser to use Web3 applications.
The advantage is obvious: speed.
The phone is already in your pocket.
A few seconds may be enough to send tokens, make a swap or connect the wallet to an application.
This simplicity also increases the attack surface.
An infected computer, a malicious extension, a phishing site or a dangerous authorization granted to a smart contract can expose the wallet.
A cold wallet, by contrast, aims to keep private keys offline.
Hardware wallets fall into this category. Transactions are prepared on the phone or computer, while the critical signature is created on the dedicated device without directly exposing the private key to the connected machine.
Ethereum.org considers hardware wallets one of the safest options for storing private keys, precisely because the keys remain locally on the device.
That does not make the system invulnerable.
BrefCrypto recently examined the movement of roughly 233,000 BTC associated with a vulnerability affecting certain generations of Coldcard. The episode shows that a physical solution also depends on key generation, firmware, the supply chain and how the owner uses it.
Cold storage reduces certain digital risks.
It does not eliminate human risk.
A hardware wallet is not a USB drive filled with Bitcoin
The terminology can create another misleading image.
A hardware wallet sometimes resembles a USB drive. It would therefore be easy to think that bitcoins are copied onto the device.
That is not how it works.
The BTC remain on the blockchain.
The physical device mainly protects the information used to sign transactions.
This distinction explains what happens when a hardware wallet is destroyed.
Imagine that a device falls into water and becomes unusable.
The bitcoins do not automatically disappear.
With a correct backup of the recovery phrase and a compatible solution, the user can generally restore the keys on another device.
The backup is therefore the real critical point.
The device can be replaced.
The seed phrase, if it is unique and permanently lost, can create a much more serious problem.
Conversely, possessing the device without knowing the access code does not necessarily mean being able to steal the funds. Manufacturers add several protection mechanisms.
Users should nevertheless be wary of a hardware wallet bought second-hand, received already configured or supplied with a seed phrase supposedly ready for use.
A seed preprinted by someone else is no longer secret.
The usual best practice is to let the device generate the information according to its official procedure.
Then verify it.
Again and again.
Poor offline storage can be less secure than good online storage.
Writing the 24 words on paper and leaving that paper somewhere accessible to anyone does not create miraculous security.
Mobile wallets dominate through simplicity
For many users, their first real crypto wallet will be a mobile app.
And that is not unreasonable.
The smartphone offers a fairly effective combination: mobility, biometric authentication, possible backups, QR codes for addresses and an interface that is more intuitive than many desktop programs.
There are nevertheless several architectures.
Some wallets use a traditional seed phrase.
Others use multiparty computation, often called MPC, to distribute the information required for signing across several fragments.
BrefCrypto has already explained how Binance’s Web3 Wallet works and how its MPC architecture is designed.
The idea behind MPC is interesting: avoiding a single complete key serving as the only point of failure. Different cryptographic parts can be stored separately.
Other wallets are beginning to use social recovery mechanisms, passkeys or smart accounts.
The boundary between a traditional wallet and a digital account is therefore becoming progressively less rigid.
Even so, beginners should always answer one question before depositing a significant amount:
if I lose this phone tomorrow, how will I recover my funds?
If the answer is not clear, the wallet is not yet ready to hold a significant portion of someone’s savings.
Users should know the restoration procedure before they need it.
Not afterward.
A Web3 wallet does much more than store tokens
On Ethereum, Solana and other programmable blockchains, the crypto wallet has gradually taken on a new role.
It still serves to receive and send assets.
But it is also becoming a form of identity used to connect to applications.
A person opens a DEX.
They click “Connect Wallet.”
The application can then read the public address and offer different operations.
The wallet is then used to sign.
This is where many beginners make a mistake: connecting a wallet does not necessarily mean immediately handing over your crypto.
The real question is what is signed after the connection.
A simple signature can be used to prove that the user controls an address.
Another transaction can authorize a smart contract to spend a token.
These permissions can be very broad.
That is why you should not mechanically click “Confirm.”
Using Web3 requires reading at least the network being used, the asset involved, the contract address and the type of authorization requested.
Modern wallets try to translate this information into simpler language.
Attacks are improving in parallel.
Fake websites can almost perfectly reproduce the interfaces of legitimate projects.
A malicious authorization may be enough to put certain assets at risk.
A Web3 wallet is therefore no longer just a safe.
It is a signing interface.
And signing without understanding can be as dangerous as handing over a bank card together with its PIN.
Multiple blockchains quickly make management more complicated
A simple Bitcoin wallet can be relatively easy to understand.
A multichain wallet operates on a different scale.
Ethereum.
Solana.
Base.
Arbitrum.
Optimism.
BNB Chain.
Polygon.
Avalanche.
And sometimes dozens of other networks.
The same app can display several assets with exactly the same name while they operate on different blockchains.
USDT is an excellent example.
It can exist on Ethereum, Tron, Solana and other networks.
10 USDT on Ethereum and 10 USDT on Tron are intended to represent the same economic value.
Technically, however, they are not the same tokens in the same location.
The network selected when making a withdrawal is therefore essential.
This complexity explains why our report on crypto uses in the DRC specifically recommends carefully checking the network when transferring stablecoins and testing new addresses with small amounts.
The wallet must also hold the currency needed to pay network fees.
Holding only an ERC-20 token on Ethereum may not be enough to send it if there is no ETH available for gas.
The same logic applies elsewhere with native assets used to pay fees.
Beginners then discover a counterintuitive reality:
having the funds does not always mean being able to move them immediately.
A small amount of the native token may be required.
Understanding networks is therefore essential before making a multichain wallet your primary financial account.
Stablecoins are changing how crypto wallets are used
A crypto wallet is no longer used only to hold a speculative asset.
For millions of users, it can be used to hold tokenized dollars.
This distinction changes the experience.
Someone who buys Bitcoin may want to hold it for five years.
Someone who receives 300 USDT may simply want to pay a supplier tomorrow.
Our coverage of stablecoins and their significant concentration on exchanges shows how central these assets have become to crypto liquidity.
The wallet then becomes a kind of blockchain settlement account.
A freelancer can receive USDC.
A company can pay a supplier in USDT.
A user can transfer funds between two countries.
They can then potentially convert them into a local currency.
However, this use raises another security question: self-custody does not eliminate the risks specific to stablecoins.
USDT and USDC remain dependent on their issuers and reserves.
A wallet can perfectly protect the private key while the token itself faces a market problem, a regulatory freeze or a loss of its peg.
The security of the container must be distinguished from the quality of the asset.
An extremely strong safe does not automatically turn what it contains into a good investment.
The same reasoning applies to all tokens.
Choosing an excellent wallet does not make an altcoin safe.
Custody technology and financial risk are two different subjects.
Malware increasingly targets users
Why try to break Bitcoin or Ethereum directly when the owner can be deceived?
This is an important part of how attacks are evolving.
An infostealer installed on a computer can search for passwords, session cookies, browser data or wallet-related information.
Some malicious extensions imitate popular wallets.
Other attacks modify clipboard contents: the user copies a Bitcoin address, a program silently replaces it with the attacker’s address, and the victim approves the transaction without comparing the characters.
BrefCrypto recently documented malware campaigns targeting wallets and exchange accounts through fake content related to Claude.
The interesting point was not a compromise of the blockchain.
The attackers were targeting the user’s environment.
This explains several simple good practices.
Check the first and last characters of an address before sending.
Avoid installing unknown extensions.
Download apps only from their official sources.
Keep devices up to date.
For large portfolios, separate the wallet used daily from the one holding long-term savings.
This last approach resembles real life.
People do not normally walk around with all their savings in cash in one pocket.
There is no reason to connect your entire crypto portfolio to every new DeFi protocol tested on a Sunday evening either.
A hot wallet can be used for spending.
A cold wallet can hold savings.
Compartmentalization limits the damage when something goes wrong.
The seed phrase remains the critical point
An extremely sophisticated wallet can be compromised by a sheet of paper photographed at the wrong time.
It is almost ironic.
The cryptography can be robust.
Human backup practices are much less so.
Ethereum.org emphasizes a particularly clear principle: no legitimate person needs your recovery phrase. Whoever possesses it can take control of the corresponding accounts.
Screenshots are particularly risky.
A phone may automatically back up its photos to a cloud service.
A phrase thought to be “stored only on my smartphone” can then be copied to several servers.
The same problem applies to a text file.
seed.txt.
Simple.
Convenient.
A very bad filename to discover during a hack.
Users holding significant amounts can go much further: fire- and water-resistant physical backups, careful fragmentation, multisignature or separate storage.
The opposite extreme should be avoided.
A procedure so complicated that the owner can no longer reconstruct it is not good security.
Three years after setup, you should still understand how to recover the assets.
The question to ask is almost a family one: if the owner disappears, could someone trusted legally recover the assets according to the planned procedure?
Crypto makes it possible to hold assets that are extremely difficult to seize.
It can also make an inheritance extremely difficult to recover if no procedure has been planned.
Good security protects against attackers.
It also protects against forgetfulness.
Choosing a wallet mainly depends on how it will be used
There is no universally best crypto wallet.
It all depends on what it needs to do.
For 50 euros intended to explore Ethereum and a few applications, immediately buying several cold-storage devices would probably not make much sense.
For 100,000 euros in Bitcoin intended to remain untouched for ten years, leaving everything on a mobile app used daily deserves more consideration.
For a trader, liquidity available on the exchange is important.
For someone who only wants to hold BTC, reducing counterparty risk may become the priority.
For a DeFi user, compatibility with applications and an understanding of permissions matter greatly.
For everyday stablecoin payments, a fast mobile wallet may be more practical than a particularly cumbersome multisig procedure.
That is why the amount alone is not enough.
Frequency of use matters.
Technical expertise matters.
Recovery options matter.
The type of assets matters.
And jurisdiction can matter too, particularly when a wallet directly integrates buying or selling functions that depend on regulated intermediaries.
Above all, beware of a very crypto-native approach: seeking the most sophisticated system simply because it appears more professional.
Effective security is often boring.
A procedure that is understood, tested and repeatable is better than an impressive architecture that no one knows how to restore.
A good wallet never replaces good habits
You can buy the best hardware wallet available and still lose your crypto.
All it takes is entering the seed phrase on a fake website.
You can also use a free smartphone wallet for years without problems if your security practices are sound and the amounts are appropriate.
The tool matters.
Behavior matters more.
Before a large transfer, a small test remains one of the simplest habits.
Send the equivalent of 5 dollars.
Check that it arrived.
Then send the larger amount.
A few extra minutes can prevent an error that cannot be repaired.
The same logic applies to new Web3 applications: using a separate wallet reduces the potential impact of a bad authorization.
Privacy also deserves more attention.
A public address can be viewed on the blockchain. When the owner’s real identity is linked to that address, their holdings and certain transactions can become much easier to track.
A wallet is therefore not necessarily anonymous.
It is better described as pseudonymous, depending on the blockchain and how it is used.
And when the value held becomes significant, public exposure can even become a physical risk. Attackers no longer need to break the mathematics when they know exactly which person controls several million dollars.
Recent crypto theft cases also show how effective social engineering remains. A hardware wallet can protect a key very well against certain types of malware.
It cannot stop its owner from voluntarily signing a bad transaction after being manipulated.
The final layer of security will always be human.
So, which crypto wallet should you choose?
For a beginner, the best first decision is probably not choosing between twenty brands.
It is choosing an architecture.
Does the user want the company to hold the keys and provide account recovery?
Or do they want to control their assets themselves?
If they choose self-custody, do they want a mobile wallet for regular transactions or a cold solution for holding assets for several years?
Will they use Bitcoin only?
Ethereum and its tokens?
Several blockchains?
DeFi?
Stablecoins?
The answer quickly narrows down the list of relevant solutions.
The ideal wallet is therefore not necessarily the one that supports the largest number of cryptocurrencies.
It is the one that properly does what its owner actually needs.
A Bitcoin wallet dedicated exclusively to long-term storage can be deliberately limited.
A Web3 wallet, by contrast, must handle many more interactions.
The first prioritizes simplicity and a reduced attack surface.
The second prioritizes interoperability.
The trade-offs are different.
The absolute priority is to understand who owns the keys.
Then understand how to recover the wallet.
Then test the procedure with a small amount.
Only afterward should you increase the capital.
This is also the main difference between a crypto wallet and a conventional banking app.
At a bank, the user has an account within the institution’s system.
With self-custody, the user may directly possess the keys that enable the blockchain to recognize their transactions.
This freedom explains much of the appeal of Bitcoin and crypto.
It also explains their demands.
A crypto wallet does not automatically turn its user into “their own bank.”
Rather, it gives them the tools to take on some of the work that a bank, custodian or service provider would normally do on their behalf.
Secure access.
Verify transactions.
Store backups.
Prepare for recovery.
Avoid fraud.
For small amounts, this responsibility can be a learning experience.
For a significant portfolio, it becomes a genuine security architecture.
That is why the question “What is the best crypto wallet?” rarely has a one-name answer.
The more useful question is:
which risks do I want to control myself, and which risks am I willing to entrust to someone else?
Everything else follows from there.
