Crypto wallets, keys and seed phrases

The word wallet is a little misleading. Your crypto is recorded on the blockchain, not stored in an app or device. What a wallet actually holds is your private key: the secret that lets you authorise transfers. Whoever holds the key controls the crypto. Understanding this one idea is the best protection you have against loss and theft.

Keys and addresses

• Public address: like an account number. You share it to receive crypto.
• Private key: like a master password that can never be reset. It signs transactions.
• Seed phrase: a list of usually 12 or 24 words that can regenerate your private keys. Effectively, the seed phrase is your crypto.

Custodial versus self-custody

When a platform holds your crypto, you are relying on its security, honesty and solvency. Crypto platform collapses overseas have left customers unable to withdraw. Australian reforms will require digital asset and custody platforms to hold a financial services licence once the new framework commences. Read crypto regulation in Australia.

Hot and cold wallets

• Hot wallets: software on your phone, computer or browser, connected to the internet. Convenient, but exposed to malware, phishing and device theft.
• Cold wallets: keys kept offline, typically on a hardware device. Less exposed to online attacks, but can be lost, damaged or bought tampered with.

Good security habits

• Write your seed phrase down on paper or metal and store it somewhere secure; consider fire and flood.
• Never photograph it, type it into a website or store it in email, cloud notes or messaging apps.
• Buy hardware wallets only from the manufacturer or an authorised seller, and never use one that arrives with a seed phrase already written.
• Use strong, unique passwords and an authenticator app for exchange accounts.
• Keep devices and apps updated.
• Send a small test transaction before a large one, and check every character of the address.
• Be wary of browser extensions, unsolicited links and "wallet validation" requests.

Scams that target wallets

• Fake support: scammers pose as exchange or wallet support and ask for your seed phrase.
• Phishing sites and fake apps that look like real wallets.
• Wallet drainers: malicious approvals that let a smart contract empty your wallet.
• Address-swapping malware that replaces copied addresses.
• Recovery scams: people promising to recover lost crypto for a fee.

If you think your keys or identity have been compromised, contact IDCARE, Australia's identity and cyber support service, and report scams to Scamwatch. Read crypto scams explained.

Planning for the unexpected

Crypto can be lost forever if no one else can access it. Think about how a trusted person could access it if something happened to you, without exposing your keys today. A lawyer can help with estate planning.

Key terms

• Custodial wallet: a platform holds the keys on your behalf.
• Non-custodial wallet: you hold the keys yourself.
• Hardware wallet: a physical device that keeps keys offline and signs transactions.
• Multisig: a wallet that needs more than one key to approve a transaction, reducing single points of failure.
• Passphrase: an optional extra word added to a seed phrase in some wallets, creating a separate hidden wallet.
• Token approval: permission you give a smart contract to move your tokens; malicious approvals are a common way wallets get drained.
• Address poisoning: a scam where small transactions from lookalike addresses appear in your history, hoping you copy the wrong one.

Regularly reviewing and revoking unused token approvals, and always checking the full address rather than the first and last few characters, reduces these risks.

The bottom line

Your keys are your crypto. Whether you use a platform or hold your own keys, understand who controls them, keep your seed phrase secret, and treat anyone who asks for it as a scammer.