Public key, private key, recovery phrase, self-custody or custody by a third party: what it means, which risks it carries and which basic rules to follow.
Whoever owns cryptocurrency owns, in practice, keys. Understanding what they are, where they are and who controls them is the most important step for a beginner. This article explains the essential concepts and basic rules, drawing on the Bitcoin and Ethereum documentation.
What a wallet is
According to the Ethereum documentation, a wallet is an app or device that lets you hold, send and receive ETH and other tokens and sign in to apps. It does not contain coins the way a purse contains banknotes: it is a window onto your account on the blockchain, with the tools to manage it. This is why you can change wallet provider without losing the account, and why the wallet provider does not, in itself, have custody of the funds.
Private key and recovery phrase
Every account is controlled by a private key: whoever has it can move the funds. The recovery phrase, also called seed phrase, is the master key of the wallet: the Ethereum documentation warns that anyone who has it can access all accounts and drain them, and that no legitimate service, support agent or website will ever ask for it. One point that surprises beginners: transactions on Ethereum are irreversible. If you send to a wrong address, unless you can persuade the owner to return the funds, there is no way to retrieve them. The same principle applies to Bitcoin.
Self-custody or custody by a third party
There are two models. In self-custody the user manages the keys and takes on the responsibility of keeping them. In custody by a third party the keys are controlled by someone else, for example an exchange. Bitcoin.org observes that when a third party controls the keys, you rely entirely on its security and honesty, and that history has shown exchanges and online wallets can be hacked, fail or freeze access to funds. It advises, whenever practical, holding your own keys and, if you use a custodial service, choosing it carefully and enabling strong multi-factor authentication.
Neither model is free of risk. With self-custody, losing the recovery phrase can mean losing the funds for good. With custody by a third party you depend on an outside entity. For companies, the choice depends on in-house skills, volumes and regulatory obligations.
Types of wallet
Bitcoin.org suggests keeping only small amounts on a computer or phone for everyday use, as in a cash wallet, and using an offline wallet for savings. In common terms: wallets connected to the internet are convenient but more exposed, offline ones are less convenient but better protected. Hardware wallets are devices that keep private keys offline: according to Ethereum they are considered the most secure option, because the key never touches the internet and stays on the device.
Basic rules
The cited sources yield a few practical rules:
- never share the recovery phrase or private keys, with anyone and for any reason;
- do not take screenshots of recovery phrases, because they might be synced to a cloud service and become accessible to others;
- check the address carefully before sending, because a transaction cannot be undone;
- make backups of the wallet, encrypt them and keep them in several secure places;
- keep software up to date;
- consider multi-signature to protect against theft, which requires several keys to authorise a movement;
- think about succession: Bitcoin.org invites you to consider what happens to the funds if the holder can no longer be reached, and for a company the same applies to authorised persons.
A recent case on choosing the device
In October 2026 there was discussion of the case of Ledger devices sold by a reseller, with withdrawals estimated by analytics firms at up to about $93 million. According to CoinDesk, Ledger confirmed an unauthorised hardware implant in at least one device and advised the customers involved not to set up unused devices and to move funds to a new device with a new recovery phrase. The figures are not confirmed by the manufacturer. The case is a reminder that a hardware wallet should be bought in a controlled way, but it does not change the general picture described above.
For companies
Whoever holds digital assets for the company should separate roles, use several signers for significant movements, keep an inventory of devices and document who can do what. These are governance criteria, the same ones that apply to a bank account.
Sources
- Bitcoin.org, Securing your wallet: https://bitcoin.org/en/secure-your-wallet
- ethereum.org, Ethereum wallets: https://ethereum.org/en/wallets/
- ethereum.org, Ethereum security and scam prevention: https://ethereum.org/en/security/
- CoinDesk, Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen, 12 October 2026: https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen
Information, not advice.
