Tier 2 · Essentials · Crypto · Module CR.2
Wallets, custody, and security
Custodial vs self-custody, hot vs cold wallets, seed phrases, and the practical security habits that protect crypto from the most common threats — phishing, approvals, and address mistakes.
Lesson 2 of 2 · 5 min read
In traditional markets, if someone steals your password, your bank or broker can often reverse the damage. In crypto, a stolen seed phrase or a signed malicious transaction is usually final. That makes security a trading skill in its own right: the best strategy in the world doesn't help if the account is emptied. This lesson covers how crypto custody works and the habits that prevent the most common and costly mistakes.
What you'll learn
- Custodial vs non-custodial (self-custody) wallets
- Hot wallets vs cold wallets, and when to use each
- What a seed phrase is — and how to protect it
- The most common attacks: phishing, malicious approvals, address poisoning, SIM swaps
- A practical security setup for an active trader
1. What a wallet actually holds
A crypto wallet doesn't "hold coins". Coins exist on the blockchain. A wallet holds the private keys that prove you control them and allow you to sign transactions.
Whoever controls the private keys controls the funds.
2. Custodial vs self-custody
| Custodial | Self-custody (non-custodial) | |
|---|---|---|
| Who holds the keys | A company (e.g. an exchange) | You |
| Recovery if you forget your password | Usually possible through the company | Only via your seed phrase |
| Main risk | The company fails, freezes withdrawals, or is hacked | You lose your keys or are tricked into giving them away |
| Best for | Funds actively traded on that exchange | Funds you hold for longer |
Most active traders use both: trading funds on an exchange, and savings in self-custody.
3. Hot vs cold wallets
| Type | What it is | Trade-off |
|---|---|---|
| Hot wallet | Software connected to the internet (browser extension, mobile app) | Convenient for frequent use; more exposed to malware and phishing |
| Cold wallet | Keys kept offline — typically a hardware wallet | Much harder to attack remotely; less convenient |
A common setup: a hardware wallet for long-term holdings, a hot wallet with a limited balance for DeFi activity, and an exchange account for active trading.
4. The seed phrase
When you create a self-custody wallet, you're given a seed phrase (recovery phrase) — usually 12 or 24 words. It can regenerate all of the wallet's keys on any device.
Rules that are not optional:
- Write it down offline (paper or metal). Never store it in a photo, email, cloud note, or password manager that syncs online.
- Keep it somewhere secure, and consider a second copy in a separate secure location.
- Never type it into a website, and never share it — with anyone, including anyone claiming to be support staff.
5. Common attacks and how to prevent them
| Attack | How it works | Defence |
|---|---|---|
| Phishing | Fake websites, ads, or messages imitating exchanges or wallets | Bookmark official sites; never click links in unsolicited messages; check the exact URL |
| Malicious approvals | A contract you approve is allowed to spend your tokens — and drains them later | Read what you're signing; approve only what's needed; review and revoke old approvals periodically |
| Address poisoning | Attackers send tiny transactions from an address that looks like one you've used, hoping you copy it from your history | Always verify the full address; use saved, verified addresses; send a small test transaction first |
| SIM swap | An attacker takes over your phone number to intercept SMS codes | Use an authenticator app or hardware security key for 2FA, not SMS |
| Fake support | Scammers in chats or social media offer "help" | Only use support through the official site or app |
Worked example: the test transaction
(Illustrative.) You're moving 2 ETH from an exchange to your hardware wallet.
- Copy the receiving address from the hardware wallet, and confirm it on the device's own screen.
- Send a small test amount first.
- Confirm it arrived in the right wallet.
- Send the remainder.
The extra network fee is tiny compared with the cost of a mistake that can't be reversed.
6. A practical setup for a trader
- Exchange account: strong unique password, authenticator-app 2FA, withdrawal address whitelisting (if offered), and only active trading funds.
- Hardware wallet: for longer-term holdings; seed phrase stored offline.
- Separate hot wallet for DeFi, with a limited balance.
- Dedicated email for crypto accounts, with 2FA.
- Regular review: check exchange login history and revoke unused token approvals.
Common beginner mistakes
- Storing a seed phrase digitally — photos, notes apps, cloud drives.
- Using SMS for two-factor authentication.
- Copying addresses from transaction history instead of a verified source.
- Approving unlimited token spending for every app.
- Keeping everything on one exchange "because it's big".
Key terms
| Term | Meaning |
|---|---|
| Private key | The secret that proves control of crypto funds |
| Seed (recovery) phrase | Words that can regenerate a wallet's private keys |
| Custodial wallet | A third party holds the keys |
| Self-custody | You hold the keys |
| Hot wallet | Keys on an internet-connected device |
| Cold / hardware wallet | Keys kept offline on a dedicated device |
| Token approval | Permission for a smart contract to spend your tokens |
| Address poisoning | Tricking you into copying a look-alike address |
Practice
- Switch every crypto-related account to authenticator-app or hardware-key 2FA.
- Enable withdrawal address whitelisting on your exchange, if offered.
- If you use a self-custody wallet, check that your seed phrase is stored offline — and nowhere else.
- Use a token-approval checker for your wallet and revoke approvals you no longer need.
Quick recap
- A wallet holds private keys — control of the keys is control of the funds.
- Use custodial accounts for active trading and self-custody for longer-term holdings.
- Cold (hardware) wallets are far safer than hot wallets for savings.
- Your seed phrase stays offline and is never shared — no exceptions.
- Defend against phishing, malicious approvals, address poisoning, and SIM swaps with simple habits.
Educational content only — not financial advice. Trading involves substantial risk of loss. Practise on a demo account before risking real money.
Track your progress
Mark lessons complete, see your Essentials progress, and move up the 7-tier path.
Continue in Trading School