A wallet is a keypair, not a piggy bank
When you install MetaMask or Phantom, the wallet generates a private key: a 256-bit random number. From that key, it derives:
- Public key (via elliptic-curve math — secp256k1 for BTC/ETH, ed25519 for SOL)
- Address (last 20 bytes of keccak256(public key), prefixed with
0x on EVM chains)
That's it. The "coins" are not in your wallet. They're entries in the blockchain's database that say *"address 0xABC… has 1.3 ETH"*. Your wallet just proves you control 0xABC by signing transactions with the private key.
Why this matters
- Lose the key → lose everything. There is no password reset. Ever.
- Share the key → lose everything. Anyone with the key IS you on chain.
- A seed phrase (12-24 words) is a human-readable encoding of your key, typically following BIP-39. Same rules apply.
Hot vs cold
- Hot wallet: key lives on an internet-connected device (your phone, browser extension). Convenient, bigger attack surface.
- Cold wallet: key lives on a device that never touches the internet (Ledger, Trezor, or a piece of paper). You sign transactions offline, broadcast them online.
For anything > $1000 you're willing to lose, use cold.