Your slice of crypto.

What Is a Crypto Wallet?

Owen Calder
Published

Updated

Illustration: an open pie tin holding a key instead of a pie, with a phone and a small hardware device either side.

General information only. This article explains what crypto wallets do and where their protection stops. It is not financial, legal or tax advice, and it does not recommend any wallet product, crypto platform or crypto asset. It is based on regulator guidance and published technical documentation, not hands-on testing of particular wallets. Last checked: 2 October 2026.

A crypto wallet is software or a physical device that manages the keys that control crypto. It stores or creates those keys, gives you addresses for receiving crypto, shows your balances, and uses your keys to approve transactions.

Despite the name, a wallet doesn’t hold crypto the way a leather wallet holds cash. The crypto is recorded on the network’s shared ledger. What the wallet holds, or gives you access to, is the means of controlling it. You will often see crypto described as being “kept in” a wallet, including by Moneysmart. That’s a fair shorthand, as long as you remember that whoever controls the keys controls the crypto.

This article covers what a wallet does, how software and hardware wallets differ, how custodial and self-custody arrangements differ, and how recovery works, and it marks where each of those protections stops. If the basic terms are new, start with What Is Cryptocurrency?

What a wallet does

An international standard for blockchain terms describes a wallet as an application used to generate, manage, store or use private and public keys, in software or as a hardware module. In practice, a wallet:

  • Keeps keys. Some wallets generate a whole family of keys from a single starting value, called a seed. Bitcoin’s BIP-32 standard is one way of doing this.
  • Gives you addresses that other people can send crypto to.
  • Shows your balances by reading the network’s ledger.
  • Approves transactions by using your keys to sign them.

Browser-based wallets can also connect to blockchain-based apps, so you can use your account with them directly.

Keys

Most conventional wallets rely on public/private key cryptography. The private key is secret and authorises transactions. The public key is generated from it and can be shared, because it lets others check a signature without learning the private key.

Not every wallet works this way. On Ethereum, for example, some accounts are smart contracts controlled by code rather than directly by a private key, and a wallet can be an interface to either kind of account. Some set-ups also need more than one approval before a transaction goes through; Bitcoin, for instance, supports multi-signature transactions.

Whatever the design, control of the keys means control of the crypto. If a private key is stolen, the thief has full access to what it controls. If it is lost and there’s no backup, it generally can’t be recreated. As the ATO puts it, you can’t recover a lost private key. Understanding Private Keys & Seed Phrases covers keys in more depth.

Addresses

An address is what you share so people can send you crypto. It works a little like an account number, but there’s no bank behind it checking whether a payment looks wrong. How an address is made depends on the network and the type of account. On Ethereum, an ordinary account’s address is derived from its public key, while a smart contract’s address comes from details of how the contract was created.

Three things about addresses catch people out:

  • They are public. On networks such as Bitcoin, anyone can see amounts moving between addresses, although the ledger doesn’t show names. Once an address is linked to you, for example through a crypto platform that has verified your identity, its history can be connected to you too.
  • The network matters as well as the address. Some networks use the same address format, so an address can look valid on a network you didn’t intend. Ethereum’s documentation notes, for instance, that one account can be used across different Ethereum networks while its balances stay separate on each. Crypto sent on the wrong network may not arrive where you expect.
  • Lookalike addresses are a known trick. Researchers have documented scammers creating addresses that look similar to ones you have used, then sending small transactions so the fake address appears in your transaction history, ready to be copied by mistake. Check the full address against a source you trust, not your history.

How to Buy Crypto Safely in Australia sets out the checks to make before sending, including a small test transfer.

Signing

When you send crypto, your wallet builds a transaction and asks you to approve it. On networks such as Bitcoin and Ethereum, approving usually uses a private key to produce a digital signature that anyone on the network can check. The signature shows the transaction was authorised by whoever controls the key without revealing the key, and transactions that have been forged or altered are rejected.

Apps you connect a wallet to can also ask you to sign messages or approve permissions, such as allowing a smart contract to spend some of your tokens. Ethereum’s security guidance warns that an unlimited spending permission could let a contract drain your wallet, and recommends reading what you are approving before you sign.

What signing does

Proves that whoever controls the key authorised this specific transaction, so someone without control of your keys can’t move crypto from your addresses.

What it doesn’t protect you from

Approving the wrong thing. A signature on a scammer’s transaction is still a valid signature, and a spending permission you give an app can be used later. Unexpected tokens can be bait: Moneysmart warns that trying to sell a mystery token that appears in your wallet can trigger a smart contract that takes your other crypto.

Software wallets and hardware wallets

Wallets are usually grouped by where the keys are kept.

Software wallets are apps on a phone or computer, or browser extensions. The device is usually connected to the internet, and Moneysmart calls these “hot” wallets. They are quick to use and are protected by the device’s security and the wallet’s own password or PIN. Their weak point is the device itself. Moneysmart warns that a hacker can potentially steal what’s in a digital wallet, and that many scam browser add-ons and programs that link to your crypto look legitimate.

Hardware wallets are separate physical devices designed to keep private keys away from your internet-connected computer or phone. Moneysmart describes them as storing private keys on a secure device that isn’t connected to the internet, and calls them “cold” wallets. In a typical set-up, you connect the device when you want to make a transaction and confirm it on the device, but how this works varies between devices and set-ups.

Both kinds can be used for self-custody, where you hold the keys. A custodial crypto platform account is another software interface, but in that case the platform holds the keys on your behalf. Moneysmart notes that a software wallet can be held by you or by a platform on your behalf.

What a hardware wallet does

Keeps private keys on a separate device designed to keep them away from your computer or phone, which makes it much harder for malware on those devices to copy them.

What it doesn’t protect you from

Exposure of your seed phrase: in a conventional seed-based wallet, anyone who gets it may be able to recreate your keys without your device. It also doesn’t stop you approving a scammer’s transaction, sending to a lookalike or wrong-network address, or being talked into moving crypto. Australian authorities have warned about scammers posing as police who told people to move crypto into a “cold storage” account that the criminals controlled.

Custodial and self-custody

Custody comes down to one question: who controls the keys?

Australian regulators draw the line in the same place. In its guidance on digital assets that are financial products, ASIC says that a business controlling the private keys for an address is likely to be providing a custodial service, while offering a self-custody or “self-hosted” wallet product is unlikely to be. AUSTRAC’s guidance similarly distinguishes a “custodial” wallet from a “self-hosted” wallet controlled by its user.

On EatCryptoPie, custodial and self-custody are the general terms, and platform custody means the common case where the crypto platform you bought from holds the keys for you. You may also see self-custody called “self-hosted” or “non-custodial”.

Platform custody

In a custodial arrangement, a business holds the keys and moves crypto on your instructions. The most common example is leaving crypto on a crypto platform (often called an exchange) after you buy it.

What you see in the platform’s app is the platform’s record of what it holds for you. The crypto itself sits at addresses the platform controls and may be pooled with other customers’ crypto. ASIC allows pooled (“omnibus”) holding, under conditions, for digital assets that are financial products.

Australian rules for custodial providers are tightening, but the protection is still narrower than many people assume:

  • AUSTRAC registration. Holding crypto for customers is what AUSTRAC calls a virtual asset safekeeping service, which needs registration under anti-money-laundering law. Businesses that started a newly covered service before 1 July 2026 had until 29 July 2026 to apply, so some may be operating while AUSTRAC decides. Registration concerns anti-money-laundering obligations. It isn’t protection for your crypto if the business fails or is hacked.
  • New platform licensing. Under the Corporations Amendment (Digital Assets Framework) Act 2026, operators of digital asset platforms (broadly, facilities where a business holds crypto for or on behalf of customers) will need an Australian financial services licence from 8 April 2027. A six-month transition period, plus continued operation while ASIC decides applications made in that period, means not every platform will be licensed from that day.
  • Licensing today. Moneysmart warns that many crypto providers are not licensed, and you may not be protected if a platform fails or is hacked.
  • Not a bank deposit. Crypto on a platform isn’t an Australian-dollar deposit with a bank, so it falls outside the government’s Financial Claims Scheme.

What platform custody does

Takes key management off your hands. You typically aren’t responsible for managing the keys or seed material behind the platform’s own wallets. Your access runs through your account, which you can usually recover through the platform’s own process if you forget your password. Multi-factor authentication, which requires more than one proof of identity to log in, makes it harder for someone else to get into that account.

What it doesn’t protect you from

The platform failing, being hacked or freezing withdrawals. You depend on it staying secure, solvent and honest, and on it letting you withdraw when you ask. AUSTRAC registration isn’t a guarantee of the platform’s safety, and the Financial Claims Scheme doesn’t apply. Multi-factor authentication also doesn’t stop you being persuaded to move crypto out yourself: Scamwatch has warned about scammers posing as police or platform staff who ask people to transfer crypto out of their account “to secure it”.

Self-custody

In self-custody, you hold the keys, usually in a software or hardware wallet you control, and the wallet usually gives you a seed phrase as a backup when you set it up. The trade is control for responsibility. Securing and backing up the wallet is up to you, and there is no password reset or support line that can restore access.

What self-custody does

Removes your reliance on a custodian that controls withdrawals. If a platform fails, freezes withdrawals or is hacked, crypto you hold in self-custody isn’t held by that platform.

What it doesn’t protect you from

Controls built into a crypto asset itself. Some tokens are issued with them: the terms for the USDC stablecoin, for example, let its issuer block transfers of USDC to and from particular addresses on the blockchain, including addresses in self-custody. It also doesn’t protect you from losing both your wallet and your seed phrase, from someone else getting your seed phrase, or from your own mistakes, such as approving a malicious transaction. And bitcoin.org warns that funds can be lost for good if no one else knows where your wallet is or how to access it, which matters for your family or executor.

Choosing between them

EatCryptoPie doesn’t recommend one arrangement over the other. Neither is free of risk, and the right fit depends on your circumstances and on which risks you are better placed to manage. It helps to be able to answer these questions:

  • Who controls the keys?
  • If I lose my phone, device or password, what is the recovery process, and who runs it?
  • If the business involved fails, is hacked or freezes withdrawals, what happens to my crypto?
  • Where is my seed phrase, and who else could see it?

Recovery: what happens if you lose access

How you get access back depends on who holds the keys.

With platform custody, recovery is an account process run by the platform, usually resetting your password and confirming your identity. It depends on the platform still operating and being willing to restore your access.

With self-custody, recovery usually depends on your seed phrase, sometimes called a recovery phrase: a list of words from which a wallet can recreate your keys. Under the BIP-39 standard, a seed phrase is 12, 15, 18, 21 or 24 words long; other wallet designs can differ. In a wallet that generates all its keys from one seed, the phrase backs up every key the wallet has made. Ethereum’s documentation describes it as the only way you’ll be able to recover the wallet.

In practice:

  • Losing your phone or hardware wallet doesn’t have to mean losing the crypto, as long as you still have the seed phrase.
  • Losing the device and the seed phrase usually does.
  • Anyone who has your seed phrase may be able to recreate your keys without your device.

How to store a seed phrase is covered in Understanding Private Keys & Seed Phrases. One point belongs here: bitcoin.org warns that any backup stored online is highly vulnerable to theft, and that includes a photo, an email or a cloud note.

What a seed phrase does

Lets you restore your wallet’s keys on a new device or in compatible wallet software if your phone or hardware wallet is lost, stolen or broken.

What it doesn’t protect you from

Anyone who sees it. In a conventional seed-based wallet, someone who gets the seed phrase may be able to recreate the wallet’s keys without the original device, which is why no legitimate service, support agent or police officer will ask for it. If you lose both the phrase and the device, there is generally no one who can restore your access.

Losing access for good can also have tax consequences. The ATO has guidance on lost or stolen crypto, including the evidence it expects, and Crypto Taxes in Australia explains how the rules apply.

Wallet warning signs

Crypto transfers are hard to recover, so these wallet-specific requests should make you stop:

  • Anyone asking for your seed phrase or private key, for any reason.
  • Being told to move crypto to a “safe”, “secure” or “cold storage” wallet by someone who contacted you.
  • Unexpected tokens or NFTs in your wallet, especially ones that send you to a website to claim or sell them.
  • Requests to approve unlimited spending, or to sign something you don’t understand.
  • Wallet software or browser add-ons reached through a link, message or ad rather than a source you have checked yourself.

Avoiding Crypto Scams and Staying Safe covers other scams and what to do if something goes wrong.

The bottom line

A crypto wallet manages keys. It doesn’t hold your crypto, insure it or make it safe on its own. The questions that matter are who controls the keys, how you would get access back, and what you are approving each time you sign. Every kind of wallet and every custody arrangement leaves some risks with you.

If you are about to move crypto off a platform for the first time, How to Buy Crypto Safely in Australia covers the checks to make first.

Sources

Last checked 2 October 2026.

Previous article:
Next article: