Crypto Wallet Types: Exchange, Software and Hardware Wallets
Lesson 5 of 10 · Beginner
What does a crypto wallet actually hold?
The name “wallet” is a little misleading. Crypto is never inside your phone or device; it is always recorded on the blockchain ledger. What a wallet holds is your private keys: the thing that lets you spend from an address. So the central question for any wallet is: who holds the key?
On that basis, wallets fall into two big families:
- Custodial: a company, usually an exchange, holds the key. You have a user account, and your balance is a number in that company's internal books.
- Non-custodial or self-custody: you hold the key, whether in a phone app or on a hardware device. Nobody but you can spend from it, and nobody but you can rescue it.
Exchange wallets (custodial): convenient, but with an intermediary
When you buy crypto on an exchange and leave it there, you are using a custodial wallet. Advantages: an easy start, password recovery, fast trading and no worry about losing a recovery phrase.
Risks: your holding is effectively a claim on the exchange. If the exchange is hacked, goes bankrupt, freezes the account for any reason or cuts your access, you depend on that company's decisions. For example, according to BleepingComputer, the Nobitex exchange was hit by an attack in June 2025 that destroyed about 90 million dollars of assets. International exchanges also screen accounts for sanctions and anti-money-laundering compliance throughout the life of the account. We cover this in more depth in the exchanges lesson.
If you use an exchange wallet, follow the minimums: two-factor login with an authenticator app rather than SMS, a unique password used nowhere else, a withdrawal address allowlist if the exchange offers one, and no more money on the exchange than your trading needs.
Software wallets (hot): the key on a phone or browser
Mobile wallets and browser extensions keep the key on your device, usually encrypted. Because the device is online, they are called hot wallets. They suit everyday use, connecting to DeFi apps and small amounts.
Main risks:
- Fake apps: according to BleepingComputer, in April 2026 a fake version of the Ledger Live app on Apple's App Store took about 9.5 million dollars from roughly 50 victims by harvesting their recovery phrases. Even official stores can host fake apps, so get the download link only from the maker's official site.
- Malware and remote access: anything running on your device can potentially reach the key or the clipboard.
- Hasty signing: most wallet drains come from signing a malicious transaction or approval, not from cracking a password.
A reminder: some wallet apps and their infrastructure services restrict users in certain countries under their own rules. Your key stays valid on the blockchain, but access through a particular app can be cut off. Decrypt reported one example in March 2022, when MetaMask's default infrastructure provider restricted users in sanctioned regions.
Hardware wallets (cold): the key stays off the internet
A hardware wallet is a small device that stores the private key in a secure chip and never hands it to the computer or phone. The transaction is built on the computer, but the signing happens inside the device, and you must confirm the details on the device's own screen. That is why malware on a computer cannot steal the key on its own.
But “hardware” does not mean “unhackable”:
- If you type your recovery phrase into a fake site or app, the device cannot help you.
- If you approve an unlimited approval or a malicious transaction on the device screen, the device will happily sign it.
- Buy the device only from the official seller; a device that arrives with a pre-written recovery phrase has certainly been tampered with.
“Not your keys, not your coins”, without dogma
The famous saying is true, but incomplete. Self-custody removes counterparty risk and puts full responsibility on you instead. For someone who has not yet learned backups and safe signing, self-custody may be more dangerous than an exchange.
| Type | Who holds the key | Main risk |
| Exchange | The company | Hack, insolvency, account freeze |
| Software | You (on an online device) | Malware, fake app, malicious signature |
| Hardware | You (on an offline device) | Lost recovery phrase, malicious signature |
A balanced pattern for many people: a “vault” wallet (usually hardware) for larger sums that rarely connects anywhere, and a separate small “hot” wallet for everyday use. None of these options protects an asset from risks such as a token being frozen by its issuer.
Common mistakes
- Thinking crypto is stored inside the phone or device; the wallet only holds the key.
- Downloading a wallet from an ad link or store search without checking the publisher and the official site.
- Buying a second-hand hardware wallet or one from an unreliable seller.
- Believing a hardware wallet stops you from signing malicious approvals.
- Keeping all assets in one hot wallet connected to dozens of sites.
- Moving to self-custody without learning backup and recovery.
What do volume and data say here?
A simple exercise makes the difference between custodial and self-custody clear. Search your personal wallet address in the explorer for its network (Etherscan, Tronscan and so on): you can see the balance and every transaction directly on the blockchain. That is what is really yours.
Your balance on an exchange, however, you cannot see in the same way. Exchanges usually hold users' assets in a few large pooled wallets, and each user's share is recorded only in the company's internal books. The deposit address an exchange gives you is typically swept into those pooled wallets after you pay in.
A practical tip: to keep an eye on your “vault” wallet you do not need to connect the device every time. You can enter the address in an explorer or in a “watch-only” wallet; this does not need a recovery phrase and must not require one. If a service asks for a recovery phrase to “view your balance”, it is a scam.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
What is the best crypto wallet?
We do not recommend a specific brand. The right choice depends on the amount, your technical knowledge and your needs: an exchange is simplest for starting out but involves an intermediary, a software wallet suits small everyday amounts, and a hardware wallet suits long-term storage of larger sums.
What is the difference between a cold and a hot wallet?
In a hot wallet the key sits on an internet-connected device. In a cold wallet the key sits on a device that never exposes it and signs inside itself. Cold is safer against malware, but it does not stop you from signing a malicious transaction.
If a wallet app is restricted in my country, do I lose my assets?
The assets are recorded on the blockchain and stay reachable with your recovery phrase, but services can restrict access through their own apps, and tokens like USDT can be frozen by the issuer. We do not teach ways to get around restrictions.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.