What is a crypto wallet?
And where the seed phrase actually goes.

The one sentence that matters: if your coins are off the exchange they are yours, and if they are on the exchange they are not. Not your keys, not your coins — fifteen years into Bitcoin's existence, this is still the line the market re-validates every three years or so, usually through some spectacular failure that costs retail billions of dollars. This piece walks through what a self-custodial wallet is, how to set up MetaMask without immediately getting drained, where to actually put the seed phrase, and how to read an approve request before you click sign.

§1 · Where your coins actually live right now

On the exchange — you hold an IOU

You bought 0.1 BTC on Binance or Coinbase. Your dashboard says "Balance: 0.1 BTC." The 0.1 BTC is not actually in your hands. It is sitting in one of the exchange's hot wallets or cold storage vaults, and a row in their database says: this user is owed 0.1 BTC. The balance you see on the screen is, mechanically, an IOU the exchange has issued to you. During the week FTX failed in November 2022, the hashtag #notyourkeysnotyourcoins trended on Twitter for days — because hundreds of thousands of users discovered, in real time, that their account balance had been a database entry the whole time and the underlying coins were gone.

Exchange goes down, the IOU evaporates. FTX in 2022 wiped out the screen balances of roughly a million customers; many of them got partial recoveries years later through the bankruptcy process, but a lot of people who had life savings on the platform watched the number on the dashboard quietly become unenforceable. After that event I stopped keeping more than two weeks of trading float on any exchange. The rest moves to self-custody the same day.

Self-custody — you actually own the coins

A self-custodial wallet is one where you hold the private key. The private key is a long string of cryptographic material that only you know. Knowing the key is the only way to authorize a transfer of the coins, and the network does not care who you are, only whether the signature is valid. Nobody can freeze the account. Nobody can refuse a withdrawal. Nobody can take the platform offline and run away with the deposits.

The cost is that there is no customer support anymore. Lose the key, lose the coins. There is no help desk, no password reset, no "I forgot, please send me a recovery link" form. Send to the wrong address, the funds are gone — blockchain transactions are irreversible by design. Self-custody is in essence the act of accepting that responsibility yourself, in exchange for the certainty that no third party can ever rugpull you.

§2 · The five kinds of wallet, ranked honestly

The combination I recommend for almost every newcomer is the same one I run myself: exchange + MetaMask + Ledger. Trading float lives on the exchange, DeFi activity goes through MetaMask, and the long-term stack sits on a Ledger that almost never gets plugged in.

§3 · MetaMask first-time setup, step by step

Step 1 · Download from the official site, and only the official site

Type metamask.io directly into the address bar. Watch the spelling — phishing sites named metamesk, metamaks, metamask-io, metamask-login and a hundred other typos all exist, all look identical to the real thing, and all exist for exactly one purpose: you type your seed phrase into the import screen and they immediately drain everything. Hand-type the domain. Never click the top result on a Google search for the wallet name — paid search ads for "MetaMask" have been the single most reliable phishing vector for several years now, because Google does not vet ads as carefully as it vets the organic results.

Step 2 · Create a fresh wallet

Open the browser extension and click "Create a new wallet" — explicitly not "Import," which is the entry path for an existing seed phrase and is therefore the path the phishers want you on. Pick a strong password. This password unlocks the wallet on this specific device; losing it does not put the coins at risk because the seed phrase, which you are about to write down, is the actual recovery mechanism. Use fifteen or more characters with mixed case, numbers and symbols. A password manager (1Password, Bitwarden, the browser's built-in one) is fine for this layer — but not for the seed phrase itself, which we'll cover next.

Step 3 · The twelve English words — this is the part that actually matters

MetaMask will show you a list of twelve English words. This is the seed phrase (also called the mnemonic, recovery phrase, or BIP-39 phrase). The order matters. The spelling matters. The capitalization does not, but every other property does. These twelve words deterministically generate every private key the wallet will ever produce. Anybody who has them can import the wallet anywhere on earth and walk away with everything in it. The phrase is the wallet, and the file on your laptop is just a convenience copy of it.

Step 4 · Write it down on paper, by hand

Use a pen and a sheet of paper. Do not:

• Take a screenshot — the photo will auto-sync to iCloud or Google Photos, and if either of those accounts ever gets compromised, the seed phrase goes with it.
• Store it in a password manager — if the password manager is breached, every wallet stored in it goes too.
• Email it to yourself — email inboxes have been the source of more seed-phrase compromises than I can count.
• Drop it on Dropbox / Google Drive / iCloud Drive — these have been compromised more often than people think, and there is no recovery once the file is exfiltrated.
• Hand it to a trusted friend "just in case" — relationships change, and there is no contract that survives a thirty-six-word PDF.
• Memorize it — you think you remember it, but three months from now the order will be subtly wrong and the wallet will be unrecoverable.

Write it twice. Store the two copies in two physically separate locations — for example, a fireproof box at home and a safety deposit box at a bank.

Step 5 · Upgrading the seed phrase storage when the balance grows

Paper is vulnerable to fire, water, humidity and silverfish. Once the wallet holds five figures or more in USD, it makes sense to spend forty to two hundred dollars on a metal seed plate — Cryptosteel, Billfodl, Stamp Seed and a half-dozen other vendors sell stainless plates that you stamp or punch the words into. The plate then survives house fires and floods, both of which have wiped out paper backups for people I know personally.

The next tier of paranoia: split the twelve words into two or three shares using Shamir's Secret Sharing, so that no single share is enough to reconstruct the seed — you need any two of the three to recover. Trezor Safe 5 supports this natively. The benefit is that the shares can live in three different locations (home, parents, lawyer) and any one being compromised does not lose the wallet. The downside is that the scheme is irreversible: if you accidentally lose two shares, the wallet is permanently gone.

§4 · Two real incidents, both close to home

§5 · Approve, in detail — what it is and why it is dangerous

In the ERC-20 token standard, any contract that wants to transfer your tokens has to be pre-authorized by you first. Concrete example: you want to swap USDC for ETH on Uniswap. The very first time you do this, the wallet prompts you to approve the Uniswap router contract — that is, to grant it permission to move your USDC on your behalf. This design is what makes DeFi swaps possible in two clicks instead of six. It is not, in itself, a bug.

The vulnerability is that approvals can be granted in unlimited size. Uniswap by default asks for an unlimited approval, because limiting the size would mean you have to re-approve before every single swap. One signature authorizes the router to move every USDC you will ever hold in this address. Uniswap itself will not abuse this — the router's code is audited and only moves USDC during the act of swapping. But if you accidentally approve a look-alike phishing contract that imitates Uniswap, the moment you sign, that contract calls transferFrom on your USDC and walks away with the entire balance. There is no time window to react, no withdrawal confirmation, no email warning.

The four-step approve defense routine

1. Read every signature popup. What function is being called? Which contract is the spender? What is the amount? If any of those answers are unclear, reject and look up the contract first.
2. Audit approvals every month or two. Use revoke.cash or Etherscan's token approval checker to list everything you have ever authorized, and revoke the contracts you no longer use. Old approvals are the lowest-hanging fruit for attackers; once a dApp gets compromised, every wallet that has unlimited approval on it gets drained at once.
3. Set spending limits, not unlimited. MetaMask now exposes a small "edit" link in the approval popup that lets you cap the allowance at, say, exactly the amount of this swap. It is one extra click per trade. It is the single highest-leverage habit in self-custody.
4. Isolate the cold stack. Long-term holdings live in a separate address that has never signed an approve transaction for any contract whatsoever. The cold address only sends and receives. It does not interact with DeFi. That single piece of operational hygiene cuts out an enormous fraction of the attack surface.

§6 · Hardware wallets — when, what, and where to buy

Above roughly ten thousand US dollars in long-term holdings, a hardware wallet stops being optional. I use a Ledger Nano X that I bought in 2020 and it is still in service. The realistic alternatives in 2026: Ledger Nano S Plus or Nano X, Trezor Safe 3 or Safe 5, Lattice1 (a desktop unit with a large screen, popular with DeFi power users), and SafePal S1 (cheaper and Bluetooth-free). Each has its tradeoffs around screen size, secure-element vendor, open-source firmware, and supported chains. Ledger is the largest by units shipped; Trezor is the most popular among the open-source-purist subset.

The core value proposition of any hardware wallet is the same: the private key never leaves the device. When you sign a transaction, the unsigned payload is sent into the device over USB. The device displays what it is about to sign on its own screen, you press the physical button to confirm, and the signed payload returns to the computer. The computer never sees the key. Even an attacker with full malware on your laptop cannot extract the key from a working hardware wallet.

Workflow: plug Ledger into the laptop, open MetaMask, select "Connect Hardware Wallet," and MetaMask now routes signing requests through the device. Every transaction requires a physical button press on the Ledger after you read what is displayed on its screen. That forced read step is the entire feature — it makes you look at what you are about to sign before you commit, and it eliminates roughly 99% of the click-through phishing attacks that hit hot-wallet users.

§7 · US & European reader perspective

The previous sections apply to anyone, anywhere. This section is the part that does not appear in the Chinese-language version, and it is here because the wallet landscape, the threat model and the recovery options look noticeably different if you sit in the US, the UK or the European Union.

Where to buy hardware in 2026 (US / EU retail channels)

For US readers: Ledger and Trezor both ship directly to all fifty states from their own stores. Best Buy carries Ledger Nano S Plus and Nano X in physical stores and online, which is the only major US retailer with an authorized reseller agreement and the only big-box where I'd trust the supply chain. Amazon — even when sold by Ledger as the listed seller — has documented tampering incidents because of co-mingled inventory in the FBA warehouses. The official store is two days faster than Best Buy and ships in plain packaging for privacy. For EU readers: ledger.com ships from France, trezor.io ships from Czechia, and Coolblue (Benelux) plus a handful of national electronics chains carry genuine units. The post-2020 retail surge means most major US and EU electronics chains know what a hardware wallet is now; this was not true in 2017.

MetaMask as the US default — and the ConsenSys angle

MetaMask, developed by ConsenSys in Brooklyn, has the largest US user base of any self-custodial wallet — north of thirty million monthly active users by ConsenSys's own reporting in 2024. In 2024 the SEC under Gary Gensler issued ConsenSys a Wells notice arguing MetaMask Swaps and Staking were unregistered broker-dealer and securities offerings. The matter was dropped in early 2025 after the Atkins SEC reorganized crypto enforcement, and ConsenSys has continued operating the products without changes in the US. Practically: MetaMask is still safe to use, still actively developed, and still the path of least resistance for an American user opening their first hot wallet. The litigation noise did not produce any technical change to the product.

Coinbase Wallet (self-custody) — separate from Coinbase the exchange

A point of confusion that catches new US users: Coinbase Wallet and Coinbase the exchange are two different products with two different security models. The exchange holds your coins on its books (custodial; you have an IOU). Coinbase Wallet is a self-custodial mobile app where you control the seed phrase and Coinbase has no access. Same logo, same brand, completely different trust assumption. If you opened a Coinbase account in 2021 and never installed the Wallet app, your coins are custodial. If you also have the Wallet app installed and your coins are in there, you are in self-custody — and Coinbase customer support cannot help you recover the seed if it is lost. Read the screen carefully. The mistake of assuming the brand provides recovery is shockingly common.

Phantom, Rabby, and the multi-chain landscape

Phantom (San Francisco, around five million monthly actives) started as the default Solana wallet, but has expanded to Ethereum, Polygon and Base. For US users active on Solana memecoins or NFTs, it is the default. Rabby, built by the team behind DeBank, has earned a small but loyal following among EVM power users because of one feature: built-in transaction simulation. Before you sign, Rabby shows what the transaction will actually do to your balances — "you will lose 100 USDC and receive 0.04 ETH" — instead of just "approve transaction." For someone who interacts with multiple DEXes a week, this single feature has prevented six-figure mistakes.

Casa, Unchained — multi-sig services for the high-net-worth tier

For balances above roughly $250,000 and especially above $1M, the right answer in the US is usually a multi-signature setup, not a single hardware wallet. Casa (based in Colorado) sells a tiered service starting around $250 per year for a 2-of-3 multi-sig and going up from there. Two of the three keys are held by the customer on separate hardware devices in separate physical locations; the third key is held by Casa as a recovery agent. No single key can move funds; no two simultaneously compromised keys is a believable threat model. Unchained Capital (Texas-based) offers a similar 2-of-3 collaborative custody product, plus integration with US-compliant IRA and 401(k) wrappers — for retirement accounts holding self-custodial Bitcoin, Unchained is essentially the only mainstream provider. The shared idea: stop trying to perfectly secure one seed phrase, and instead split the trust across three independent custody points so that no single failure (lost key, dead spouse, compromised location) loses the wallet.

Where US readers actually put the seed phrase

The most common practice among American Bitcoin holders I know personally is some combination of:

• Bank safe deposit box, typically $50-$200 a year at a regional or national bank. The metal seed plate goes in the box, accessed roughly never.
• Home fireproof safe, paired with the bank box as a two-location redundancy. The safe should be bolted to the floor; otherwise the safe itself becomes the target of a smash-and-grab.
• Stamp Seed, Cryptosteel Capsule, Billfodl — the three most common metal storage products in the US, all available through Amazon (acceptable here because the product is just stamped steel; there is no firmware to tamper with) or the manufacturer's site.

The 2024 New York Times article on lost Bitcoin estimated that roughly $3 billion in BTC sits in addresses whose keys have been irretrievably lost — passwords forgotten, hardware destroyed, dead-grandfather lockouts, seed phrases that ended up in a moving box that never reappeared. That number is roughly equal to the GDP of a small Pacific nation. It exists because nobody has invented a better seed phrase management practice than steel + bank box + a will that mentions the location, and people don't follow it.

2024 phishing wave · Inferno Drainer and the MetaMask impersonation surge

During 2023-2024 a piece of malware-as-a-service called Inferno Drainer, sold to phishing crews on a revenue-share model, was linked by on-chain investigators to roughly $80M in losses across thousands of wallets in its first year, before being followed by copycats that pushed the cumulative drainer-attack total above $300M in 2024. The attack flow: a Discord or Twitter account impersonating MetaMask, Phantom or some other wallet brand posts a "security verification" link. Click it, sign the popup, and the drainer's smart contract transfers everything in the wallet — tokens, NFTs, even some forms of staked positions — into the attacker's address inside the same transaction. Defense for US/EU readers in 2026: assume any DM you receive about your wallet, from any platform, is hostile until proven otherwise. Wallet companies do not message you. Discord support does not exist for self-custodial wallets. Twitter "verification" links are virtually always drainers. The default response to any wallet-related unsolicited contact is to ignore it.

Three rules for US/EU readers, distilled

1. Hardware wallet once holdings cross $50,000. The marginal cost of a $79 Ledger Nano S Plus is rounding error against the loss prevention; the marginal cost of operational friction is small.
2. Multi-sig (Casa or Unchained) once holdings cross $500,000. Above this threshold, a single key being compromised, a single physical location burning down, or a single death starts to be a non-trivial probability over a five-year horizon. Multi-sig collapses each of those failure modes from "lose everything" to "annoying recovery."
3. Never, ever type a seed phrase into a browser tab. The seed only exists on paper or steel, and only ever gets entered into a hardware wallet or a freshly-installed wallet app on a clean device. If a website is asking you to type the twelve words, you are being phished, regardless of how authentic the page looks.

§8 · Comprehensive wallet-security checklist

1. Seed phrase is hand-written on paper or stamped on metal, two copies, two physical locations.
2. No screenshots, no cloud storage, no email, no telling anyone — including a person claiming to be customer support.
3. If anyone — exchange, wallet maker, "verification team" — asks for the seed phrase, they are an attacker. There are no exceptions to this rule.
4. Download wallet software only from the official domain, hand-typed into the address bar. No Google ads.
5. Large balances live on a hardware wallet. Hot wallets carry only what you are willing to lose in a single bad signature.
6. Read every signature popup. Reject unknown contracts. Reject unlimited approvals. Reject signatures whose payload you can't explain.
7. Audit approvals on revoke.cash every couple of months. Revoke anything you no longer use.
8. Maintain a strict separation between the long-term cold address (no approvals, no DeFi) and the day-to-day hot address.
9. Before any large withdrawal to a new address, send a tiny test transaction first, confirm receipt, then send the rest.
10. Any service claiming to "recover" a lost seed phrase, a stolen wallet, or a forgotten password is a scam. There are no exceptions to this rule either.

§9 · Closing thoughts

Wallets are not complicated, but the tolerance for error is unusually low. One screenshot at the wrong moment, one mis-clicked signature, one second-hand hardware unit, and the entire balance can move to an attacker's address with no recourse. The good news is that the practices that protect against all of these are the same practices, and they are not technically difficult — they just have to actually be followed.

The first-week routine I recommend to anyone new: install MetaMask, create a wallet, write the seed phrase on paper, and then test the recovery by importing the same seed phrase into a fresh installation on a different computer. Confirm the same address appears. That confirms the words were copied correctly. Then send 50 USD worth of ETH from an exchange to the wallet to confirm the receive flow works, and you're operational.

After ten years of watching people lose money in crypto, the conclusion that keeps holding up is: every loss I've seen up close was self-inflicted — buying a clearly fraudulent token, signing a clearly suspicious approval, leaving the long-term stack on an offshore exchange. Wallet security is the single highest leverage thing you can get right; do this part well and you've already avoided half the ways people exit the market with less money than they came in with.