Skip to content

Security · 5 min read

Crypto wallets and security: know who controls the keys

Understand exchange custody, self-custody, recovery phrases and the checks to make before a crypto transfer.

Sources checked 16 October 2026 · Free to read · No account needed

01

Separate account access from ownership controls

With an exchange account, you depend on the provider’s custody and withdrawal processes. With a self-custody wallet, you control the signing keys and take on the recovery burden. Neither arrangement removes the risk of loss.

  • An exchange password reset is different from restoring a wallet from its recovery material.
  • Ask what would happen if your phone broke, the provider restricted withdrawals or your email account was compromised.
02

Protect recovery material

A recovery phrase can restore control of a wallet. Treat it as access to the assets, not as an ordinary password to share with support. Keep it offline and private; do not type it into a link sent by someone offering help.

  • Follow the wallet maker’s genuine setup instructions and understand how backups work.
  • Do not place a recovery phrase in this site, a community post, a direct message or a cloud document.
03

Check a transfer in both places

The asset name is not enough: the sending and receiving services must support the same network. Some destinations also require a memo or tag. Compare the full address using a trusted display before confirming.

  • Check the destination’s deposit page for supported networks, minimums and any memo requirement.
  • Consider a small test transfer first, allowing for its fee. Wait for it to arrive before sending more.
04

Review what you are signing

Connecting a wallet and authorising a transaction are different actions. Read the request, the site address and the permissions. If a prompt is confusing, close it and investigate rather than repeatedly clicking through.

  • Keep a separate learning wallet with limited funds when experimenting with unfamiliar applications.
  • Review old token approvals through tools you have independently verified. Revoking an approval itself can require a network fee.

Your next steps.

Use this checklist before moving on. These boxes are for this reading session and are not saved.

Sources & fact check

Checked . Provider material describes the provider’s own service. Check current terms before acting.

  1. ASIC Moneysmart: crypto wallets and storage risks
  2. Scamwatch: investment scams
Suggest a correction

Keep learning

One useful next step.

Learn to recognise crypto scams →

All learning guides →

Hardware wallets

Hardware wallets to consider

A hardware wallet keeps your private keys offline, away from exchange hacks and malware. Buy only from the maker’s official store, never second-hand.

Ledger

Hardware wallets that keep your private keys offline. Buy only from the official store.

Visit Ledger Official site

Trezor

Open-source hardware wallets that keep your private keys offline. Buy only from the official store.

Visit Trezor Official site

Listed alphabetically as options to research, not endorsements. Check pricing and features on each site.