Self custody means controlling signing power.
A wallet coordinates keys and transactions, but custody comes from who can produce valid signatures. The backup is not a password reset; it is usually the path back to spending authority.
Wallets: keys and payments
A Bitcoin wallet does not hold coins the way a leather wallet holds cash. The coins live on the blockchain. A wallet holds the keys that can spend them, and helps you receive, check and send payments safely.
What a wallet does
Every Bitcoin wallet, whatever it looks like, does five jobs.
- Creates and guards your keysIt generates the secret private keys that can spend your bitcoin, and keeps them away from everyone else.
- Gives you addresses to receiveIt turns your keys into receiving addresses, a fresh one for each payment.
- Watches the blockchain for your coinsYour “balance” is the wallet adding up the coins on the blockchain that your keys can spend. The coins never sit inside the app.
- Builds and signs paymentsIt picks coins to spend, adds the recipient, your change and a fee, then signs with your keys.
- Backs you upIt shows you a seed phrase once, so you can rebuild everything on a new device if this one is lost.
Seed phrase, keys and addresses
One backup gives you everything. Here is how the pieces connect, from the secret you protect to the address you share.
- Seed phraseUsually 12 or 24 ordinary words (BIP39). The master backup.Secret: never share
- Master keyCalculated from the words. Never shown to you.Secret: never share
- Private keysMany of them, derived in a fixed order (BIP32). Each can sign.Secret: never share
- Public keysCalculated from each private key. Not secret: Taproot outputs show a tweaked one, and other address types reveal it when you spend.Not secret
- AddressesShareable payment destinations, usually a hash of a public key (Taproot uses a tweaked key). What you give to a payer.Safe to share
- The seed phrase can recreate every key and address the wallet will ever use. That is why it must be protected like the bitcoin itself.
- The calculation only goes one way: nobody can work backwards from an address to your keys.
- Most wallets follow the same standards, so the same words can usually restore your coins in different wallet software, as long as it uses the same address type, derivation path and any passphrase.
- An optional passphrase (sometimes called the “25th word” of a 24-word phrase) turns the same words into a completely different wallet. Lose it and those coins are gone.
Who holds the keys?
This is the most important question about any wallet. If someone else holds the keys, you have their promise, not the bitcoin.
QuestionCustodialSelf-custody
Who holds the keysA company (exchange or app)You
What you ownA claim on the company: an account balanceThe bitcoin itself, on the blockchain
Forgot your password?The company can usually reset itYour seed phrase is the only way back
Main risksHacks, frozen withdrawals, insolvency, account closureLosing your backup, theft of your seed, your own mistakes
Many people start custodial and move to self-custody as they learn. Either way, keep in a custodial account only what you could afford to lose.
Kinds of wallets
“Hot” wallets keep keys on a device connected to the internet; convenient, but more exposed. “Cold” wallets keep keys offline; safer for savings, but slower to use. Many people use both: a small hot wallet for spending and cold storage for savings.
TypeWhere the keys liveGood forWatch out for
Mobile walletOn your phone (hot)Small amounts and everyday paymentsPhone loss, malware, shoulder-surfing
Desktop walletOn your computer (hot)More control: coin selection, fee control, connecting to your own nodeMalware on a general-purpose computer
Browser or web walletIn a browser extension or websiteConveniencePhishing sites and malicious extensions; often custodial
Hardware signing deviceOn a small dedicated device, offline (cold)Savings: keys never touch an internet-connected computerBuy from the maker directly; verify every address and amount on its own screen
Air-gapped signerOn a device that never connects, using QR codes or memory cardsMaximum separation from the internetMore steps; you must still check what you sign
Multisig walletSplit across several keys: any M of N must sign, such as 2 of 3 or 3 of 5Larger amounts; no single lost or stolen key is fatalMore to set up, back up and practise
Address formats
You will see addresses that start differently. All of them can pay each other; newer formats cost less to spend from.
Starts withNameSinceWhat to know
1…Legacy (P2PKH)2009The original format. Works everywhere; highest fees.
3…Script hash (P2SH)2012Used for early multisig and wrapped SegWit.
bc1q…Native SegWit2017Lower fees. The most common format today.
bc1p…Taproot2021Lower fees for complex spending rules, and more privacy for them.
Receiving safely
- Use a fresh address for every payment. Reusing one lets anyone link your payments together.
- If you have a signing device, check the address on its screen, not just on your computer or phone.
- Share the whole address. Copy and paste it, or use a QR code; never retype it by hand.
- A payment is “pending” until it is in a block. Wait for confirmations before treating larger amounts as received.
Sending safely
- Check the whole address, start, middle and end, against what the recipient gave you. Malware can swap a copied address.
- Check the amount, the fee and the change before you sign. On a signing device, check them on its screen.
- For a new recipient or a large amount, send a small test payment first.
- Bitcoin payments cannot be reversed. If something looks wrong, stop before signing.
- If a payment is stuck because the fee was too low, many wallets can raise it (RBF or CPFP; see the Transactions lesson).
Backing up your seed phrase
Anyone who sees your seed phrase can take your bitcoin. If you lose it and your device, nobody can get it back for you.
Do
- Write the words by hand, in order, and check each one.
- Store the backup somewhere safe from fire and water. Metal plates last longer than paper.
- Keep copies in separate places, so one fire or burglary cannot take everything.
- Test it: restore the wallet from the words before you put in real money.
- If you add a passphrase, back it up too. Without it, the words alone open a different, empty wallet.
- Leave instructions so someone you trust can find and use it if something happens to you.
Don’t
- Never photograph or screenshot it, or store it in email, notes apps, cloud drives or password managers that sync.
- Never type it into a website, a form or a chat. A real wallet only asks for it when you restore it.
- Never give it to anyone. No real support agent, exchange or developer will ever ask for it.
- Never keep your only copy in one place.
- Never use words you made up yourself. Let the wallet generate them.
What to look for in a wallet
This lesson does not recommend any product. Use these questions to judge any wallet yourself.
- Standard backupsUses a standard seed phrase (BIP39) and can export its wallet setup (a descriptor), so you can restore in other software.
- Open sourceThe code is public and reviewed. Better still: builds that others can reproduce and check.
- Clear signing screenShows the full address, amount and fee in plain view before you approve.
- Fee controlLets you set the fee and raise it later (RBF).
- Privacy featuresNew address each time; coin control; can connect to your own node instead of a company’s server.
- Actively maintainedRecent updates, a public record of fixing security problems, and a long track record.
- Official source onlyDownload from the maker’s own site or official app store listing, and verify the release signature where offered. Buy hardware directly from the maker.
Common scams and mistakes
Most losses come from tricks and mistakes, not from anyone breaking Bitcoin’s cryptography.
- Fake wallet appsCopies of real apps in app stores that steal your seed phrase.
- Fake supportSomeone messages to “help” with a problem and asks for your seed phrase or to install a remote-control app.
- Address swappingMalware replaces a copied address with the thief’s. Look-alike addresses are also sent to you to copy by mistake.
- Phishing sites and emailsLook-alike websites or “security alerts” asking you to “verify” your wallet.
- Giveaways and doublingSend some bitcoin, get twice as much back. It never comes back.
- Tampered hardwareSecond-hand or resold devices, or ones arriving with a pre-filled seed phrase card.
- Single backup, no testNot a scam, but the most common way people lose coins: one copy, never tested, then lost.
Choose a learner persona
Different users need different wallet tradeoffs.
Pick a scenario to see which kind of setup fits. This saves only your lesson progress, never wallet secrets.
Choose a persona to compare setups.
The answer changes with amount, spending frequency, recovery skill, and who you are defending against.
Wallet design is a bundle of tradeoffs.
TradeoffGood forWatch outThink about it
Hot vs. coldHot wallets are fast for daily use; cold wallets are better for patient savings.Hot keys touch networked devices. Cold keys add ceremony and recovery responsibility.Which balance would you keep on the phone you carry everywhere?
Open vs. closed sourceOpen code can be reviewed by many people; closed products may polish the guided experience.Open source still needs reproducible builds and active review. Closed source asks for more vendor trust.What would you need to verify before trusting a wallet release?
Air-gapped signingKeeping the signer offline while a watch-only wallet builds transactions.QR cards and files can still carry bad transaction details if users do not verify outputs.What information must be checked on the offline screen before signing?
Custodial vs. self-custodyCustodians simplify passwords, support, and small beginner balances.The user owns an account claim, not the signing keys, so withdrawals and policies can change.When is convenience worth counterparty risk, and when is it not?
Never enter a real seed phrase here.
This exercise uses fictional amounts and paper labels only; no wallet connection or real funds are needed. A real seed phrase belongs only in wallet software or signing devices you deliberately trust.
Rehearse receive, verify, sign and broadcast
On paper, draw a watch-only computer, a separate signing device and a recipient. Label the recipient request “B, 50,000 sats”. These are fictional labels, not usable addresses.
- Receive: request a fresh address. Compare the complete address on the trusted signing device with the receiving screen. A matching prefix or valid checksum is insufficient.
- Build: use a fictional 200,000-sat input, a 50,000-sat payment and an estimated 150-vB transaction at 6 sat/vB. Calculate the fee and change before revealing the answer below.
- Inspect: move a partially signed Bitcoin transaction (PSBT) to the signer. Independently confirm the recipient request. Verify destination, amount, fee and change on the trusted display.
- Sign: approve only a matching transaction. Private keys and the seed phrase stay on the signer; send the signed PSBT back to the coordinator.
- Broadcast: finalize and relay. Mempool acceptance is not confirmation. Inclusion in the active chain gives confirmation one; later blocks add depth.
Check the paper transaction
Fee: 900 sats. Change: 149,100 sats. Outputs sum to 199,100 sats; the 900-sat difference is the fee, not a separate output.
Failure drill: cross out the recipient label on the computer while leaving the signing-device label unchanged. Say why you must stop. Repeat with an unexpectedly high fee.
Technical reference: BIP174: PSBT; BIP39: seed phrases; BIP32: key derivation; wallet security and backups.
Apply what you learned
Try without looking back. Check your answers, then revisit any explanation you missed. These practice checks do not certify readiness to handle real funds.
Custody and recovery
Bitcoin lets ownership be enforced by signatures instead of account permission. That shifts the lesson from "where are my coins stored?" to "which keys, people, and procedures can authorize movement?"
Who can move the coins?
Pick a custody mode to see the control tradeoff.
This saves your lesson progress only. No keys, addresses, seed phrases, or wallet data are collected.
Current answer
Exchange custody
The exchange can move coins because it controls the private keys and account controls.Useful for small learning balances, but withdrawals and solvency depend on the custodian.
The backup plan is part of the wallet.
Good custody includes where recovery material lives, who knows about it, how heirs find it, and how you prove the plan works before a real emergency.
2-of-3 multisig storyboard
Multisig is procedure, not magic.
This storyboard uses 2 of 3 as the example; the same steps apply to other setups such as 3 of 5. A real setup needs careful wallet software choices, descriptor backups, and small-value rehearsals.
Choose three signers
Pick separate devices or trusted cosigners so one lost key cannot strand funds and one stolen key cannot spend.
Record the policy
Write down that this is a 2-of-3 wallet and preserve the wallet descriptor or setup file needed to reconstruct it.
Practice recovery
Reconstruct the watch-only wallet from its policy record. Restore each signer separately from its own backup on a trusted device; never combine two seeds on one online computer.
Separate backups
Store keys and policy material in different places so fire, theft, or coercion does not defeat every layer at once.
Rehearse spending
Run a small transaction so the team understands proposal, review, signing, and broadcast before stress appears.
Threat checklist
Check each threat you can explain.
Explain a response to all four threats before checking them. Then pass the application check below; checking a box alone does not complete this part.
Rehearse recovery on paper
Label three fictional signers A, B and C. Draw each signer and its own backup in separate locations. Add a policy record: “2 of 3”, public signer information, derivation paths and wallet descriptor. Never write real recovery material into this site.
- Remove A. Circle the two remaining signers that can approve a recovery spend. Explain why a single stolen signer cannot authorize it.
- Reconstruct the watch-only coordinator from the policy record. Verify expected receiving addresses independently on the signers before relying on the restored view.
- If restoring a signer, restore only its own backup on a separate trusted signing device. Keep the other signer separate; never put two seeds into one online computer.
- Prepare a PSBT for a newly verified replacement setup. Independently inspect it on B and C, collect both signatures, finalize and broadcast. A real rehearsal requires wallet-specific instructions and a separate test environment before meaningful funds.
- Document how an heir locates the policy and enough protected backups without publishing the secrets together. Include any required passphrase; losing it can defeat a valid seed backup.
Check your recovery plan
B and C can sign. A alone cannot. If two signers and their backups are lost, the policy record cannot recreate their private keys. A descriptor helps reconstruct the wallet but leaks financial privacy if exposed; it is not a signing secret.
Reference: Bitcoin Core descriptors and BIP39 passphrase derivation.
Apply what you learned
Try without looking back. Check your answers, then revisit any explanation you missed. These practice checks do not certify readiness to handle real funds.