How to Read a Crypto Wallet's Security Model Before You Trust It

Choosing a wallet is choosing who holds your keys and what happens when something goes wrong. The marketing rarely explains either. This guide walks through the questions that actually decide whether a wallet is safe to use.

Who holds the keys

The first distinction is custody. A self-custodial wallet stores the private keys on your device and never sends them anywhere; you alone can move the funds, and you alone are responsible if the keys are lost. A custodial wallet holds the keys on your behalf, which is convenient but means the provider — not you — controls the asset.

Neither is universally better. Self-custody removes counterparty risk and adds personal responsibility. Custody adds a trusted third party and removes the burden of key management. Decide which trade-off you want before you compare features.

Where the keys live

For a self-custodial wallet, ask where the secret material is stored and whether it ever leaves the device. A hardware wallet keeps keys in a dedicated secure element and signs transactions without exposing the key to the connected computer. A software wallet keeps keys in the device's storage, which is fine for smaller balances but exposes them to malware on a compromised machine.

• Are keys generated on-device, or on a server?
• Is the secret element certified, or is it general-purpose storage?
• Does signing happen on the device, or is the key loaded into the app?

How recovery works

Recovery is where most losses happen. A standard recovery phrase — the twelve or twenty-four words — is the master key. Anyone who reads it controls the funds, and no support desk can reset it. Confirm how the wallet backs up that phrase, whether it offers optional multi-share recovery, and what the provider can and cannot do if you lose access.

A wallet that promises to "recover your funds if you forget your password" is telling you it holds your keys. That is custody, whatever the marketing calls it.

The short checklist

Before moving funds, confirm: who holds the keys, where they are stored, how signing happens, and exactly what recovery requires from you. If any of those answers is vague, treat the vagueness as the answer.

This guide is educational and is not financial or security advice. Verify a wallet's claims against independent audits and the provider's own documentation before trusting it with meaningful funds.