A number. Randomly generated. Astronomically large.

Controls a wallet completely. Whoever has it can send every token inside anywhere they want. No password reset. No customer support. No recovery process. Just the key.

Entire concept of self-custody comes down to this.

How It Works (h2)

Private key generates a public key through elliptic curve cryptography. Public key generates a wallet address. One-way relationship. Address visible to everyone. Public key derivable from private key. Private key derivable from nothing except itself.

Sending ETH. Wallet uses private key to create a cryptographic signature. Signature proves the transaction was authorized. Network verifies it against the public key. Confirmed.

Private key never transmitted. Never exposed. Used locally to create the signature. Proves ownership without revealing itself. Elegant system until a human touches it.

Seed Phrase Is the Same Thing

Most people never see a raw private key. See a seed phrase instead.

12 or 24 words. Randomly selected from a standardized list. Generates the private key. Generates all private keys for all accounts in the wallet actually. One phrase, everything derived from it.

Security-wise they're identical. Seed phrase in someone else's hands means wallet in someone else's hands. Immediately. No additional steps required.

This is why every legitimate wallet tells you to write it down offline and never share it. Not a recommendation. A description of how the math works.

Not Your Keys Not Your Coins

Coinbase holds the private keys for Coinbase accounts. Users have a username and password and a legal claim on the assets.

FTX customers had the same thing. Accounts, balances, a legal relationship with the company. Company collapsed. Accounts became claims in a bankruptcy proceeding. Some people got fractions back eventually.

Self-custody means holding the actual key. Your wallet. Nobody's permission needed to access funds. Nobody's insolvency can touch them. Complete ownership. Complete responsibility. Both parts matter.

How Keys Actually Get Stolen

Not through breaking the cryptography. Math is fine. Humans aren't.

Phishing. Fake MetaMask recovery page. Fake Ledger support site. Asks for seed phrase to verify or restore or fix something. Legitimate wallet software never asks for seed phrase after initial setup. Never. Anyone asking is stealing.

Malware. Keyloggers. Clipboard hijackers replacing copied addresses with attacker addresses mid-paste. Crypto-specific malware is sophisticated now. Targets seed phrases specifically.

Cloud storage. Screenshot of seed phrase sitting in iCloud. Notes app syncing. Email to self. Any digital copy is an attack surface. Cloud accounts get hacked. Seed phrase goes with them. Seen this happen to people who knew better.

Social engineering. Someone in Discord claiming to be wallet support. Needs the seed phrase to fix the issue. No wallet company needs the seed phrase. No exceptions. Anyone saying otherwise is lying.

Physical. Written seed phrase found by someone with access to the home. Less dramatic than the other methods. Still happens.