Keys & Wallets: How You Own Crypto

A wallet doesn’t hold coins — it holds the secret key that proves an entry on the ledger is yours to move.

Crypto & Tokenization · Lesson 2 · 8 min read

You buy your first bit of crypto. The app creates a “wallet” and shows you a scary 12-word phrase, telling you to write it on paper and never, ever lose it. Three questions hit you at once: Where are my coins actually stored? Is this wallet like a bank account? And if I lose that phrase, can I just call support and reset it? The answers are surprising — and they all come down to a single idea: keys. Hold the question; by the end you’ll know exactly what that phrase protects and why no one can reset it for you.

A wallet holds keys, not coins

Your coins never leave the ledger — they’re entries, exactly like last lesson. So what’s in the “wallet”? A matched pair of numbers called a key pair:

• A public key (your address) — like an account number. It’s safe to share; people use it to send you coins, and anyone can see it on the public ledger.
• A private key — a secret number that proves you’re allowed to move whatever sits at that address. The 12-word phrase is just a human-friendly backup of this secret.

The two are mathematically linked: the public one is derived from the private one, but you can’t run that backward to recover the secret. Owning crypto means controlling the private key — nothing more.

Signing: prove it’s yours without revealing the secret

Here’s the clever part. To spend, your wallet creates a digital signature: it takes the transaction (“move 5 from my address to Bob”) and stamps it using your private key. Anyone on the network can then check that signature against your public key. The math guarantees two things at once: only the holder of the private key could have produced a valid signature, and verifying it never exposes the secret.

That’s how a ledger with no bank, no login, and no identity check still knows a transaction is authorized — not because someone vouched for you, but because the signature checks out. You can verify it yourself.

Alice sends 5 coins to Bob:
1. Her wallet writes the message: “from Alice’s address → Bob’s address, amount 5.”
2. It signs that message with Alice’s private key, producing a signature.
3. She broadcasts the message + signature — never the private key itself.
4. Every node checks: does this signature match Alice’s public address? Math says yes only if the real private key signed it.
5. It checks out → the ledger records the transfer. No bank approved it; the signature did.

Ownership = control of the key (and its consequences)

Because the key is the ownership, the consequences are blunt and worth saying plainly:

• Lose the private key (and its backup phrase) → the coins are frozen at that address forever. No reset, no support line, no recovery.
• Leak the private key → whoever has it can take everything, instantly and irreversibly.

This is self-custody: total control and total responsibility, two sides of one coin. It’s also why people say “not your keys, not your coins.” If an exchange holds the keys for you, they control the coins on the ledger — what you have is an IOU from that company, not direct control. Neither choice is “right”; the point is to know which one you’ve actually made, and to be able to check it.

Why a stranger can’t steal Alice’s coins even though her address is public:
1. Alice’s address (public key) is visible on the ledger — anyone can see she holds 5 coins.
2. An attacker writes “from Alice → me, amount 5” and broadcasts it.
3. But every node demands a valid signature for that message, checked against Alice’s public address.
4. The attacker can’t produce one: making a valid signature requires Alice’s private key, and you can’t derive it from the public address.
5. The forged transaction fails verification and is rejected. Seeing the address tells you what Alice owns; only the secret key lets you move it.