What a crypto wallet is
What a wallet really holds, which kinds there are and who controls your crypto in each case.
By Pitiklini · · 5 min read
Key points
- A wallet does not hold crypto: it holds the keys that let you move it.
- Whoever has the private key controls the funds. If someone gets it, they can take them.
- In a custodial wallet, a provider keeps the keys for you. In your own wallet, you keep them.
- A transfer to the wrong address or network usually cannot be undone.
What a wallet holds
Crypto is not stored inside your phone or your computer. It exists as entries on the blockchain of its network, a record shared by many computers that nobody can change on their own.
A wallet holds the keys that give access to those entries:
- The private key signs transfers. It is secret: whoever has it can move the funds.
- The address is used to receive. You can share it, like an account number.
Many wallets derive all their keys from a recovery phrase, a list of 12 to 24 words. It restores the wallet on another device. That is also why anyone who sees it can use it.
Custodial or your own
The difference is who keeps the keys.
| Custodial wallet | Your own wallet | |
|---|---|---|
| Who keeps the keys | A provider, for you | You |
| How you get in | With your account, your password and two-step verification | With the wallet app or device |
| If you lose access | You recover it through the provider's procedure, after proving who you are | Without the recovery phrase, nobody can give you back the funds |
| The main risk | The provider suffering an attack or a failure | Losing the recovery phrase or having it stolen |
With a custodial wallet, the provider offers a service that EU law calls custody. Keeping your own wallet is also known as self-custody: nobody else can move the funds, but nobody can recover them for you either.
Your own wallet can be one of two kinds:
- A hot wallet is connected to the internet, like a phone or browser app. It is handy for everyday use and more exposed to attacks.
- A cold wallet keeps the keys offline, on a dedicated device or on paper. It is harder to attack remotely, but it can be lost, broken or stolen.
What the law requires from custodians
Since 30 December 2024, the EU Markets in Crypto-Assets Regulation (MiCA) has applied to crypto-asset service providers across the European Union. An authorized provider that holds its clients' crypto-assets must, among other things:
- keep a record of what each client holds and give them a statement of their positions at least every three months;
- keep clients' crypto-assets separate from its own, so that its creditors cannot claim them if it goes bankrupt;
- have procedures to return them to its clients as soon as possible;
- be liable for their loss if it is caused by an incident attributable to it, up to their market value.
What it does not do is protect you from price falls. And crypto-assets are not covered by any guarantee scheme, as bank deposits are.
Your wallet on Pitiklini
On Pitiklini, the crypto and euros in your account are held by the crypto-asset service provider that provides the service. Its name is at the bottom of every page. Pitiklini provides the technology platform: it builds the website and the app and manages your account.
To receive crypto from another wallet, you use the address and network shown on the deposit screen. To send it out, you make a withdrawal to the address you are given.
Nobody from Pitiklini will ever ask for your password, your codes or a recovery phrase.
Before you send or receive
- Check the whole address, not just the beginning and the end. Some malware swaps the address you copy for another one.
- Use the same network on both sides. The same crypto can travel on several networks. If you send it on one the receiving wallet does not support, it may not arrive or may be lost.
- Add the destination tag if the network asks for one. Some networks, such as XRP's, use a destination tag or memo to know which account each transfer is for.
- Allow for the network fee. Every transfer pays the network to record it, and the amount changes with how busy it is. When you withdraw from Pitiklini, the platform pays it and you pay the withdrawal fee; when you send from another wallet, you pay it.
- Try a test the first time. Sending a small amount to a new address first lets you check that everything is right.
Once the network confirms a transfer, it cannot be cancelled. If you get the address wrong, only whoever controls it could send it back.
Sources
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Articles 3 and 75.
- EU supervisory authorities' warning on the risks of crypto-assets (6 October 2025), on the ESMA website.
- "Monederos (wallets)", from the crypto-asset course of Finanzas para Todos, by the CNMV and the Bank of Spain (in Spanish).
- "Cripto robos y estafas digitales", from the Spanish National Cybersecurity Institute, INCIBE (in Spanish).