Trail notes
- A crypto wallet holds keys, not coins. The coins stay on the blockchain; the keys prove you can move them.
- Hot wallets are connected to the internet and convenient; cold storage keeps keys offline and is slower but harder to attack.
- Smart-contract and multisig wallets add rules, such as needing two of three approvals before funds move.
- A custodial account means a platform holds the keys for you, so its registration and safeguards matter more than any app feature.
- Choose by what you are doing with the funds, and use more than one wallet when your needs differ.
What a wallet actually holds
The word “wallet” is a little misleading. Your Bitcoin or Ether never sits inside an app or a device. It is recorded on a public blockchain, and the ledger says which address controls it. What a wallet stores is the private key that matches that address.
Here is the chain of pieces, from secret to public:
- Private key: a very large secret number. Whoever has it can sign transactions that move the funds. It must never be shared.
- Public key: derived from the private key with one-way maths. Others can use it to check your signatures, but it cannot be reversed to find the private key.
- Address: a shorter string derived from the public key. This is what you give people so they can send you funds, much like an account number.
- Recovery phrase: a list of words (often 12 or 24) that can regenerate your private keys. Most modern wallets show it once during setup. It is covered in the seed phrase security guide.
When you “send” crypto, your wallet builds a transaction, signs it with your private key and broadcasts it to the network. Nodes check the signature against your public key. If it matches, the transaction is valid. Nobody needs to know who you are; they only need proof that the key holder approved it.
This is why losing the key, or having it copied, is so serious. There is no bank to reverse a payment or reset a password. Control of the key is control of the funds.
Hot and cold, software and hardware
Wallets are usually sorted along two lines: whether the key is ever exposed to an internet-connected device (hot or cold), and what form the wallet takes (software or hardware).
| Type | Where the key lives | Strengths | Weak spots |
|---|---|---|---|
| Browser or mobile software wallet | Encrypted on your phone or computer | Fast, free, easy for frequent use | Exposed to malware, phishing and a compromised device |
| Desktop software wallet | Encrypted on one computer | More control, can run with your own node | Same device risks; backups often neglected |
| Hardware wallet | Inside a dedicated device that signs without revealing the key | Key stays offline even when you connect it | Can still sign a malicious request you approve; device can be lost |
| Paper or offline (air-gapped) setup | Written or stored on a device never connected online | Very hard to attack remotely | Easy to damage, lose or mishandle; awkward to use |
A hardware wallet is not magic. It protects the key from being copied, but it will still sign whatever you approve. If a scam site asks you to sign a harmful approval and you press the button, the device does its job perfectly and the funds still leave. The wallet approvals guide explains what to look for before you confirm.
See the full infographic with notes.
Smart-contract and multisig wallets
On networks such as Ethereum, a wallet can also be a smart contract: a program on the blockchain that holds funds and follows rules you set. Instead of one key controlling everything, the contract decides what counts as a valid instruction.
The best-known version is a multisig (multi-signature) wallet. You might set it so that any two of three keys must approve a transfer. One key could sit on your phone, one on a hardware device at home and one in a safe place elsewhere. Losing one key does not lose the funds, and stealing one key is not enough to drain them.
Smart-contract wallets can add other features: daily spending limits, trusted “guardians” who can help you recover access, or bundling several actions into one confirmation. The trade-off is complexity. The rules are only as good as the contract code and your setup. A misconfigured multisig, or one where all the keys end up on the same laptop, gives a false sense of safety.
Multisig makes the most sense once you hold an amount you would genuinely miss and you are comfortable with backups. Practise with a small amount first so you know how recovery works before you rely on it.
Custodial accounts: when someone else holds the keys
When you buy crypto on a centralized trading platform and leave it there, you usually do not hold any keys. The platform does. Your account shows a balance, but what you really have is a claim on the platform. That is called custody, and it shifts the question from “how do I protect my key?” to “how well does this business protect its keys and my claim?”
Custody has real advantages: password resets, customer support, and no recovery phrase to lose. It also has a different kind of risk. If the platform is hacked, mismanaged or fails, your access depends on how it held client assets and what happens in an insolvency. The custodial vs self-custody comparison sets out both sides.
The Canadian Securities Administrators say crypto platforms serving Canadians, including foreign ones, must register with provincial or territorial regulators (CSA page last updated 2025-10-22). CDIC deposit insurance does not cover cryptocurrencies, including stablecoins. QuadrigaCX, a Canadian crypto exchange, collapsed in 2019; an Ontario Securities Commission staff review in 2020 found its founder had committed fraud. Check registration before you trust any platform with custody.
You can check a platform yourself with the steps in how to check a platform.
Choosing by use, not by brand
This site does not recommend specific wallet products. A better question than “which wallet is best?” is “what will this wallet be used for?” Most people end up with a small stack of wallets, each with one job. The custody stack infographic shows the idea at a glance.
If you are unsure where to start, the wallet chooser walks through your use case, and the self-custody readiness check helps you decide whether holding your own keys suits you yet.
What can go wrong, and how to check
- Fake wallet apps: lookalike apps and browser extensions are a common trap. Get software only from the developer’s official site, reached by typing the address or using a saved bookmark, never from an ad or a direct message.
- Tampered or second-hand hardware: buy devices new from the maker or an authorized seller. A device that arrives with a recovery phrase already printed in the box is a scam.
- Lost backups: a wallet with no tested backup is one broken phone away from permanent loss.
- Wrong network: sending funds to an address on a different network can strand them. Check the network as carefully as the address.
- Clipboard swaps: some malware replaces a copied address with the attacker’s. Compare the first and last several characters after you paste.
None of these require advanced skill to avoid. They require slowing down, checking twice and keeping roles separate.
Your checklist
Questions people ask
Does a crypto wallet store my coins?
No. A wallet stores the private keys that control your coins; the coins themselves are recorded on the blockchain. If you lose the keys and the backup, the coins are still on the ledger but nobody can move them.
Is a hardware wallet the same as cold storage?
Mostly, yes. A hardware wallet keeps the private key inside the device and signs transactions without exposing it, which is a form of cold storage. It still signs whatever you approve, so you must read each request carefully.
What is a multisig wallet?
A multisig wallet is a smart-contract or protocol-level wallet that needs more than one key to approve a transaction, such as two of three. It protects against a single lost or stolen key, but it is more complex to set up and recover.
Is my crypto on a Canadian platform covered by CDIC?
No. CDIC says cryptocurrencies, including stablecoins, are not covered. Your protection on a platform depends on its registration, how it holds client assets and its own safeguards, so check registration with the Canadian Securities Administrators first.
Sources and dates
- Ethereum wallets — ethereum.orgreference
No date shown on page · checked 2026-10-31. What wallets are and how they hold keys. - Ethereum security and scam prevention — ethereum.orgreference
No date shown on page · checked 2026-10-31. Wallet security habits and common scams. - Introduction to smart contracts — ethereum.orgreference
No date shown on page · checked 2026-10-31. What a smart contract is and how it executes. - Crypto platforms: regulation and enforcement actions — Canadian Securities Administratorsin force
Page date 2025-10-22 · checked 2026-10-30. Platforms serving Canadians, including foreign ones, must register; operating platforms sign a pre-registration undertaking while under review. - Crypto platforms authorized to do business with Canadians — Canadian Securities Administratorsreference
Page date 2026-09-18 · checked 2026-10-30. The official list of authorized platforms, with links to each decision. - What's covered — Canada Deposit Insurance Corporationin force
No date shown on page · checked 2026-10-30. Up to $100,000 per category per member institution; cryptocurrencies, including stablecoins, are not covered. - Investor tools — crypto assets — Canadian Securities Administratorsreference
Page date 2025-10-22 · checked 2026-10-30. Crypto assets can be very volatile and risky; you could lose some or all of your funds.
Education only. Nothing on this page is financial, investment, tax or legal advice, or a recommendation to buy, sell, stake, lend or borrow any crypto-asset. Crypto-assets can lose some or all of their value and are not covered by CDIC. Canadian rules change: check the dated sources above and talk to a qualified professional about your situation. Full disclaimer.