nkhresearcher
Member
If you have never opened a crypto wallet, the first problem is not the software. It is the mental model. People talk about “putting coins in a wallet” as if the app were a digital purse. That picture is wrong, and it is the picture scammers rely on. This guide is written in August 2026 for a reader who has not used a wallet before. It is not investment advice and not a recommendation to buy or trade anything. It covers what a wallet is, how send and receive work, why networks are not interchangeable, and the mistakes that permanently lose money.
A wallet holds keys, not coins
Bitcoin.org states it directly: a Bitcoin wallet is an application that manages your private keys — the credentials that allow you to spend — while the coins themselves exist as records on the blockchain. Ethereum.org says the same thing: you never really hold cryptocurrency; you hold private keys; the funds are always on Ethereum’s ledger.
Think of a mailbox. Your public address is the street number you can share. Your private key is the only key that opens the box. The wallet app is the tool that shows the address and signs a request to move funds. Ethereum.org describes a wallet as a window onto an account. You can change apps later; the account lives on the network. If you still have the keys — typically as a seed phrase — you can open a different wallet and see the same balances. If you lose the keys, no company can look them up, because a self-custody wallet never stored them for you.
EOAs versus custodial exchange accounts
On Ethereum there are two kinds of accounts. An externally owned account, or EOA, is controlled by whoever has the private keys. A contract account is a smart contract, controlled by code. Ethereum.org’s account documentation is the reference: an EOA is a cryptographic key pair; the public address is 42 characters starting with
When people say “I have a MetaMask” or “I have a Trust Wallet,” they usually mean a software wallet is displaying one or more EOAs. Ethereum.org is explicit: a wallet can manage several accounts, and one account can be opened in more than one wallet. The recovery phrase generates the accounts.
A custodial exchange account is a different species. You typically get a username, a password, email recovery, and customer support. Ethereum.org notes that you are trusting the exchange with custody. Bitcoin.org is blunt: when a third party controls your keys, you rely on their security and honesty, and exchanges and online wallets can be hacked, fail, or freeze access to funds. In an EOA you control, there is no “forgot password” that reaches a human. MetaMask cannot recover a wallet for you. Trust Wallet never stores your seed phrase on its servers; lose the device and the phrase, and restoration is impossible.
The seed phrase is the most dangerous object in the setup
When you create a self-custody wallet, the software or hardware device shows 12 to 24 ordinary English words. MetaMask generates a 12-word Secret Recovery Phrase; Ledger generates 24 words on the device screen; Trust Wallet uses 12 words for a new app wallet (and documents 12 to 24 in general). The words come from a BIP-39 list. Order matters. They are the master backup of the private keys. Anyone who has the phrase can restore the wallet and spend. Ledger, MetaMask, and Trust Wallet all state the same rule: whoever has the phrase controls the accounts.
Official guidance from those vendors, plus Bitcoin.org and Ethereum.org: write the words on paper, check spelling and order, and store the copy somewhere only you can reach. Bitcoin.org recommends more than one physical place so a single fire or theft is not fatal. Do not photograph the phrase, email it, save it in cloud storage, type it into a website or chat, or give it to anyone — including people who claim to work for MetaMask, Ledger, Trust Wallet, or an exchange. The wallet password is not the seed. In MetaMask, the password unlocks the app on that device; the phrase recovers the wallet on a new device. Forgetting the password is recoverable if you have the phrase. Losing the phrase is not.
Ledger adds a hardware-specific warning: the recovery sheets in the box should be blank. The phrase is generated on the device during setup and displayed once. Never use a device that arrives with a PIN or phrase already filled in. Bitcoin.org describes the same attack as counterfeit hardware with a pre-generated seed known to the attacker. Buy hardware only from the manufacturer or an authorized reseller, and generate the phrase yourself. Do not type a Ledger 24-word phrase into MetaMask. Do not import a MetaMask 12-word phrase into a Ledger: that phrase was generated online.
If you lose the phrase and the device, the coins are still on the ledger — unreachable. Ethereum.org’s FAQ: without the seed phrase or private keys, funds cannot be recovered, and no one can reset a self-custody wallet.
Hot wallets and hardware wallets
A hot wallet is software on a phone, browser, or computer connected to the internet. Ethereum.org lists those as the common interfaces. They are how most people learn to receive and send, and they are reasonable for small everyday amounts. They are also exposed to malware, fake extensions, phishing pages, and sites that ask you to connect and then to sign.
A hardware wallet is a dedicated device that holds keys offline and signs transactions without revealing the private key to the computer. Bitcoin.org calls this one of the most secure methods to store funds, and notes that loss of the device without a backup can make funds unrecoverable. MetaMask’s security guide: keys stay offline, so you need physical possession of the device to sign. Bitcoin.org recommends keeping only small amounts on a computer or phone and the rest in a safer environment, including offline (“cold”) storage. Hardware is not magic. Type the seed into a fake site and the device cannot help. Approve a malicious transaction on the screen and the device will sign it.
How receiving and sending actually work
Ethereum.org’s “How to use a wallet” guide is the beginner sequence. To receive: open the wallet, tap Receive, copy the address or show the QR code, and give that public address to the sender. Ethereum addresses always start with
To send: confirm you are on the same network as the recipient, paste or scan the address, enter the amount, review the fee, and confirm. On Ethereum the fee is called gas and must be paid in ETH, even if you are sending a token. Fees move with congestion. After confirmation you cannot cancel. Send a tiny test amount first, then the rest. Verify the entire destination address, not just the first and last characters. Bitcoin.org documents “address poisoning” — dust from lookalike addresses so you copy the wrong one from history — and malware that rewrites an address in the clipboard. Check status on a block explorer by searching the address or the transaction ID.
Networks: Ethereum, Solana, and Bitcoin addresses are not interchangeable
This is the second most expensive beginner error after leaking a seed phrase. Ethereum.org’s account-creation FAQ answers it in one line: you cannot send bitcoin to an Ethereum address, or ether to a Bitcoin address. They are separate networks with separate address formats. Wrapped assets and bridges exist; they are extra machinery, often custodial, not “the same coin in a different box.”
Official format descriptions, in brief:
[*]Ethereum (and many EVM-compatible chains): starts with `0x`, then 40 hexadecimal characters. Ethereum.org notes that the same address can work on blockchains that use similar software to Ethereum. Bitcoin is not on that list.
- Bitcoin: legacy addresses start with `1` or `3`. Native SegWit (“bc1”) addresses are described on Bitcoin.org’s wallet chooser; Taproot addresses begin with `bc1p`.
- Solana: official docs describe a 32-byte address displayed as a base58 string with no `0x` prefix, derived from an Ed25519 keypair — different cryptography from Ethereum.
The same ticker on two networks is not the same asset. Ethereum.org warns that tokens such as DAI or USDC exist on multiple networks and are not interchangeable; sender and recipient must be on the same network. Send USDC on Ethereum to a Solana address, or Bitcoin to an
The scams that target people who just installed a wallet
You will meet these in the first week.
Fake support. MetaMask states that it has no phone number, never contacts you first, never discusses tickets on Twitter, Telegram, Discord, or Instagram, and will never ask for your Secret Recovery Phrase. Ledger does not offer phone support, will never ask for the 24-word phrase, and treats anyone who asks as a scammer. Bitcoin.org: no legitimate person, business, or support team will ever ask for your seed phrase or private key. Typical script: you posted a question, a “support agent” DMs you, and they ask you to “verify” with the 12 or 24 words or to install remote-access software. Hang up. Use only the vendor’s published support site.
Drainer sites. Bitcoin.org’s scam catalog describes the pattern: a fake website prompts you to connect a wallet and sign a transaction that grants permission to transfer assets. The page can look like a mint, an airdrop, a “connect to claim,” or a copy of a real app. Connecting is not always the theft. Signing the malicious approval is. Read every prompt. If a page asks for the seed phrase, it is fake — MetaMask is explicit that no legitimate MetaMask website will ever ask for it. Bookmark official domains. Download from the vendor’s site or the genuine store listing, not from an ad. Ledger documents fake Ledger Wallet sites whose only job is to harvest the 24 words.
Giveaways and urgency. Ethereum.org’s FAQ calls Ethereum giveaways scams. Bitcoin.org covers free giveaways, impersonation, and AI-generated impersonation in video and voice. If a famous person is “going live” to double your deposit, it is a trap. Transactions are irreversible. Bitcoin.org also describes a second-wave pitch: recover lost funds for an upfront fee. No legitimate firm offers guaranteed cryptocurrency recovery.
Closing, without trading advice
This is not a recommendation to buy an asset. Download a wallet from its official site, write the seed on paper before you fund anything, send a tiny test on the correct network, and never sign a prompt you do not understand. Anyone who asks for the phrase is not support.
Self-custody is a set of habits around a key. The wallet is the interface. The network is the ledger. The phrase is the backup. Mix those three up and the software will do exactly what you signed — including emptying the account.
Sources
[*]Ethereum.org — Ethereum wallets: https://ethereum.org/en/wallets/
[*]Ethereum.org — Ethereum accounts (EOA vs contract accounts, keys, `0x` addresses): https://ethereum.org/en/developers/docs/accounts/
[*]Ethereum.org — How to create an Ethereum account (recovery phrase; Bitcoin vs Ether addresses): https://ethereum.org/en/guides/how-to-create-an-ethereum-account/
[*]Ethereum.org — How to use a wallet (receive, send, networks, irreversibility): https://ethereum.org/en/guides/how-to-use-a-wallet/
[*]Ethereum.org — Gas fees: https://ethereum.org/en/gas/
[*]Ethereum.org — Community support FAQ (wrong address, lost wallet, giveaways): https://ethereum.org/en/community/support/faq/
[*]MetaMask Help Center — Secret Recovery Phrase, password, and private keys: https://support.metamask.io/start/user-guide-secret-recovery-phrase-password-and-private-keys/
[*]MetaMask Help Center — How to recognize the real MetaMask (never enter SRP on a website): https://support.metamask.io/stay-safe/safety-in-web3/how-do-i-recognize-the-real-metamask-/
[*]MetaMask Help Center — Official support channels (no phone number; never asks for SRP): https://support.metamask.io/stay-safe/safety-in-web3/what-are-metamasks-official-support-channels/
[*]Trust Wallet — Seed phrase glossary: https://trustwallet.com/glossary/seed-phrase
[*]Trust Wallet — What is a seed phrase, and why is it important?: https://trustwallet.com/blog/academy/what-is-a-seed-phrase-and-why-is-it-important
[*]Ledger Academy — What is a seed phrase?: https://www.ledger.com/academy/basic-basics/2-how-to-own-crypto/whats-a-secret-recovery-phrase
[*]Ledger Support — How to keep your 24-word Secret Recovery Phrase and PIN safe: https://support.ledger.com/article/360005514233-zd
[*]Ledger Support — Scams targeting crypto holders: https://support.ledger.com/article/scams-targeting-crypto-holders
[*]Ledger Academy — Security tips for hardware wallets: https://www.ledger.com/academy/hardwarewallet/best-practices-when-using-a-hardware-wallet
[*]Bitcoin.org — FAQ (wallet holds keys; recovery phrase): https://bitcoin.org/en/faq
[*]Bitcoin.org — Vocabulary (wallet, private key, recovery phrase, address formats): https://bitcoin.org/en/vocabulary
[*]Bitcoin.org — Securing your wallet (custodial risk, hot vs cold, hardware): https://bitcoin.org/en/secure-your-wallet
[*]Bitcoin.org — Avoid scams (fake support, drainers, fake hardware, address poisoning): https://bitcoin.org/en/scams
[*]Bitcoin.org — Choose your wallet (hardware vs mobile/desktop; Bech32 / Taproot prefixes): https://bitcoin.org/en/choose-your-wallet
[*]Solana Docs — Account structure (32-byte base58 addresses): https://solana.com/docs/core/accounts/account-structure
[*]Solana Docs — How payments work (wallet address as public key): https://solana.com/docs/payments/how-payments-work
A wallet holds keys, not coins
Bitcoin.org states it directly: a Bitcoin wallet is an application that manages your private keys — the credentials that allow you to spend — while the coins themselves exist as records on the blockchain. Ethereum.org says the same thing: you never really hold cryptocurrency; you hold private keys; the funds are always on Ethereum’s ledger.
Think of a mailbox. Your public address is the street number you can share. Your private key is the only key that opens the box. The wallet app is the tool that shows the address and signs a request to move funds. Ethereum.org describes a wallet as a window onto an account. You can change apps later; the account lives on the network. If you still have the keys — typically as a seed phrase — you can open a different wallet and see the same balances. If you lose the keys, no company can look them up, because a self-custody wallet never stored them for you.
EOAs versus custodial exchange accounts
On Ethereum there are two kinds of accounts. An externally owned account, or EOA, is controlled by whoever has the private keys. A contract account is a smart contract, controlled by code. Ethereum.org’s account documentation is the reference: an EOA is a cryptographic key pair; the public address is 42 characters starting with
0x; creating one costs nothing; signing with the private key proves you may spend.When people say “I have a MetaMask” or “I have a Trust Wallet,” they usually mean a software wallet is displaying one or more EOAs. Ethereum.org is explicit: a wallet can manage several accounts, and one account can be opened in more than one wallet. The recovery phrase generates the accounts.
A custodial exchange account is a different species. You typically get a username, a password, email recovery, and customer support. Ethereum.org notes that you are trusting the exchange with custody. Bitcoin.org is blunt: when a third party controls your keys, you rely on their security and honesty, and exchanges and online wallets can be hacked, fail, or freeze access to funds. In an EOA you control, there is no “forgot password” that reaches a human. MetaMask cannot recover a wallet for you. Trust Wallet never stores your seed phrase on its servers; lose the device and the phrase, and restoration is impossible.
The seed phrase is the most dangerous object in the setup
When you create a self-custody wallet, the software or hardware device shows 12 to 24 ordinary English words. MetaMask generates a 12-word Secret Recovery Phrase; Ledger generates 24 words on the device screen; Trust Wallet uses 12 words for a new app wallet (and documents 12 to 24 in general). The words come from a BIP-39 list. Order matters. They are the master backup of the private keys. Anyone who has the phrase can restore the wallet and spend. Ledger, MetaMask, and Trust Wallet all state the same rule: whoever has the phrase controls the accounts.
Official guidance from those vendors, plus Bitcoin.org and Ethereum.org: write the words on paper, check spelling and order, and store the copy somewhere only you can reach. Bitcoin.org recommends more than one physical place so a single fire or theft is not fatal. Do not photograph the phrase, email it, save it in cloud storage, type it into a website or chat, or give it to anyone — including people who claim to work for MetaMask, Ledger, Trust Wallet, or an exchange. The wallet password is not the seed. In MetaMask, the password unlocks the app on that device; the phrase recovers the wallet on a new device. Forgetting the password is recoverable if you have the phrase. Losing the phrase is not.
Ledger adds a hardware-specific warning: the recovery sheets in the box should be blank. The phrase is generated on the device during setup and displayed once. Never use a device that arrives with a PIN or phrase already filled in. Bitcoin.org describes the same attack as counterfeit hardware with a pre-generated seed known to the attacker. Buy hardware only from the manufacturer or an authorized reseller, and generate the phrase yourself. Do not type a Ledger 24-word phrase into MetaMask. Do not import a MetaMask 12-word phrase into a Ledger: that phrase was generated online.
If you lose the phrase and the device, the coins are still on the ledger — unreachable. Ethereum.org’s FAQ: without the seed phrase or private keys, funds cannot be recovered, and no one can reset a self-custody wallet.
Hot wallets and hardware wallets
A hot wallet is software on a phone, browser, or computer connected to the internet. Ethereum.org lists those as the common interfaces. They are how most people learn to receive and send, and they are reasonable for small everyday amounts. They are also exposed to malware, fake extensions, phishing pages, and sites that ask you to connect and then to sign.
A hardware wallet is a dedicated device that holds keys offline and signs transactions without revealing the private key to the computer. Bitcoin.org calls this one of the most secure methods to store funds, and notes that loss of the device without a backup can make funds unrecoverable. MetaMask’s security guide: keys stay offline, so you need physical possession of the device to sign. Bitcoin.org recommends keeping only small amounts on a computer or phone and the rest in a safer environment, including offline (“cold”) storage. Hardware is not magic. Type the seed into a fake site and the device cannot help. Approve a malicious transaction on the screen and the device will sign it.
How receiving and sending actually work
Ethereum.org’s “How to use a wallet” guide is the beginner sequence. To receive: open the wallet, tap Receive, copy the address or show the QR code, and give that public address to the sender. Ethereum addresses always start with
0x. Sharing the address does not hand someone your keys. It is not private — a block explorer will show it — but it does not let anyone spend. Do not type an address by hand. Clerical errors lose funds, and confirmed transactions cannot be reversed. Ethereum.org’s FAQ: if you sent crypto to the wrong address, there is in most cases no way to get it back.To send: confirm you are on the same network as the recipient, paste or scan the address, enter the amount, review the fee, and confirm. On Ethereum the fee is called gas and must be paid in ETH, even if you are sending a token. Fees move with congestion. After confirmation you cannot cancel. Send a tiny test amount first, then the rest. Verify the entire destination address, not just the first and last characters. Bitcoin.org documents “address poisoning” — dust from lookalike addresses so you copy the wrong one from history — and malware that rewrites an address in the clipboard. Check status on a block explorer by searching the address or the transaction ID.
Networks: Ethereum, Solana, and Bitcoin addresses are not interchangeable
This is the second most expensive beginner error after leaking a seed phrase. Ethereum.org’s account-creation FAQ answers it in one line: you cannot send bitcoin to an Ethereum address, or ether to a Bitcoin address. They are separate networks with separate address formats. Wrapped assets and bridges exist; they are extra machinery, often custodial, not “the same coin in a different box.”
Official format descriptions, in brief:
[*]Ethereum (and many EVM-compatible chains): starts with `0x`, then 40 hexadecimal characters. Ethereum.org notes that the same address can work on blockchains that use similar software to Ethereum. Bitcoin is not on that list.
- Bitcoin: legacy addresses start with `1` or `3`. Native SegWit (“bc1”) addresses are described on Bitcoin.org’s wallet chooser; Taproot addresses begin with `bc1p`.
- Solana: official docs describe a 32-byte address displayed as a base58 string with no `0x` prefix, derived from an Ed25519 keypair — different cryptography from Ethereum.
The same ticker on two networks is not the same asset. Ethereum.org warns that tokens such as DAI or USDC exist on multiple networks and are not interchangeable; sender and recipient must be on the same network. Send USDC on Ethereum to a Solana address, or Bitcoin to an
0x address, and the likely outcome is permanent loss. Multi-chain apps can display several networks. That does not merge them. Match both the asset and the chain.The scams that target people who just installed a wallet
You will meet these in the first week.
Fake support. MetaMask states that it has no phone number, never contacts you first, never discusses tickets on Twitter, Telegram, Discord, or Instagram, and will never ask for your Secret Recovery Phrase. Ledger does not offer phone support, will never ask for the 24-word phrase, and treats anyone who asks as a scammer. Bitcoin.org: no legitimate person, business, or support team will ever ask for your seed phrase or private key. Typical script: you posted a question, a “support agent” DMs you, and they ask you to “verify” with the 12 or 24 words or to install remote-access software. Hang up. Use only the vendor’s published support site.
Drainer sites. Bitcoin.org’s scam catalog describes the pattern: a fake website prompts you to connect a wallet and sign a transaction that grants permission to transfer assets. The page can look like a mint, an airdrop, a “connect to claim,” or a copy of a real app. Connecting is not always the theft. Signing the malicious approval is. Read every prompt. If a page asks for the seed phrase, it is fake — MetaMask is explicit that no legitimate MetaMask website will ever ask for it. Bookmark official domains. Download from the vendor’s site or the genuine store listing, not from an ad. Ledger documents fake Ledger Wallet sites whose only job is to harvest the 24 words.
Giveaways and urgency. Ethereum.org’s FAQ calls Ethereum giveaways scams. Bitcoin.org covers free giveaways, impersonation, and AI-generated impersonation in video and voice. If a famous person is “going live” to double your deposit, it is a trap. Transactions are irreversible. Bitcoin.org also describes a second-wave pitch: recover lost funds for an upfront fee. No legitimate firm offers guaranteed cryptocurrency recovery.
Closing, without trading advice
This is not a recommendation to buy an asset. Download a wallet from its official site, write the seed on paper before you fund anything, send a tiny test on the correct network, and never sign a prompt you do not understand. Anyone who asks for the phrase is not support.
Self-custody is a set of habits around a key. The wallet is the interface. The network is the ledger. The phrase is the backup. Mix those three up and the software will do exactly what you signed — including emptying the account.
Sources
[*]Ethereum.org — Ethereum wallets: https://ethereum.org/en/wallets/
[*]Ethereum.org — Ethereum accounts (EOA vs contract accounts, keys, `0x` addresses): https://ethereum.org/en/developers/docs/accounts/
[*]Ethereum.org — How to create an Ethereum account (recovery phrase; Bitcoin vs Ether addresses): https://ethereum.org/en/guides/how-to-create-an-ethereum-account/
[*]Ethereum.org — How to use a wallet (receive, send, networks, irreversibility): https://ethereum.org/en/guides/how-to-use-a-wallet/
[*]Ethereum.org — Gas fees: https://ethereum.org/en/gas/
[*]Ethereum.org — Community support FAQ (wrong address, lost wallet, giveaways): https://ethereum.org/en/community/support/faq/
[*]MetaMask Help Center — Secret Recovery Phrase, password, and private keys: https://support.metamask.io/start/user-guide-secret-recovery-phrase-password-and-private-keys/
[*]MetaMask Help Center — How to recognize the real MetaMask (never enter SRP on a website): https://support.metamask.io/stay-safe/safety-in-web3/how-do-i-recognize-the-real-metamask-/
[*]MetaMask Help Center — Official support channels (no phone number; never asks for SRP): https://support.metamask.io/stay-safe/safety-in-web3/what-are-metamasks-official-support-channels/
[*]Trust Wallet — Seed phrase glossary: https://trustwallet.com/glossary/seed-phrase
[*]Trust Wallet — What is a seed phrase, and why is it important?: https://trustwallet.com/blog/academy/what-is-a-seed-phrase-and-why-is-it-important
[*]Ledger Academy — What is a seed phrase?: https://www.ledger.com/academy/basic-basics/2-how-to-own-crypto/whats-a-secret-recovery-phrase
[*]Ledger Support — How to keep your 24-word Secret Recovery Phrase and PIN safe: https://support.ledger.com/article/360005514233-zd
[*]Ledger Support — Scams targeting crypto holders: https://support.ledger.com/article/scams-targeting-crypto-holders
[*]Ledger Academy — Security tips for hardware wallets: https://www.ledger.com/academy/hardwarewallet/best-practices-when-using-a-hardware-wallet
[*]Bitcoin.org — FAQ (wallet holds keys; recovery phrase): https://bitcoin.org/en/faq
[*]Bitcoin.org — Vocabulary (wallet, private key, recovery phrase, address formats): https://bitcoin.org/en/vocabulary
[*]Bitcoin.org — Securing your wallet (custodial risk, hot vs cold, hardware): https://bitcoin.org/en/secure-your-wallet
[*]Bitcoin.org — Avoid scams (fake support, drainers, fake hardware, address poisoning): https://bitcoin.org/en/scams
[*]Bitcoin.org — Choose your wallet (hardware vs mobile/desktop; Bech32 / Taproot prefixes): https://bitcoin.org/en/choose-your-wallet
[*]Solana Docs — Account structure (32-byte base58 addresses): https://solana.com/docs/core/accounts/account-structure
[*]Solana Docs — How payments work (wallet address as public key): https://solana.com/docs/payments/how-payments-work