Crypto · Beginner · 4 min

Private keys and security

You can explain what private keys and seed phrases are, how attackers try to steal them, and the basic rules for keeping them safe.

Twelve words

When you set up a crypto wallet, it shows you a list of twelve or twenty-four ordinary words and tells you to write them down. Many people click past this step.

Those words can control everything in the wallet. Lose them, and the coins may be gone forever. Share them, and they belong to someone else within minutes. This lesson explains what they are, how criminals try to get them, and how to keep them safe.

Key = control

A private key is a long secret number. It proves that you control the coins at a blockchain address and lets you sign transactions that move them. Anyone who has the private key can move the coins. Investor.gov puts it bluntly: once created, a private key cannot be changed or replaced, and if you lose it, you permanently lose access.

Because private keys are hard to handle, most wallets use a seed phrase: a list of words from which all the wallet's keys can be recreated. If your phone breaks, the seed phrase restores the wallet on a new device. The SEC advises storing it in a secure place and never sharing it with anyone.

Attackers know this, and they target keys and seed phrases:

Phishing: fake websites, emails or ads that copy real wallets or exchanges and ask you to enter your seed phrase.
Fake support: accounts posing as help desks on social media or messaging apps, offering to fix a problem.
Malware: programs that search devices for keys, or change copied wallet addresses.
Fake apps: copies of popular wallets in app stores.

Basic rules:

Write the seed phrase down offline and store it securely, possibly in two places.
Never photograph it, store it in the cloud or type it into a website.
Never share it, with anyone, for any reason.
Double-check addresses before sending, and start with a small test amount.

Phishing in minutes

A fictional wallet user gets an email that looks exactly like a message from their wallet provider: a security update is required, please verify your wallet.

The link leads to a perfect copy of the provider's website.
The page asks for the seed phrase to complete the update. The user types it in.
Within minutes, all coins are moved to an unknown address.

The transaction is final. There is no bank to reverse it and no support line that can help. The real provider never asks for seed phrases.

Common mistakes

Storing the seed phrase as a screenshot. Phones and cloud accounts get hacked.
Trusting support messages. Real support never needs your seed phrase.
Skipping the backup. A broken device without a seed phrase means lost coins.
Sending large amounts without a test. One wrong character can lose everything.

The takeaway

Whoever has the private key or seed phrase controls the coins. Lose it and the coins are gone, share it and they can be stolen.

Check yourself

Quick quiz

4 questions. Instant feedback, nothing is saved.

1Tap the item that can restore a whole wallet if your device is lost.

Tap the chart.

The SEC notes a seed phrase can restore a wallet. Store it securely and never share it.
2You lose your private key and have no backup. What happens?

Investor.gov: a private key cannot be changed or replaced. Without it or a seed phrase, access is gone.
3A support agent asks for your seed phrase to fix a problem. What do you do?

Anyone with the seed phrase can take the coins. Requests for it are a classic scam.
4Where is a seed phrase safest?

Online copies can be stolen by malware or account hacks.

of 4 correct.