A crypto wallet does not hold coins. It holds keys, and whoever holds the keys controls the money, which is why almost every crypto loss reported to police is a key problem rather than hacking. The one rule that never changes: the recovery phrase is never typed into anything but the wallet app itself, and never shown to another person. Most people reading this do not need a wallet at all, and that is a good answer.
What does a wallet actually store?
A wallet stores a private key and the software to sign transactions with it. The balance lives on a public network that thousands of computers keep a copy of, and that network has no idea who anyone is. It checks only whether an instruction was signed by the key controlling the address. Install a wallet and the coins do not move into your phone; the app becomes able to sign for you.
Banking language does not transfer. There is no account in the sense a credit union uses the word, no branch, no fraud department. A wallet is either non-custodial, meaning you control the keys and there is no company-held account for anyone to recover, or custodial, where a business holds the keys. A business that can restore access can also freeze or lose the funds.
Exchange accounts are custodial. Phone apps and in-messenger wallets are usually non-custodial. Crypto Office, reached through the official @officeapp bot on Telegram, is named here as one example of that in-messenger category, not a recommendation. It matters because a wallet living inside a chat app also sits where the scam messages arrive.
What is a seed phrase, and what is the rule?
A seed phrase, or recovery phrase, is the list of twelve or twenty-four ordinary words a wallet generates when created. Those words are a readable version of the private key. Anyone who types that sequence into any compatible wallet immediately controls the funds. It is not a password protecting an account; it is the money.
The rule is short. The phrase goes on paper, stored somewhere physically safe, and is shown to nobody. Never photographed, never emailed to yourself, never kept in a notes app, never typed into a website, form or support chat. No exchange, developer, giveaway or recovery service has a legitimate reason to ask. Every request for it is theft.
The less discussed half: losing the phrase is as final as having it stolen. A sticky note is one house fire from a permanent loss, which is why people holding real amounts keep the backup in a fireproof box or on a metal plate.
How do the common attacks actually work?
1. Fake support accounts
The most common attack by a wide margin. Someone posts a question in a public group about a wallet problem and within minutes gets a message from an account using the project’s logo and a near-identical name. It is polite and competent, and ends with a request to validate the wallet on a site asking for the recovery phrase. Real support never messages first.
2. Clipboard-swapping malware
A program running quietly on a phone or computer watches the clipboard for anything shaped like a crypto address and substitutes the attacker’s at the moment of pasting. The victim copies the right address, pastes what looks right, and pays a stranger. Check the first and last four characters after every paste.
3. Approval draining
Using a decentralised application means granting it permission to move a token from your wallet. Malicious sites ask for unlimited permission and a distracted user grants it. Nothing happens immediately, which is what makes it work. Weeks later the permission is used and the balance leaves in one authorised transaction.
4. SIM swaps
An attacker persuades a mobile carrier to move a phone number onto a SIM they control, using details from data breaches and social media. Every text-message code then lands on their device, enough to take over an email account. Text messages are the weakest second factor, and carriers will add a port-out PIN on request.
5. Fake wallet apps
Convincing copies of popular wallets appear regularly in app stores and atop search advertisements, sometimes with fabricated reviews. The counterfeit generates a seed phrase the attacker already knows, so funds are stolen on arrival. Install only from a link on the project’s own site.
How much should sit in a phone wallet at all?
For most people, nothing, because most people have no reason to hold crypto. For those who do, the amount should match what the storage method can protect.
| Where the funds sit | Upfront cost | Who holds the keys | Realistic worst case | Sensible balance to keep there |
| Regulated exchange account | $0 | The exchange | Account takeover or company failure | Only what is actively being traded |
| Phone or in-messenger wallet | $0 | You | Phone malware or a stolen seed phrase | Up to a few hundred dollars |
| Hardware wallet | $70 to $250 | You | Device lost with no written backup | The bulk of a long-term holding |
| Metal seed backup in a safe | $30 to $120 | You | Found by someone with access to the safe | Backup only, never a live balance |
| No crypto wallet at all | $0 | Not applicable | Missing a price movement | The right answer for most households |
A phone wallet is a pocket, not a vault: fine for a balance someone would be annoyed to lose, wrong for savings.
A worked example: what a test transaction costs
Consider a reader in Thunder Bay moving $1,800 worth of a token to a new wallet. Sending it in one go costs one network fee, say $1.20. Sending a $25 test first and the remaining $1,775 after costs two fees, $2.40, so caution costs an extra $1.20.
That is 0.067 percent of the amount moved, about seven cents per hundred dollars, in exchange for confirming the address is right and no clipboard swap occurred. Even a one-in-a-thousand chance of losing the lot would make that spend worth it fifteen times over, and first-time address errors run worse than that.
What should you do in the first hour if a wallet is compromised?
Speed matters more than diagnosis. In order:
- Move whatever remains. Create a new wallet on a device that was not involved, with a new seed phrase, and send any surviving balance there. A compromised wallet is not repairable; changing the PIN does nothing, because the attacker has the keys.
- Revoke active approvals, if the loss came from a decentralised application rather than a stolen phrase. Use a reputable revocation tool reached through a link you already trust, and cancel every permission on the address.
- Secure the surrounding accounts. Change the email password, replace SMS recovery with an authenticator app, and call the carrier to add a port-out PIN in case the number was the way in.
- Record the evidence: transaction identifiers, timestamps, amounts, and screenshots of the messages or sites involved. A police report needs them, and so does any exchange asked to freeze the funds.
- Report it, then stop. File with your local police service and the Canadian Anti-Fraud Centre, then refuse every offer of help that follows. Recovery services that contact victims after a loss are, with few exceptions, the same operation returning.
The pre-flight checklist
Before any money goes in, five things should be true. The seed phrase is on paper, somewhere fireproof, with no digital copy. The app came from the project’s official site, never a search advertisement. Email two-factor authentication is an app or hardware key. The balance could be lost without changing anything important. And any message asking for the recovery phrase is understood to be fraudulent.
FAQ
Can stolen cryptocurrency ever be recovered?
Occasionally, but rarely, and never by paying someone who contacts you. Transactions on public networks are permanent by design, so there is no reversal comparable to a chargeback. The realistic path runs through law enforcement working with an exchange: if the funds reach a regulated platform where the receiver was identity-verified, that platform can sometimes freeze the balance. It takes months and succeeds in a minority of cases. Anyone promising faster results for a fee is running a second fraud on the same victim.
Is keeping crypto on an exchange safer than a personal wallet?
It trades one set of risks for another rather than removing risk. An exchange manages keys professionally, can restore access if a password is forgotten, which protects people who would otherwise mishandle a seed phrase. Against that, it is a single target holding a great deal of money, and history includes platforms that failed, froze withdrawals, or did not hold what they claimed. The usual compromise: traded balances on a regulated exchange, long-term holdings in self-custody.
Do I need a crypto wallet if I have never bought cryptocurrency?
No. A wallet is a tool for holding and moving digital assets, and if you hold none there is nothing for it to do. Being told otherwise is itself a warning sign: a common opening move in investment fraud is getting a target to install a wallet so money can move quickly and irreversibly. If someone met online explains why you need one, the wallet is not the point of the conversation.
