Crypto Wallets Explained: Software, Mobile and Hardware

A crypto wallet is the app or device that holds your private keys, the secret numbers that prove you may spend coins recorded on a blockchain. The coins never leave the chain. Pick the wallet type by how much you hold and how often you move it: a phone or desktop app for small, frequent payments, a hardware device for savings, and an exchange account only for coins you are about to trade.

This page replaces our old separate software, hardware and mobile wallet pages, several of which recommended apps that have since closed or been renamed. Below you will find how wallets work, how the main types compare, which old names to retire, and how to set one up without the mistakes that cost people money. Updated October 2026.

What a wallet really holds

Think of a blockchain as a public ledger anyone can read. Your balance is simply the sum of entries assigned to addresses you control. Control means holding the matching private key, and the wallet’s job is to keep that key safe, sign transactions with it, and show you a readable balance.

Most modern wallets derive every key from one master secret written as a recovery phrase. The common standard, BIP39, uses words from a fixed list of 2,048 English words, and phrases are normally 12 or 24 words long. From that phrase the wallet can regenerate thousands of addresses in a predictable order, which is why one backup covers everything.

Three pieces are worth separating in your head:

• Address: what you share to receive coins. Safe to publish.
• Private key: what signs a payment. Never shared, never typed into a website.
• Recovery phrase: the master copy of all your keys. Anyone holding it holds your coins.

Custodial or self-custody: the first decision

Before choosing an app, decide who should hold the keys. A custodial service (an exchange, a broker, a payment app) keeps them for you and gives you a login. Self-custody means the keys exist only in software or hardware you control.

History explains why the distinction matters. Mt. Gox, once the largest Bitcoin exchange, stopped withdrawals and filed for bankruptcy protection in Tokyo in February 2014; its creditors waited about a decade for repayments to begin. FTX filed for bankruptcy in November 2022, and its founder was later convicted of fraud in New York and sentenced to 25 years. Customers of both held exchange balances rather than their own keys.

Custody is not automatically bad. Regulated exchanges carry insurance on some fiat balances, help with forgotten logins and are the normal on-ramp from a bank account. Our exchange comparison covers how to judge one. The sensible pattern for most people is to buy on an exchange, then withdraw anything you are not trading to a wallet you control.

Hot and cold storage

A hot wallet keeps keys on a device that is online: your phone, laptop or browser. It is convenient and free, but malware, a phishing page or a stolen unlocked phone can reach the keys. Cold storage keeps keys on hardware that never exposes them to an internet-connected computer, so a payment must be approved on the device itself.

Neither is a moral choice. A sensible split looks like a current account and a savings account: a small hot balance for spending, and the rest in cold storage that you touch a few times a year.

The wallet types compared

Software wallets on a computer

Desktop wallets give the most control over how a transaction is built. Electrum, first released in November 2011, is still maintained and remains a reference Bitcoin wallet: it encrypts keys locally, restores from a seed phrase, supports multisig and pairs with the main hardware wallets. Sparrow is another Bitcoin-only desktop wallet popular with people who want to choose exactly which coins (UTXOs) they spend. If you still use an original model, our Ledger Nano S guide explains what its end of support means.

Multi-coin desktop apps such as Exodus put many networks behind one interface. That convenience comes at a cost: you depend on one company to support every chain correctly, and their code is not fully open to inspection in every case. Read what each app says about where keys are stored before you fund it.

Browser extensions are a separate group. MetaMask is the best-known Ethereum-style extension, and it now also handles Solana and Bitcoin in recent versions. The risk with any extension is less about theft of the key file and more about you approving a malicious transaction or token allowance on a fake site. Our Ethereum guide explains gas fees and why a signature request deserves a careful read.

Mobile wallets

A phone is already a decent security device. Recent iPhones keep sensitive keys in the Secure Enclave and Android offers a hardware-backed Keystore on most devices, so a reputable wallet app can protect keys better than a laptop file would. Mobile wallets also handle QR codes natively, which removes the need to copy long addresses by hand.

Good habits for phone wallets are short: install only from the developer’s own link to the official store, turn on a device passcode and biometric lock, write the recovery phrase on paper rather than in a screenshot or cloud note, and keep only spending money there. Lightning-enabled apps let you send small Bitcoin amounts almost instantly at tiny fees, useful for payments rather than storage.

Hardware wallets

A hardware wallet is a small device that generates and stores keys internally. When you send, your computer or phone prepares the transaction, the device shows the address and amount on its own screen, and you confirm with a button press or touch. Malware on the computer can change what you see on the monitor, but it cannot change what the device displays and signs.

The established makers are Trezor (since 2014), Ledger, KeepKey, BitBox, Coinkite (COLDCARD) and Blockstream (Jade). They differ in three ways that matter: whether the firmware is open source, whether a secure element chip protects the keys against physical attacks, and whether the device is Bitcoin-only or multi-coin. Bitcoin-only firmware has less code and fewer features to go wrong; multi-coin devices suit people holding Ethereum, Litecoin, XRP or Dogecoin alongside Bitcoin.

Buy directly from the manufacturer or an authorised reseller. A device that arrives with a recovery phrase already printed in the box, or with a request to enter your phrase on a computer, is a scam, whatever the packaging looks like.

Old wallet names and what happened to them

CoinChoose has published wallet reviews since the early Bitcoin years, and several names we once covered are gone or have changed into something else. Here is their status as of October 2026:

For the Trezor Model T, the company says software updates continue until at least 2031 and critical security fixes until at least 2036, so owners need not rush. Older Ledger Nano S units keep working for basic sending and receiving.

If you still hold a phrase from any discontinued app, the coins are recoverable as long as the phrase is. Install a maintained wallet from its official source, choose “restore”, enter the words, and wait for it to scan. Some old apps used non-standard derivation paths, so if the balance shows zero, check the new wallet’s documentation for the right path before panicking. Once the funds appear, send them to a newly created address and treat the old phrase as retired.

Address formats you will meet

Sending to the wrong kind of address is one of the commonest reasons coins go missing. Each network has its own format, and some have several:

The 0x row deserves attention. An Ethereum address is valid on every compatible network, so a wallet will happily send USDC on the wrong chain. Whether the receiver can recover it depends entirely on whether they control that address on that network. Exchanges usually cannot. Our coin guides for Bitcoin, Litecoin, Dogecoin and XRP go into each network’s quirks.

Setting up a wallet without the usual mistakes

1. Get the software from the source. Type the developer’s address yourself or follow the link on their site to the app store. Search ads for wallet names have repeatedly pointed to clones.
2. Create a new wallet offline-first where possible. A hardware device generates its own phrase; with an app, disconnect while you note the words if you are cautious.
3. Write the phrase on paper or stamp it in metal. No photos, no cloud notes, no password-manager fields that sync to a browser. Number each word.
4. Verify the backup. Most wallets ask you to re-enter some words. Better still, wipe a test install and restore from the paper before you fund it.
5. Send a small test amount first. Confirm it arrives, then send the rest.
6. Record what you did. Note the wallet name, the coin types, and whether you added a passphrase. Your future self or your heirs will need it.

Passphrases, Shamir backups and multisig

Many wallets let you add an optional passphrase, sometimes called a 25th word. It creates a completely different set of addresses from the same phrase, so someone who finds your paper backup alone sees an empty or decoy wallet. The catch is unforgiving: forget the passphrase and those coins are gone, because nothing stores it.

Trezor’s Safe models support SLIP-39 “Shamir” backups, which split a recovery secret into several shares where a set number (for example any two of three) rebuild it. You can then keep shares in different places without any single share being useful to a thief.

Multisig goes further by requiring signatures from several separate keys, each ideally on a different device from a different maker. A 2-of-3 arrangement survives the loss of one device and resists the theft of one. Desktop wallets such as Electrum and Sparrow can coordinate it, and several companies sell assisted multisig where they hold one of the three keys as a backup.

Smart accounts on Ethereum

Ethereum wallets are changing in a way Bitcoin wallets are not. Since the Pectra upgrade on 7 May 2025, EIP-7702 lets an ordinary Ethereum account temporarily act like a smart contract. In practice that allows features such as batching an approval and a swap into one confirmation, paying fees in a token other than ETH through a sponsor, or setting spending limits. Wallets are rolling these features out gradually. They are useful, but each one is another thing to understand before you sign, so read the prompt every time.

Scams that target wallet holders

Most losses come from tricking the owner, not breaking the cryptography. The patterns repeat:

• Phrase phishing. A site, email or “support agent” asks for your recovery phrase to “validate”, “sync” or “unlock” the wallet. No legitimate service ever needs it.
• Fake apps and extensions. Clones copy the name and logo of popular wallets and send every phrase entered to the attacker.
• Address poisoning. An attacker sends a worthless transaction from an address that matches the first and last characters of one you use, hoping you copy it from your history next time. Check the whole address, or use your address book.
• Clipboard malware. Software that swaps a copied address for the attacker’s. A hardware wallet’s screen defeats it if you actually compare.
• Unlimited token approvals. Signing an approval for a malicious contract lets it drain that token later. Revoke old approvals periodically.
• Too-good-to-be-true offers. “Send 1, get 2” giveaways and fake airdrops. Our free bitcoin guide covers what is genuine and what is not.

Rules that touch self-custody

Holding your own keys is legal in the major markets, but regulated platforms must ask questions when coins move between them and private wallets. In the European Union, the Transfer of Funds Regulation (EU) 2023/1113 has applied since 30 December 2024. For transfers above 1,000 euros to or from a self-hosted wallet, the crypto-asset service provider must assess whether that wallet is owned or controlled by its customer. Expect an exchange to ask you to confirm ownership, sometimes by signing a message or sending a small test amount.

Tax is separate from custody. Moving coins between your own wallets is generally not a disposal, but selling, swapping or spending usually is, wherever the keys sit. Keep records of every transfer so you can show which addresses are yours.

Choosing a wallet by situation

If you trade, the exchange’s own security tools matter. Kraken and Coinbase both offer withdrawal allow-lists and app-based two-factor authentication; see our notes on Kraken and Coinbase Advanced.

Planning for when you cannot access it

Self-custody shifts responsibility to you, including after you are gone. A short sealed letter that lists the wallet types, where backups are kept, whether a passphrase exists and who can help, without writing the phrase itself in the same place, saves families a great deal of trouble. Revisit it whenever you change devices.