Track 2 · Keeping crypto safe · Module 7

Wallets, keys and seed phrases

What a wallet really holds, and why 12 words matter more than a password.

Lessons: 7
Reading: 46 min
Quiz: 15 questions
Pass mark: 80%

1What a wallet really holdsWhat does a crypto wallet actually hold?5 min
2Private keys, public keys and addressesHow is a crypto address made from a private key?7 min
3Signatures: what signing provesWhat does signing a crypto transaction or message prove?7 min
4Seed phrases and the maths of 12 wordsHow does a 12-word seed phrase work, and why does it matter more than a password?8 min
5One phrase, many accountsHow can one seed phrase hold many accounts, and what is a derivation path?8 min
6Kinds of walletsWhat are the main types of crypto wallet?5 min
7Putting it together: a company's first walletsWhat are the parts of a crypto wallet, and who should see each one?6 min

The case used in this module

The Brindlecove Labs case (made up)

Brindlecove Labs is a made-up company with a made-up token, BRDL. Its made-up finance lead, Maya Quist, is moving the company's crypto onto its first hardware wallet. Its dollars stay at Pellowmark Bank, a made-up bank.

The phrase: a hardware wallet makes a new 24-word recovery phrase on its own screen.
Two accounts from one phrase: a Treasury account at path m/44'/60'/0'/0/0 and a Payments account at m/44'/60'/1'/0/0.
The addresses: each account has its own 42-character address starting with 0x. Suppliers get the Payments address.
The auditors: get the two addresses, so they can watch balances and payments without being able to sign.
A check: Maya restores the phrase on a second hardware wallet, typing the words on the device itself, and looks for the same two addresses.

The lessons follow Maya as she learns what each piece is, and who should see it. Some quiz questions ask about her. These are examples, not rules, and nothing here is advice.

Each module tells its own made-up Brindlecove story, so details can differ from one module to the next.

Key words

Wallet: An app or device that holds your keys and lets you see balances, send and receive crypto, and sign in to apps. The coins themselves stay on the blockchain.¹²
Private key: A huge random number that signs transactions. Anyone who has it controls the account, so it must stay secret.³⁴⁵
Public key: A key worked out from the private key by one-way maths. It lets others check your signatures, but it can't be used to approve transactions.⁶³
Address: The identifier you share so others can pay you. On Ethereum, it is the last 20 bytes of the Keccak-256 hash of the public key, written as 0x and 40 hex characters.⁴
Externally-owned account (EOA): An ordinary Ethereum account controlled by a private key. With the key you can do anything; without it, nothing.⁷
Digital signature: Proof, made with a private key, that the key's owner approved exactly this data. Anyone can check it, and checking it doesn't reveal the key.⁸³
Checksum: Extra information added to an address or phrase so that software can spot most typing mistakes.⁹¹⁰
EIP-55: An Ethereum standard that hides a checksum in which letters of an address are capitals.⁹
Recovery phrase (seed phrase): A list of 12 to 24 words that can rebuild every key in a wallet. Anyone who has it can drain the wallet.¹⁰⁵
BIP-39: The standard that turns 128 to 256 random bits, plus a checksum, into words from a list of 2,048.¹⁰
Entropy: The random bits a wallet starts from. A 12-word BIP-39 phrase carries 128 bits.¹⁰
HD wallet: A hierarchical deterministic wallet: one seed grows a whole tree of keys, so one backup covers them all.¹¹
Derivation path: The address of one key in an HD wallet's tree, such as m/44'/60'/0'/0/0. It names the purpose, coin type, account, change chain and address index.¹²
Watch-only wallet: A wallet that holds addresses or public keys but no private keys, so it can watch balances and payments but can't spend.²¹¹
Typed data (EIP-712): A standard way to sign structured messages, so a wallet can show what each field means before you sign.¹³
Blind signing: Approving something your wallet can't show in readable form, such as a raw hash. Ledger compares it to signing a blank cheque.¹⁴

Sources

Ethereum wallets explained. ethereum.org, page updated 24 February 2026.
Mastering Ethereum, 2nd edition, chapter 5: Wallets. Andreas M. Antonopoulos, Gavin Wood and co-authors (CC BY-NC-ND 4.0 for its first 12 months, then CC BY-SA 4.0), GitHub, checked 22 October 2026.
Mastering Bitcoin, 3rd edition, chapter 4: Keys and Addresses. Andreas M. Antonopoulos and David A. Harding (CC BY-SA 4.0), GitHub, December 2023.
Ethereum accounts. ethereum.org (developer documentation), page updated 6 August 2026.
Ethereum security and scam prevention. ethereum.org, page updated 6 June 2026.
Crypto Asset Custody Basics for Retail Investors – Investor Bulletin. US Securities and Exchange Commission, Office of Investor Education and Assistance (Investor.gov), 12 December 2025.
Account abstraction. ethereum.org, page updated 24 June 2026.
Mastering Ethereum, 2nd edition, chapter 6: Transactions. Andreas M. Antonopoulos, Gavin Wood and co-authors (CC BY-NC-ND 4.0 for its first 12 months, then CC BY-SA 4.0), GitHub, checked 22 October 2026.
ERC-55: Mixed-case checksum address encoding. Ethereum Improvement Proposals (eips.ethereum.org), created 14 January 2016; status Final.
BIP 39: Mnemonic code for generating deterministic keys. Bitcoin Improvement Proposals (github.com/bitcoin/bips), assigned 10 September 2013.
BIP 32: Hierarchical Deterministic Wallets. Bitcoin Improvement Proposals (github.com/bitcoin/bips), assigned 11 February 2012.
BIP 44: Multi-Account Hierarchy for Deterministic Wallets. Bitcoin Improvement Proposals (github.com/bitcoin/bips), assigned 24 April 2014.
EIP-712: Typed structured data hashing and signing. Ethereum Improvement Proposals (eips.ethereum.org), created 12 September 2017; status Final.
What Is Clear Signing?. Ledger Academy (hardware-wallet maker's documentation), updated 19 October 2026.