Beginner guide to crypto wallets and security

If you are new to crypto, the concept of a "wallet" can be confusing. Unlike a physical wallet, a crypto wallet does not store your coins - it stores the keys that prove you own them. Understanding this distinction is the foundation of good crypto wallet security. This guide explains how wallets work, which type suits different needs, and what practical steps you can take to keep your digital assets safe.

What is a crypto wallet?

A crypto wallet is a tool that stores your private keys - the cryptographic credentials that give you control over your assets on the blockchain.

Your coins never actually leave the blockchain. Instead, the blockchain records that a specific address owns a specific amount. Your wallet holds the private key to that address. Whoever controls the private key controls the assets. This is why key security is so important - and why the phrase "not your keys, not your coins" is so widely repeated in the crypto world.

Every wallet has two key components:

• A public key (or wallet address): like a bank account number. You can share this with others so they can send you assets.
• A private key: like your PIN or password, but far more sensitive. Never share this with anyone.

Most modern wallets also give you a seed phrase (sometimes called a recovery phrase) - a set of 12 or 24 words that can restore access to your wallet if you lose your device. Your seed phrase is the master key to everything in that wallet. Store it carefully offline.

What are the main types of crypto wallets?

Crypto wallets fall into two broad categories: hot wallets and cold wallets. The key difference is whether they are connected to the internet.

Hot wallets

Hot wallets are connected to the internet, which makes them convenient for regular transactions but more exposed to online threats.

Common types include:

• Exchange wallets: assets held directly on a centralised exchange (such as Binance, Kraken, or Crypto.com). Easy to use, but the exchange controls the private keys - not you. If the exchange is hacked or goes insolvent, your assets are at risk.
• Software wallets: apps installed on your phone or computer (such as MetaMask or Trust Wallet). You control the private keys, which improves security compared to exchange wallets - but they are still exposed to malware or device vulnerabilities.
• Web wallets: browser-based wallets. Convenient but among the most exposed to phishing and session hijacking attacks.

Cold wallets

Cold wallets store your private keys offline, disconnected from the internet. They are significantly more secure for long-term storage.

Common types include:

• Hardware wallets: physical devices (such as Ledger or Trezor) that store private keys in an isolated chip. To approve a transaction, you must physically confirm it on the device. This makes remote theft extremely difficult.
• Paper wallets: your private key printed or written on paper. Secure from digital attacks but vulnerable to physical damage, loss, or theft.

The general principle: use hot wallets for assets you transact with regularly, and cold wallets for assets you intend to hold long term.

What is the difference between custodial and non-custodial wallets?

This distinction is fundamental to understanding how crypto platforms and exchanges work.

A custodial wallet is one where a third party (an exchange or platform) holds your private keys on your behalf. You log in with a username and password, and the provider manages the keys. It is convenient, but it means you are trusting that provider with your assets. If the provider is hacked, goes bankrupt, or freezes withdrawals, your access to funds may be compromised.

A non-custodial wallet is one where you hold your own private keys. The platform you use cannot access or move your funds without your explicit action. This gives you full ownership - but also full responsibility. If you lose your seed phrase, there is no customer support team that can recover it for you.

Diamond Pigs operates on a non-custodial model. The platform connects to your exchange wallet via API and places automated buy and sell orders on your behalf - but it can never withdraw or transfer your funds. Your assets remain in your exchange wallet at all times, and Diamond Pigs only has permission to trade within your spot wallet. This design means you benefit from automated investing without giving up custody of your assets. You can read more about how this works on the Diamond Pigs how it works page.

How do you secure a crypto wallet?

Securing your crypto assets does not require advanced technical knowledge. Most security incidents happen because of basic mistakes - weak passwords, clicking phishing links, or storing seed phrases digitally. The steps below eliminate the majority of common risks.

Use strong, unique passwords

Your exchange account is the gateway to your assets. Use a password manager to generate and store a long, unique password for each platform. Never reuse passwords across services.

Enable two-factor authentication (2FA)

Two-factor authentication adds a second verification step when you log in. Use an authenticator app (such as Google Authenticator or Authy) rather than SMS-based 2FA - SIM-swapping attacks can intercept SMS codes. Enable 2FA on your exchange account and any associated email addresses.

Protect your seed phrase offline

• Write it down on paper immediately and store it in a secure physical location
• Never photograph it, type it into a computer, or store it in cloud storage
• Consider using a fireproof safe or a metal backup product designed for seed phrase storage
• Do not share it with anyone - legitimate platforms will never ask for it

Keep software updated

Software wallets and exchange apps release security updates regularly. Running outdated versions leaves known vulnerabilities unpatched. Enable automatic updates or check manually at least once a month.

Be alert to phishing

Phishing is one of the most common ways crypto assets are stolen. Attackers create fake websites, emails, or social media accounts that mimic legitimate platforms. Always check the URL carefully before entering credentials. Bookmark the official sites you use regularly. Be sceptical of unsolicited messages asking you to connect your wallet or enter your seed phrase.

Use a hardware wallet for large holdings

If you hold a significant amount of crypto long term, a hardware wallet is worth the investment. It keeps your private keys offline and requires physical confirmation for every transaction - making remote attacks essentially impossible.

What security risks should crypto investors know about?

Understanding the most common attack vectors helps you avoid them. The major risks are:

Exchange hacks - Centralised exchanges are large targets. Several major exchanges have been hacked over the years, resulting in significant losses for users with assets in custodial wallets. Keeping only the assets you need for trading on an exchange - and moving the rest to non-custodial or cold storage - reduces this risk.

Phishing attacks - Fake websites, emails, and social media impersonation attempts trick users into entering their credentials or seed phrases on malicious sites. Always verify URLs. Never click login links sent by email or direct message.

Malware - Malicious software can monitor your clipboard (copying wallet addresses), record keystrokes, or directly target wallet applications. Use reputable antivirus software and avoid downloading software from unverified sources.

SIM swapping - Attackers convince a mobile carrier to transfer your phone number to a SIM they control, allowing them to intercept SMS-based 2FA. This is why authenticator apps are strongly preferred over SMS 2FA.

Social engineering - Scammers impersonate platform support, crypto influencers, or even friends, asking for seed phrases or offering fake investment opportunities. No legitimate platform will ever ask for your private key or seed phrase.

Smart contract vulnerabilities - When using DeFi applications, smart contract bugs can result in funds being drained. This is less relevant for exchange-based investing, but important to understand if you interact with decentralised protocols.

How does security work when using an automated crypto platform?

Platforms like Diamond Pigs that use API connections to manage investments on your behalf operate differently from giving a platform direct wallet access.

When you connect Diamond Pigs to your exchange account, you create an API key on the exchange side and configure it to allow trading only - specifically within the spot wallet. The API key does not have withdrawal permissions. This means Diamond Pigs can place buy and sell orders, but it cannot send your funds anywhere.

This is an important distinction. You keep full custody of your assets on the exchange. The platform manages your portfolio automatically - but it can never move funds out of your account. You can also revoke the API key at any time through your exchange account settings, instantly removing the platform's access.

This model reflects the Diamond Pigs best practices approach: automated investing that keeps the investor in control. If you want to understand the full setup process, the platform's knowledge base walks through API connection step by step.

Key takeaways

• A crypto wallet stores your private keys - not your coins. Whoever controls the private key controls the assets.
• Hot wallets are convenient but more exposed to online threats. Cold wallets offer stronger security for long-term holdings.
• Custodial wallets (exchange accounts) give a third party control of your keys. Non-custodial wallets give you full ownership.
• Your seed phrase is the master key to your wallet. Store it offline, never digitally, and never share it.
• Most crypto security incidents result from basic mistakes: weak passwords, SMS-based 2FA, phishing clicks, or seed phrases stored online.
• API-connected platforms like Diamond Pigs operate without withdrawal permissions - your assets stay in your exchange wallet throughout.

Frequently asked questions

Do I need a crypto wallet to use Diamond Pigs?
Diamond Pigs connects to your account on a supported exchange (such as Binance, Kraken, or Crypto.com) via API. Your assets stay on the exchange - Diamond Pigs places orders within your spot wallet but cannot withdraw or transfer funds. You do not need a separate external wallet to use the platform. The exchange account itself functions as your wallet for this purpose.

What happens if I lose my seed phrase?
If you lose your seed phrase for a non-custodial wallet and your device is also lost or broken, access to those funds may be permanently lost. There is no central authority that can recover a seed phrase for you - this is by design in a decentralised system. This is why physical, offline backup of your seed phrase is essential from the moment you create a wallet.

Is it safe to keep crypto on an exchange?
Keeping assets on a centralised exchange is convenient but carries specific risks - primarily exchange hacks and insolvency. Major exchanges like Binance and Kraken have strong security practices, but no exchange is completely immune. A sensible approach is to keep only the assets you actively trade on an exchange, and move longer-term holdings to a hardware wallet. If you use Diamond Pigs, your assets stay on the exchange to enable automated trading - but the API permission structure limits Diamond Pigs to trading only, not withdrawals.

What is two-factor authentication and why does it matter for crypto?
Two-factor authentication (2FA) requires a second verification step when you log in - usually a time-sensitive code from an authenticator app. It means that even if someone steals your password, they still cannot access your account without also having your phone. For crypto accounts where asset loss is irreversible, 2FA is not optional - it is essential. Always use an authenticator app rather than SMS-based 2FA, which is vulnerable to SIM swapping attacks.

What is the difference between a hot wallet and a cold wallet?
A hot wallet is connected to the internet (exchange wallets, software wallets, web wallets). It is convenient for regular use but more exposed to online threats. A cold wallet is kept offline (hardware wallets, paper wallets). It is less convenient but significantly more secure for long-term storage. Most experienced crypto investors use both: a hot wallet for day-to-day transactions, and a cold wallet for the bulk of their holdings.

Can an automated trading platform access my crypto without my permission?
With a properly configured API connection, no. When you connect a trading platform to your exchange account via API, you control which permissions the API key has. For automated investing purposes, the key should be set to allow trading only - not withdrawals. Diamond Pigs, for example, explicitly uses API keys without withdrawal permissions. Your assets stay in your exchange wallet, and you can revoke the API key at any time.

Glossary

Private key - A cryptographic string that proves ownership of a blockchain address. Whoever holds the private key controls the assets at that address. Must never be shared.

Public key / wallet address - The address others use to send you crypto. Safe to share publicly - it is the equivalent of a bank account number.

Seed phrase - A set of 12 or 24 words that can restore access to a wallet. It is the master backup for your private keys. Store offline only, never share.

Hot wallet - A crypto wallet connected to the internet. Convenient but more vulnerable to online attacks.

Cold wallet - A crypto wallet stored offline (hardware or paper). More secure for long-term holdings.

Custodial wallet - A wallet where a third party (such as an exchange) holds your private keys on your behalf.

Non-custodial wallet - A wallet where you hold your own private keys. Full ownership, full responsibility.

API key - A credential that allows a third-party application to interact with your exchange account. Permissions (such as trading-only vs. withdrawal access) are set when the key is created.

2FA (two-factor authentication) - A security layer requiring a second verification step (beyond password) to log in. Authenticator apps are preferred over SMS-based 2FA.

Hardware wallet - A physical device (such as Ledger or Trezor) that stores private keys offline and requires physical confirmation for transactions.