Wallet

A crypto wallet does not hold coins — it holds the private keys that authorise moving them. Everything that matters follows from that: who controls the keys controls the assets, and a wallet you do not hold keys for is an account at someone else’s company. This desk covers wallet software and hardware, the recurring ways users lose funds, and the custody question underneath it all.

What we track on this desk

• Self-custody versus custodial. Hardware wallets, mobile wallets and exchange accounts, and what each actually protects against.
• Security incidents. Supply-chain compromises, malicious approvals and phishing campaigns, reported with the mechanism named rather than as generic “hacks”.
• Recovery and inheritance. Seed phrases, multisig and social recovery — the part users postpone until it is too late.
• Account abstraction. Smart-contract wallets that allow spending limits and key rotation, and where they are actually usable.
• Institutional custody. The regulated end of the same problem.

How to read a wallet story here

Almost every reported “wallet hack” is not a break of the wallet. It is a user approving a malicious transaction, a compromised device, or a phishing site — the cryptography held and the human was targeted. That distinction changes what a reader should do about it, so our coverage names the mechanism or says plainly that it has not been established.

Drainer campaigns get double-counted too: several outlets reporting the same losses from one analytics source is one publisher’s claim repeated, not corroboration. Our count only rises when a publisher reports it independently, and an Echo does not count at all.

Where to go next

See the Verification Center for how publishers are counted, or the Custody hub for how institutions solve the same problem.