- Explain the difference between an address, a private key and a recovery phrase.
- Spot common phishing and approval traps.
- Use a safer send-and-receive process.
What a wallet controls
A public address can usually be shared to receive assets. A private key authorises actions from that address. A recovery phrase is a human-readable backup that can recreate a wallet’s keys. The phrase is not a password that support staff should request; anyone with it may be able to control the assets.
Custodial services may hold keys on your behalf, while non-custodial wallets put more responsibility on you. Neither label removes risk. Custody, counterparty exposure, software bugs and human error are different risk categories.
- Public address: identifier you can share for receiving.
- Private key: secret authorisation material.
- Recovery phrase: secret backup that must stay offline and private.
A safer transaction routine
Install wallet software only from the project’s official source. Record a recovery phrase offline, never in a screenshot or cloud note, and check the words before confirming. When sending, compare the address on the device screen with the intended address and verify the network and token type.
Use a small test transaction when the amount or destination is meaningful. Smart-contract approvals can grant permissions that persist beyond one action, so review and revoke permissions through trusted tools when appropriate.
Threats worth recognising
Phishing pages copy a real exchange or wallet. Fake airdrops ask you to connect and approve a transaction. Impersonators offer recovery help or promise to reverse a payment. Malware can replace a copied address. These attacks target attention, not technical expertise alone.
Use bookmarks, hardware confirmation screens, transaction simulations and independent verification. If something feels rushed, stop. A delayed transaction is usually easier to handle than an irreversible mistake.
- Unexpected direct messages
- Seed-phrase requests
- Unverified browser extensions
- Token approvals you do not understand
- Address replacement malware
Before pressing send
Read the destination address from the trusted source, compare the first and last characters, check the network, send a small test if appropriate, and only then send the planned amount. Keep the confirmation and transaction ID for your records.
Carry these four ideas forward.
- Keep recovery material offline.
- Use official downloads and bookmarks.
- Verify address, network and token.
- Reject urgency and unsolicited support.
Three questions before the next tab.
Choose the answer that best matches the lesson. This is a memory check, not a market signal.
Before you move on
Should I keep crypto on an exchange or in a wallet?+
That is a custody and risk decision. Compare counterparty, access, recovery, security and local regulatory considerations; learn the mechanics before moving funds.
Can a transaction be reversed?+
Many blockchain transactions cannot be reversed once confirmed. A recipient or service may choose to help, but there is no general undo button.
Is a hardware wallet risk-free?+
No. It can reduce some online-key exposure, but phishing, loss, wrong network and recovery-phrase mistakes remain possible.