Crypto wallets: where your coins should actually live

The seed phrase, properly explained

When you set up a self-custody wallet it gives you twelve or twenty-four ordinary English words. Those words are not a password to your wallet. They mathematically generate every private key in it. Anyone who has them has your funds, from anywhere in the world, instantly and irreversibly. Anyone who does not — including you — has nothing.

This produces two opposed failure modes that you have to solve simultaneously. Store the phrase too carelessly and it gets stolen. Store it too carefully, in one place only, and you recreate the Newport problem. The answer is redundancy without exposure: multiple physical copies, geographically separated, each individually secure.

Practical rules. Write it by hand or stamp it into metal — paper burns and dissolves, steel plates designed for this cost around £30 and survive both. Store copies in at least two locations, for instance a home safe and a trusted relative's house or a bank safe deposit box. Never photograph it, never type it into any device, never store it in a password manager or cloud notes, and never enter it into a website. Every wallet-drainer phishing site in existence is asking for exactly those words.

Hardware wallets

A hardware wallet is a small dedicated device that stores private keys in a secure element and signs transactions internally, so the keys never touch your computer. Even on a compromised machine, an attacker cannot extract them. You confirm each transaction on the device's own screen, which also defends against malware that alters a destination address in your clipboard.

Expect to pay between £50 and £150. Buy directly from the manufacturer's own website — never from a marketplace reseller, an auction site or a third party. Supply-chain tampering is documented, and the classic attack ships a device with a pre-printed "your recovery phrase" card containing a seed the attacker already controls. A genuine device always generates its seed itself, in front of you, at first setup.

Set it up yourself, verify the recovery phrase during setup, and send a small test transaction before moving anything substantial. Then practise the recovery process on a spare device or a wallet reset, so you know your backup actually works before you need it.

Inheritance, and why Wales should care

Cryptoassets form part of your estate. HMRC treats them as property for inheritance tax purposes, and they are valued at the date of death like any other asset. The difficulty is not legal — it is practical. An executor cannot access a wallet without the seed phrase, and cannot even begin if nobody knows the assets exist.

The Newport case is the extreme version of a problem that is going to become ordinary. A generation that bought crypto in their twenties and thirties is now in their forties, and estates containing wallets nobody can open are already reaching solicitors. In Cardiff you can find a firm that has dealt with one. In much of mid, west and north Wales you cannot, which makes planning ahead more important rather than less.

A workable approach: keep a written record of what you hold and roughly where — which exchanges, which wallet types, which devices — stored with your will or somewhere your executor will find it. Keep the seed phrase itself entirely separate, with access arranged through a mechanism you have actually thought about. Tell the person who will administer your estate that the assets exist. And take proper legal advice if the sums are meaningful; this is one area where a generic template is genuinely inadequate.

Moving coins off an exchange, without losing them

Four steps, in order, every time. Add the destination address to your exchange's allowlist and expect a security hold of up to 24 hours on a newly added address — that delay is protecting you. Send a small test amount first and confirm it arrives. Only then send the balance. And verify the address on the hardware wallet's own screen rather than trusting what your computer displays, because clipboard-hijacking malware exists specifically to swap addresses at the moment you paste.

Be aware of the compliance side too. Under the Travel Rule, in force since September 2023, firms must collect and transmit originator and beneficiary information on cryptoasset transfers, with customer due diligence triggered at a flat £800 threshold since 30 June 2026. You may be asked who controls the destination wallet. Answer honestly — and keep the record, because when you eventually sell, the receiving platform will ask where the coins came from. Our cashing-out guide covers why that matters.

Wallet-specific fraud

Three patterns account for most self-custody losses. Fake wallet applications, published in app stores with convincing branding, which harvest the seed phrase at setup. Phishing sites impersonating a wallet's own support or a "validation" process, asking you to enter your phrase. And malicious token approvals, where you sign a transaction that grants a contract permission to move your assets — common in DeFi and rarely understood by the person signing.

Download wallet software only from the developer's official site or a link you have verified independently. Never enter a seed phrase anywhere. Review what you are actually approving before signing, and periodically revoke old approvals. And remember that Welsh police forces recorded more than ten thousand fraud reports in a single year — our scams page covers the wider picture.