Why you should know this
A password can often be reset. A self-custody wallet secret may be the authority itself. Sharing it can be more like handing over a signed blank transfer than revealing an ordinary username.
We all begin somewhere, so there is no embarrassment in pausing to label each secret correctly before funds arrive.
Four things that are often confused
Private key: secret cryptographic information used to authorize transactions from an address. It must remain private.
Seed or recovery phrase: a sequence of words from which a wallet can recreate keys. In many wallet designs, it can restore all accounts derived from that phrase.
Wallet password or PIN: usually unlocks an app or encrypted data on one device. It may not restore the wallet elsewhere.
One-time verification code: approves a login or sensitive action for an account. It should not be given to a caller or chat contact.
The precise recovery design varies. Follow the official documentation for the wallet being used.
How a key pair works—without the mathematics
A typical blockchain account uses related public and private information.
- The public side helps form an address or verify that a signature is valid. It can usually be shared for receiving or checking activity.
- The private side creates the signature that proves authorization. It should remain under the owner’s control.
The network does not need to see the private key. It checks the signature produced by it. That is powerful because participants can verify authorization without learning the secret itself.
It also explains why a support agent cannot safely “check whether your private key works.” A legitimate wallet performs signing locally or through its approved security design. Sending the raw key to another person destroys the separation that makes it private.
A seed phrase is a recovery root, not an ordinary password
Many wallets generate several accounts or keys from one recovery phrase. The phrase may therefore control more than the single address visible on the first screen. Deleting the app, changing its PIN or moving one token does not automatically make an exposed phrase safe.
A phrase is also not an account name. Two people who enter the same valid phrase into compatible wallet software may recreate the same key authority. The network cannot tell which person is the rightful owner; it sees valid signatures.
Some wallets do not use the familiar word-list model, and newer designs may add multiple keys or recovery guardians. The governing question remains: what information or combination can recreate authorization?
What a recovery phrase can do
If a wallet uses a recovery phrase, someone who obtains it may recreate the wallet on another device without possessing your phone. Changing an app PIN may not remove that authority.
That is why legitimate support can ask for a public address or transaction hash but should never need the private key or recovery phrase. Public information helps inspect a network record; secret information authorizes control.
Safer handling principles
- Create or reveal a recovery phrase only inside the verified wallet process.
- Keep it out of email, chat, support tickets, online forms and shared documents.
- Avoid screenshots or ordinary cloud notes; automatic photo backup can copy them elsewhere.
- Keep durable offline recovery records protected from theft, fire, loss and unauthorized viewing.
- Do not invent a clever transformation that your future self cannot reconstruct.
- Never test a suspicious website by entering the real phrase.
- Ensure trusted recovery arrangements match your circumstances without exposing the secret casually.
There is no storage method with zero risk. The aim is to remove single, obvious failure points while keeping recovery possible.
Plan for four different backup threats
A backup can fail in opposite ways, so evaluate more than theft.
- Confidentiality: Can an unauthorized person read or copy it?
- Availability: Can you reach it after a lost phone, disaster or long absence?
- Integrity: Can you tell whether the words, order or material were damaged or changed?
- Continuity: Could an authorized person follow the plan if you were unavailable?
Keeping the only copy beside the wallet phone is convenient but creates one physical failure point. Keeping many unprotected copies increases exposure. Encrypting or transforming the phrase without a durable recovery method can lock out the owner as effectively as destroying it.
Choose a method appropriate to the amount and circumstances, and review it after moving home, changing devices or changing who should have access. For significant or complex arrangements, qualified security, estate or legal advice may be needed.
What never belongs in a support conversation
Do not send any of these through chat, email, screen share or an online form:
- the private key;
- the seed or recovery phrase;
- a wallet backup file and its decryption secret;
- a password, passkey approval or one-time code;
- a QR image that encodes a private key;
- a live screen showing the phrase during “troubleshooting.”
A public address and transaction hash are different. They normally identify public network data, though they can still reveal financial activity and should not be posted more widely than necessary.
Signing is also a security decision
A private key may authorize more than a simple transfer. A wallet can ask you to sign a message, approve token spending or interact with a smart contract. The interface should show what authority is requested, but a misleading site can make the request difficult to understand.
“It did not ask for my seed phrase” is therefore not enough. Before signing, check the verified site, account, network, destination, amount and permission. If the meaning is unclear, reject the request and investigate from an independent source.
Later Academy lessons will go deeper into approvals and smart contracts. For now, remember: protecting the secret and reviewing how it is used are two separate controls.
Practice recovery without risking a funded wallet
Do not learn by deleting the only funded wallet and hoping the backup works. Use an approved no-money exercise, test environment or newly created empty wallet whose loss has no consequence. Follow the wallet’s official instructions and avoid typing a real funded phrase into unfamiliar software.
The exercise should answer:
- Which exact information restores access?
- Does the restored wallet show the expected empty test address?
- Where will the durable backup live?
- What would happen if one device or one record disappeared?
Once funds exist, recovery is no longer the ideal place for improvisation.
Philippine scenario: the “wallet validation” message
Mika receives a direct message in a community group: “Your wallet must be validated before the network upgrade. Enter the 12 words here.” The sender knows her name and uses the project logo.
The request is still unsafe. Networks do not need a website to learn Mika’s secret. She closes the message, checks the wallet’s official channel independently and warns the group administrator without posting her phrase or wallet balance.
If a phrase or private key may be exposed
Treat it as compromised. Do not argue with the sender or keep using the same secret because “nothing happened yet.” From a clean, trusted device, consult the wallet’s official security guidance and consider establishing a new uncompromised wallet before moving any remaining assets. Verify every destination and fee carefully; rushed recovery can create a second loss.
For a custodial account, use its official account-compromise process instead—the provider, not the customer, holds the blockchain key.
Preserve relevant messages, URLs, times and transaction IDs. No recovery step guarantees that stolen assets will return.
If an attacker already moved assets, the old phrase cannot be “changed” to reverse those signed transactions. Report through the relevant provider, recipient or authority where appropriate, but be prepared for limited recovery. Anyone demanding an advance crypto payment to recover the funds may be attempting a second scam.
Scam or Legit?
- “Send your public address so we can inspect the transfer.” Potentially legitimate, if the channel is independently verified.
- “Send your seed phrase so we can reverse the transfer.” Scam or dangerous request.
- “Read me the six-digit code to cancel the withdrawal.” Unsafe; the code may approve it.
Continuity without casual disclosure
Self-custody planning must consider more than today’s device. Illness, incapacity, death, fire or relocation can make a perfect secret unavailable to the rightful owner or family. The answer is not to post the phrase in a will, email it to relatives or give one person an unlabeled copy without understanding the consequences.
For meaningful value, consider appropriate legal and technical continuity planning with qualified local advice. Record what the wallet is, where non-secret instructions live and what trusted process applies. Separate that information from the secret itself, and test the process with an unfunded wallet before relying on it.
How this connects to market mastery
Private-key control underlies wallet signing, smart-contract approval, custody, settlement and institutional key management. Professionals add policies, multiple approvals and secure hardware, but the basic principle remains: separate information used to identify activity from secrets used to authorize it.
Key takeaways and check
- Private keys authorize; recovery phrases can recreate keys.
- A device PIN, account password and seed phrase are not interchangeable.
- Support does not need wallet secrets to inspect a public transaction.
- A potentially exposed self-custody secret should be treated as compromised.
Security check: Classify these as public or secret: wallet address, transaction hash, password, private key, recovery phrase and verification code. Only the first two are normally public.
*Cryptocurrency and virtual asset transactions are highly volatile and irreversible, may result in significant losses, and do not guarantee returns; customers should trade only after understanding the risks involved.
