If you delete the wallet app, are the coins gone?
New crypto users meet exchange accounts, wallet apps, and hardware wallets all at once. The most common misunderstanding is that a wallet is a box that holds coins. In reality the record of your assets lives on the blockchain, and a wallet manages the private keys that give you the right to move them.
That is why deleting a wallet app does not lose your funds if you still have the recovery phrase, and why a perfectly working app does not protect you if that phrase leaks. This guide compares custody options, explains what a recovery phrase can do, and looks at what a signature request actually authorizes.
What a wallet really holds
Ethereum.org describes wallets as applications for interacting with your account, emphasizing that the wallet manages access rather than holding the assets themselves. An address is public, like an account number anyone can see, but sending funds from it requires signing a transaction with the private key.
The balance on screen is simply what the wallet reads from the blockchain. Seeing a balance and having the authority to move it are different things, and who holds the private key is what separates one custody model from another.
Comparing custody options
Custody splits broadly into custodial arrangements, where a company holds the keys, and self-custody, where you do. Within self-custody, risk depends on whether the keys live on an internet-connected device or on separate hardware.
| Option | Who holds the keys | If you lose access | Main risks |
|---|---|---|---|
| Exchange custody | The exchange | Account recovery via identity checks | Hacks, insolvency, withdrawal freezes |
| Software wallet | You (phone or PC) | Recovery phrase only | Malware, phishing, lost device |
| Hardware wallet | You (separate device) | Recovery phrase only | Phrase exposure, supply-chain tampering |
| Multisignature wallet | Several key holders | Possible with the required number of keys | Setup errors, coordination between holders |
No option removes risk entirely. What changes is whether the risk sits with the provider or with you.
The power of a recovery phrase
Creating a self-custody wallet usually produces a recovery phrase of 12 or 24 words. Because that phrase can regenerate every key in the wallet, anyone who knows it can move the funds. Bitcoin.org's wallet security guidance recommends keeping backups offline and storing copies in more than one secure location.
Saving the phrase in a photo, cloud note, email, or chat app ties your wallet's safety to that service's account security. Legitimate wallet providers and support staff never ask for a recovery phrase, so any request to enter it should be treated as a scam signal.
What a signature request authorizes
Connecting a wallet to a website and signing can look like logging in, but it often grants token permissions, moves assets, or executes a smart contract. A token approval in particular lets a contract move your tokens up to a set limit, and some sites request an effectively unlimited allowance.
As a hypothetical example, a site that asks you to click "claim free airdrop" and then requests an unlimited approval could later move that token out of your wallet while you are doing something else entirely. Before signing, check the domain, the network, the type of permission requested, and the amount, and revoke approvals you no longer use.
If you keep assets on an exchange
Exchange custody is convenient, and a forgotten password can be recovered through identity checks. The trade-off is that the exchange controls the assets. The CFTC's customer advisory on virtual currency trading warns that trading platforms can be exposed to hacking, operational failures, and fraud.
If you use an exchange, look beyond login security: does it segregate customer assets from its own, what are its withdrawal policies and limits, how much does it disclose about reserves or holdings, and is there a process for compensating customers after an incident?
A custody check-up
Use the steps below to review how you hold assets today or when setting up a new wallet.
- List each asset and note whether the exchange or you hold its keys.
- Make sure no recovery phrase is stored online (photos, cloud, chat), and check where the offline copies are kept.
- Before a large first transfer, send a small test amount to the same address and compare the first and last characters of the pasted address.
- Review the token approvals your wallet has granted and revoke any you no longer need.
- On exchanges, enable two-factor authentication and withdrawal-address allowlists, and read the withdrawal and asset-segregation policies.
There is no perfect custody
Every custody choice moves risk rather than eliminating it. Self-custody reduces dependence on a company but puts loss and phishing risk on you; custodial services add convenience but make you reliant on the provider's operations and solvency.
The approval scenario above is hypothetical, and wallet and exchange features differ by service and change over time. Check each provider's current official documentation, and consider splitting holdings across methods according to the risks you are prepared to carry.