The crypto app store is chaos. There are wallets, extensions, dashboards, bots, trackers and "free airdrop checkers" (please don't). For a beginner, it's hard to even tell what job each tool is supposed to do, which is exactly how people end up typing their seed phrase into a fake "portfolio tracker".
This guide sorts everything into categories. Each category does a different job: some hold your assets, some just watch them, and some watch the network itself. Get that distinction clear and you'll avoid one of the most common early mistakes.
We mention some well-known products so you can recognize each category. That's not an endorsement, and we don't get paid for it. Always download apps from official sources and do your own checks.
Wallets and custody
A wallet doesn't actually store coins. Your crypto lives on the blockchain. A wallet stores the private keys that let you move it (our tech guide explains keys properly). The main types:
- Hot wallets (software)
- Apps or browser extensions on an internet-connected device, such as MetaMask, Phantom or Trust Wallet. Free, convenient and needed for most DeFi. The downside: they're exposed to malware, phishing sites and malicious approvals because they're always online.
- Cold wallets (hardware)
- Small dedicated devices, such as those made by Ledger or Trezor, that keep keys offline and only sign transactions when you physically confirm them. Much harder to hack remotely. Best for larger, long-term holdings. Buy only from the official manufacturer, never second-hand.
- Exchange custody
- When your crypto sits on an exchange account, the exchange holds the keys. Easiest to use and offers password recovery, but you're trusting the company's security and solvency. If it fails or freezes withdrawals, your funds can be stuck. "Not your keys, not your coins" is the saying.
- Multi-signature wallets
- Wallets that need several keys to approve a transaction, like two of three. Great for shared funds, organizations or high-value holdings, because one stolen key isn't enough. More complex to set up and manage.
- Smart contract wallets
- Newer wallets built as smart contracts, which can offer features like spending limits, social recovery (trusted contacts helping you recover access) and paying fees in different tokens. Powerful, but you're also trusting the contract's code.
Choosing a custody setup
There's no single right answer. It depends on how much you hold and what you do with it.
| Setup | Best for | Main risk |
|---|---|---|
| Exchange custody | Beginners, small amounts, active trading | The company fails, gets hacked or freezes withdrawals |
| Hot wallet | Everyday use, DeFi, NFTs, small to medium amounts | Phishing, malware, malicious approvals |
| Hardware wallet | Long-term holding, larger amounts | Losing the device and the seed phrase backup |
| Multi-signature | Shared funds, teams, very large holdings | Complexity; losing too many keys |
Storing your seed phrase
- Write it on paper or stamp it into metal. Store it somewhere safe from fire, water and curious housemates.
- Never photograph it, store it in notes apps, email it to yourself or keep it in cloud storage.
- Consider a second copy in a separate secure location.
- Never type it into a website. Legitimate apps only ask for it when you're restoring a wallet you set up yourself.
Portfolio trackers
Read-only apps that show all your balances across wallets and exchanges in one place, with performance over time. Many exchange and wallet apps have this built in, and dedicated trackers exist too.
A tracker only needs your public addresses, or exchange API keys set to read-only. It should never need to move your funds. If a tracker asks for your seed phrase or withdrawal permissions, close it.
Charting and market data
Sites that show prices, volume, market cap and order books across exchanges. Data aggregators like CoinGecko and CoinMarketCap list thousands of assets; charting platforms like TradingView add drawing tools and technical indicators.
Useful for understanding the market, but a chart doesn't tell you what a project actually does or whether it's safe. Also be aware that market cap for small tokens can be misleading if most of the supply is locked or held by a few wallets.
Block explorers and on-chain research
Block explorers are free search engines for blockchains: paste in an address, transaction or token and see everything about it. Examples include Etherscan for Ethereum, mempool.space for Bitcoin and Solscan for Solana. They're the best way to check if a transaction went through, see where funds went, or verify a token's contract address.
A step up are analytics platforms such as Glassnode, Dune, Nansen and Arkham, which turn raw data into charts and label known addresses. DeFi dashboards like DefiLlama track value locked across protocols. Our on-chain analysis guide shows how to use this data without misreading it.
Tax and accounting
Tax tools like Koinly, CoinTracker and CoinLedger import your history from exchanges and wallets and calculate gains, losses and income. They save huge amounts of time, especially if you trade often or use DeFi.
They're only as good as the data you give them. Check for missing transactions, mislabeled transfers between your own wallets, and tokens without prices. And they don't replace a professional for anything complex. Our crypto tax basics explains what they're calculating.
Security and monitoring
The most underrated category. These tools catch the problems that cause most real-world losses.
- Approval checkers
- When you use a DeFi app, you often grant a smart contract permission to spend a token on your behalf, sometimes an unlimited amount. Tools such as Revoke.cash show every approval you've granted and let you cancel old or suspicious ones.
- Transaction previews
- Many wallets now simulate a transaction and show what will leave your wallet before you sign. Read it every time. If it says you're about to send everything you own, stop.
- Phishing and scam warnings
- Browser extensions and wallet features that flag known malicious websites and contracts.
- Account security
- A password manager, unique passwords, and two-factor authentication using an authenticator app or hardware security key (not SMS) for every exchange and email account.
Scams you'll actually run into
| Scam | How it works | How to avoid it |
|---|---|---|
| Fake support | Someone "from the exchange" or "wallet team" DMs you to fix a problem and asks for your seed phrase or remote access | Real support never DMs first and never asks for your phrase |
| Wallet drainers | A fake site or "free mint" gets you to sign a transaction that hands over your tokens | Only use bookmarked official sites; read every transaction preview |
| Address poisoning | A scammer sends a tiny transaction from an address that looks like one you use, hoping you copy it from your history | Copy addresses from a trusted source, and check the whole address, not just the start and end |
| Fake airdrops | Random tokens appear in your wallet with a link to "claim" more | Ignore unknown tokens; never visit the link |
| Investment romance scams | A new online friend slowly persuades you to invest on a platform they recommend, which is fake | Never invest on a platform recommended by someone you've only met online |
| Guaranteed returns | "Send 1, get 2 back" or "guaranteed 2% a day" | Guaranteed high returns are always a scam |
No legitimate wallet, exchange or support team will ever ask for your seed phrase or private key. If anything asks for it, it is not legitimate, no matter how official it looks.
Starter setups
Some example setups depending on where you are. Adjust to your situation.
- Just getting started
- A reputable, regulated exchange in your country with two-factor authentication on. Keep amounts small while you learn. Practice sending a tiny amount to a hot wallet so you understand how it works.
- Using DeFi or NFTs
- A hot wallet for day-to-day activity holding only what you're actively using, plus a habit of revoking old approvals monthly. Keep the rest elsewhere.
- Holding long-term
- A hardware wallet for the bulk of your holdings, with the seed phrase stored offline in a secure place, and a separate hot wallet for experiments.
Checklist before trusting any new tool
-
Check the permissions it wants
A tracker needs read access. A wallet holds keys. Anything asking for more than its job needs deserves a hard second look.
-
Verify you're on the official site
Type the address yourself or use a bookmark. Search ads and DMs are common phishing routes.
-
Look for independent review
Open-source code, public audits and a long track record are easier to trust than a slick website.
-
Start small
Test with an amount you could afford to lose before you commit more.
-
Separate your wallets by job
Keeping long-term holdings, trading funds and experiments in different wallets limits how much one mistake can cost.
Questions people ask
Do I need a hardware wallet?
Not for small amounts you're still learning with. Once you hold an amount that would really hurt to lose, a hardware wallet is widely considered worth it.
Is it safer to keep crypto on an exchange?
It's easier, and some exchanges have strong security, but you're trusting the company. Several large exchanges have collapsed or frozen withdrawals in the past. Self-custody shifts the risk to you.
What happens if my hardware wallet breaks?
As long as you have your seed phrase, you can restore your wallet on a new device. The device is replaceable; the seed phrase isn't.
How often should I revoke approvals?
A quick monthly check is a good habit if you use DeFi, and always after using a new or unfamiliar app.
I think I've been scammed. What now?
Move any remaining funds to a new, clean wallet immediately, revoke approvals, change passwords, and report it to the platform involved and your local authorities. Be wary of "recovery services" that contact you; many are scams too.
This article is general education about how things work. It is not financial, investment or tax advice, and it doesn't consider your circumstances. Do your own research and talk to a licensed professional before making decisions with money.