In July 2024, WazirX — India's largest crypto exchange at the time — got hacked. Over $230 million worth of crypto was drained in one of the biggest exchange hacks in history. Thousands of Indian users woke up to frozen accounts and the dawning realisation that the money they thought they owned was, in a very real sense, not theirs.

This article is for everyone who saw that news and thought: wait, what exactly do I own when I buy crypto?

A Massive Misconception, Cleared Up

When you buy Bitcoin on CoinDCX or WazirX, you don't actually receive Bitcoin. What you receive is a promise from the exchange — an IOU. They hold the actual Bitcoin in their wallets. Your account balance is just a number in their database.

It's not fundamentally different from a bank telling you your money is safe. And just like a bank can freeze accounts, get hacked, or go bankrupt — an exchange can do all of those things too. Which is exactly what happened with WazirX. And FTX globally. And Mt. Gox before that.

The phrase the crypto community uses: "Not your keys, not your coins."

What is a Crypto Wallet, Really?

Most explanations go wrong here — they describe a crypto wallet as something that "stores" your cryptocurrency. It doesn't. Not exactly.

Your cryptocurrency never actually moves anywhere — it always lives on the blockchain. What a wallet stores is your private key — a unique password that proves you're the owner of a particular address and gives you the right to move those funds.

Think of your blockchain address like a bank account number — public, shareable, where people can send you money. Your private key is like the PIN that only you know. A crypto wallet is essentially a keychain. It holds your private keys and lets you sign transactions.

Types of Wallets: From Convenient to Fort Knox

Hot Wallets are connected to the internet — apps like MetaMask or Trust Wallet on your phone. Convenient for daily use, but being online means potential exposure to hacks and phishing.

Cold Wallets are hardware devices — a Ledger or Trezor looks like a chunky USB drive. Your private keys are stored completely offline. Hackers can't reach what isn't connected to the internet.

Paper Wallets are your private key printed on paper. Old-school, but technically valid. Just don't lose the paper, get it wet, or have your house burn down.

For most Indian users starting out, a hot wallet like MetaMask or Trust Wallet is fine for small amounts. Once you're holding amounts you'd genuinely be upset to lose — get a hardware wallet. Ledger costs around ₹8,000–12,000. That's a one-time insurance premium on whatever you're holding.

Seed Phrases: The Thing You Cannot Lose

When you set up a wallet, it gives you a seed phrase — usually 12 or 24 random words in a specific order. This seed phrase is the master key to your wallet. It can recreate your private keys on any device, anywhere in the world, even if your phone dies.

Lose it — and your crypto is gone. Forever. There's no customer support to call. No "forgot password" link. Write it on paper. Store it somewhere safe. Never photograph it. Never type it into any website — ever. Legitimate wallets will never ask for your seed phrase. If anyone asks, they're trying to steal from you.

Custodial vs. Non-Custodial

Custodial wallets — your exchange account. The exchange holds your keys. Convenient, but you've handed over control.

Non-custodial wallets — you hold your own keys. MetaMask, Trust Wallet, Ledger. Nobody else has access. You are fully responsible.

Neither is objectively better — it depends on what you're doing. Actively trading? An exchange makes sense for that portion. Long-term holding? Get your crypto off the exchange. The people who got hurt worst in the WazirX hack were the ones who'd parked their entire portfolio there because it felt like a bank. It's not a bank. That's the whole point.

How to Send and Receive Crypto

Receiving is easy — share your wallet address with whoever is sending. Like giving someone your UPI ID, except it's public and permanent.

Sending: open your wallet, enter the recipient's address, specify the amount, confirm the transaction fee (called "gas" on Ethereum), and sign. Done.

One critical warning: crypto transactions are irreversible. Unlike a UPI transfer, blockchain transactions cannot be undone. Send to the wrong address and that crypto is gone. Always triple-check addresses for large amounts.

Setting Up Your First Wallet

For a beginner in India, here's a sensible path: Download Trust Wallet or MetaMask from the official app store (beware of fake apps — a huge scam vector). Create a new wallet. Write down your seed phrase on paper immediately, before you do anything else. Transfer a small test amount — ₹200 worth — from your exchange first to confirm it arrives. Then move larger amounts.

That's it. You're now your own bank.