This article answers these questions, with the goal of educating users about one of the most important aspects of Web3 access infrastructure.

Wallets or keychains?

In the context of blockchain and Web3, a “wallet” is essentially a cryptographic key management system that doubles as a user interface allowing you to interact with network applications and services by reading and/or modifying the state of the blockchain. It is in this sense, therefore, that we will use the term “wallet” from now on.

Although the use of the term is already widespread, it is somewhat misleading, and it is worth dispelling a common misunderstanding right away. Contrary to popular belief, when you make a transaction on the blockchain you are not “sending” tokens from your wallet to someone else’s wallet. In fact, you are using your private key to sign a transaction and transmit it to the entire blockchain network. Only after the network validates your transaction will it be executed, and then this change will be reflected in the updated balances of your address and the recipient’s address.

In this sense, the term “wallet” is misleading because the applications we use to interact with the blockchain do not store money the way physical wallets do. Instead, they store the private keys that allow you to sign and make transactions, and the public keys that allow you to receive assets. A more apt analogy would be to a keychain, with the important difference that in the case of the blockchain this “keychain” not only manages the keys needed to interact with the network but also shows the record of transactions and the balances of the addresses associated with these keys.

But what exactly are the “keys” that digital wallets manage, and what are they used for?

Keys and seed phrases

A “key”, in the sense in which the term is used in cryptography, is the basis of a transformation, usually mathematical, of an ordinary message into an unreadable (encrypted) message.

In public-key cryptography, which is the standard used to implement blockchains, a pair of correlated keys are created for this purpose: the first is called private because it must be kept secret; the second is called public because it can be shared with anyone who wants to receive it. Any participant that has access to your public key can encrypt a message using that key, but only you can read it, using your private key. In addition, you can use your private key to “digitally sign” a message, allowing others to verify that you were the sender; this verification is also done using your public key.

Public-key cryptography — Source: Network Encyclopedia

A wallet stores and allows you to manage this key pair to interact with a blockchain.

• A public key refers to an address that allows you to send and receive transactions.
• A private key proves that you own the assets associated with your address.

You can think of your public key as analogous to your bank account number, and of your private key as analogous to the password you use to access your account and make transactions. As with banking, your public key can be shared with anyone to receive funds, but your private key, like your password, must be kept secret.

Public & Private Keys — Source: Crypto.com

Most modern wallet implementations use a single master key, also known as a seed phrase, to generate the public and private keys. This key generation system is called deterministic because in it the public and private keys are correlated and can always be reproduced from the same seed.

Seed phrases are represented as a list of English words (usually 12, sometimes 24) that you can write down and keep somewhere, and can reuse to retrieve your wallet if for some reason you lose access to it (say, by having a device stolen or damaged).

Example of seed phrases — source: Realt Academy

There are a set of industry standards for wallet implementations that ensure interoperability between different applications. Thanks to these standards, you can easily export and import your keys between wallets from different vendors.

More than keychains — wallets as Web3 identities

The keychain analogy helps, but it doesn’t catch all the functions of wallets. In a blockchain, nodes are constantly synchronizing the state of the network and updating the history of transactions made. As we saw above, wallets connect you to the blockchain nodes and allow you to read this history and also make transactions, registering new data in the network. In this sense, we can also say that wallets work analogously to a traditional web browser, serving as a gateway to access and interact with Web1 / Web2. Wallets, in turn, are your gateway to Web3. But they go further, and can also serve as your identity in this new environment.

In Web3, identity and reputation work very differently from what we are used to today. As a rule, in Web2 our identities are tied to some centralized provider, which almost always requires users to hand over confidential and personal information. Examples of such identities are your Google account, Facebook, Twitter, etc.

Web2 Login — Source: Dev.to

In Web3, you simply link your wallet to a decentralized application (dApp) to be able to interact with it. And unlike Web2 authentication methods, wallet addresses are pseudonymous by default. If a user chooses to connect the same wallet with multiple dApps, her (pseudonymous) identity can be easily transferable between those dApps, which means that over time the user can build up a sort of portable reputation, even without having to reveal her personal information.

Web3 Login — Source: Coinbase

As more and more aspects of our lives come to be experienced on Web3 — communication, work, education, entertainment, finance, and so on — all “orchestrated with tokens” (see Dixon and McCormick’s definition of Web3), our very identities will become more and more intertwined with the content of our wallets. For this reason, having a portable, privacy-preserving, and secure digital identity will become of paramount importance in this emerging future.

(I delve deeper into issues involving risks to our identities in Web3 and in the Metaverse in this article.)

Types of wallets

Types of Wallets — Source: Odyssey DAO

The first important distinction for categorizing wallets concerns whether or not they are connected to the Internet. So-called “hot wallets” are connected to the Internet, while so-called “cold wallets” are kept offline.

Hot wallets

In hot wallets, the user’s keys are stored and encrypted in the application itself, which is kept online. Examples of hot wallets include:

• Web-based wallets (websites or browser extensions)
• Wallets for mobile devices (Android or iOS applications)
• Desktop Wallets (applications installed on your OS)

Using a hot wallet, in its different forms, is generally quite convenient, but along with convenience also comes more risk, since computer networks tend to have hidden vulnerabilities that can be targeted by hackers or malware programs, among other forms of a system intrusion.

Hot wallets can be subdivided into two further categories, having to do with the way the keys are controlled in each case.

Custodial hot wallets

These are wallets managed by an exchange (for example, by Binance, Coinbase, Crypto.com, etc.), and require you to log in with a username and password to access them, just as you would do to access any traditional web application.

With a custodial wallet, you do not own your keys and therefore are not in full control of the assets they manage. As a popular saying in the crypto community goes, “not your keys, not your coins!”

Because of this, when using custodial wallets you must trust the service provider to securely store your assets and implement strong security measures to prevent unauthorized access. These measures include two-factor authentication (2FA), email confirmation, and biometric authentication, among others. Many exchanges will not allow you to transact until these security measures are properly configured by you.

Non-custodial hot wallets

These are self-managed wallets. The keys and assets these applications manage are fully under the control of the users. But since with great power comes great responsibility, this means that users of non-custodial wallets must take care of their own security regarding key and seed phrase storage. If any of these are lost, recovery may be difficult or even impossible, since they are not usually stored on any third-party server.

Cold wallets

Cold wallets are, by default, offline. This makes them less convenient than hot wallets, but as a rule, also makes them more secure.

Examples of cold wallets include:

• Paper wallets: as the name implies, a paper wallet is a physical location where private keys and/or seed phrases are written or printed. Since hackers cannot access these records remotely, this method is generally more secure than using a hot wallet connected to the internet. On the other hand, it opens up the potential risk that the piece of paper will be destroyed or lost, which could result in unrecoverable funds.
• Stainless steel wallets: To avoid the risk of destroying a paper wallet in case of fire or flooding, you can also engrave your private keys on a stainless steel plate. Some manufacturers even offer ready-made kits for this type of wallet.
• Hardware wallets: A hardware wallet is an external, dedicated device (usually a USB or Bluetooth device) that stores your keys. You can only sign a transaction by pressing a physical button on the device, which malicious actors cannot control.

Wallets with multiple signatures (multisig)

Also known as “multisig”, these are wallets that require two or more private key signatures to authorize transactions. This solution is useful for a number of use cases:

• An individual using a multisig wallet can avoid losing total access to the wallet in a scenario where one key is lost because then there will still be other keys able to sign transactions.
• Multisig wallets can make misuse of funds and fraud more difficult, which makes them a good option for hedge funds, exchanges, and corporations. Since each authorized person will have a key, and a transaction requires the use of most keys, it becomes impossible for any one individual to unilaterally perform unauthorized transactions.

(All the wallet types described above have multisig versions — hot, cold, hardware, and so on.)

How to secure your wallet

If your wallet’s private key or seed phrase gets lost or stolen, you not only risk losing access to your assets but, given what was said before, an integral part of your identity on Web3 will be jeopardized. Therefore, it is crucial that you learn how to secure your wallet to avoid fraud and identity theft.

Here are some tips to ensure the security of your wallet:

1. Store your private keys and your seed phrases in a safe place. Consider copying them to paper or stainless steel and storing them very well, or, if you prefer to have online access, use a password manager (such as 1Password or LastPass).
2. Never share your private keys or seed phrases with anyone. No matter who asks — just don’t share!
3. Protect your password. If your wallet has a separate password, anyone who obtains it can obtain your private key. So choose a secure password, preferably saving it in a password manager, and using 2FA.
4. Don’t leave valuable assets in your everyday hot wallet. Instead, put those assets in a cold wallet or in a separate hot wallet with reinforced security. If you have a lot of assets in your wallet and share your address publicly, sooner or later someone will try to pull a scam using this information and some social engineering techniques.
5. Carefully check any website URL, email address, or social network profile before taking any action involving your wallet. Scammers usually pose as a trusted platform to phish your seed phrase or private key.
6. Turn off private messaging in apps like Discord and Telegram, and never interact with unknown assets (such as NFTs) that appear “out of nowhere” in your wallet. These are two common attack vectors that scammers use.

In addition to these general tips, here are some suggestions of best practices for using cold wallets specifically:

1. Your seed phrase is more important than the device itself. If your cold wallet is damaged, you can always recover your assets by importing your seed phrase into another wallet. Therefore, prioritize the safety of the seed phrase as indicated above.
2. Do not use the seed phrase from a hot wallet in your cold wallet. The purpose of the cold wallet is to store a seed phrase offline. Reusing a hot wallet seed phrase in the cold wallet means bringing back all the problems of online storage.
3. Be very wary of cold wallet phishing attempts. Buy a cold wallet only from the official websites of the manufacturers (such as Ledger and Trezor). Do not respond to “support” emails, letters, or private messages asking for your seed phrase.

Common frauds involving wallets, and tips to avoid them

One of the main goals of scammers regarding the Web3 space is to trick you into sharing your private key or your seed phrase. Here is a list of common scams for this purpose, and tips for avoiding them.

Phishing attacks by fake customer support accounts

Scammers send a message via email, social network, SMS, etc., informing you that there has been some kind of problem with your wallet — for example, “Your Metamask account has been hacked.” The criminals then try to convince you to share your private key or your seed phrase, supposedly to verify that you really own the “hacked” account. If this happens:

• Carefully check the website URL, email address, social profile, or phone number from which the message originated.
• Even if the source seems reliable, remember: no reputable platform will ask for your private key or seed phrase!

MetaMask’s Fake Support Attack — Source: Odyssey DAO

Trust Wallet Fake Support Attack — Source: Rainbow

Airdrops of fake tokens and NFTs

Since wallet addresses are public, literally anyone can send tokens or NFTs to these addresses. This is usually not a big problem, because you can simply choose to ignore them; but some cybercriminals have developed ways to send tokens that can execute transactions on your account as soon as you interact with them. In this sense, one could compare these tokens to a trojan that allows hackers to access your computer as soon as you interact with a malicious file. A more detailed analysis of this type of scam, including an explanatory video, can be found here.

As a precaution, be very careful with “freebies” and “gifts”, usually offered by fake profiles on social networks or by private instant messages on Discord servers or in Telegram groups. Never interact with a token of unknown origin in your wallet!

Blind-signing

Another recent and still little-known type of attack used to steal digital assets from wallets is blind signing. This attack takes advantage of the fact that users who employ their wallets to interact with dApps and NFTs often do not review the code of the smart contracts underlying these applications and therefore may end up signing and authorizing transactions without knowing exactly what they are signing and authorizing.

For example, it is sometimes necessary to grant a third party — say, cryptocurrency exchange or an NFT marketplace — permission to conduct transactions involving tokens within your wallet. Once third-party access is approved, users can exchange tokens or list NFTs for sale without paying additional fees each time. The attackers have found ways to trick victims into giving them third-party approval over the contents of their wallets, which can be transferred to other addresses controlled by the criminals.

Fake hardware wallets

One very ingenious scam involves sending some sort of correspondence — it can be an email or even a physical letter in the mail, “signed” by a CEO of a hardware wallet manufacturer — that tries to convince the user that their wallet has suffered some sort of attack and needs to be replaced. Sometimes a new device is even sent along with the letter. But these new devices have been hacked to provide access to the fraudsters, who then clone the wallet using the previously created seed phrase to gain access to the user’s funds.

If something like this happens, simply throw these devices in the trash and inform the manufacturer of the attempt.

A fake letter signed by “Ledger CEO” — Source: Ledger

Speaking of Web3 Identities, Unstoppable Domains is on a mission to create the best web3 domains and identities on the planet. Their domains fix a lot of issues such as long complex crypto addresses, sign-in with your web3 ID, and more. My Web3 Domain is stephenajulu.crypto. Get your own now at a discounted price. Free minting and no renewal fees: Unstoppable Domains

Blockchain.com Premium Domains

Sources and Further Reading

• Wallets as web3 identities By Jônadas Techio — Blockchain Solutions Architect & Web3 Evangelist @ Axur(Medium)
• What is a Crypto Wallet? A Beginner’s Guide (Crypto.com)
• What is a crypto wallet? | Coinbase
• Public Key Cryptography — Network Encyclopedia
• Seed Phrase 101 (Realt Academy)
• How to use a hot wallet? (Odyssey DAO)
• The Anatomy of MetaMask. An X-ray of Web3’s Beloved Fox | by Julia Wu | Jun, 2022
• How to use a cold wallet? (Odyssey DAO)
• What is a Hardware Wallet and How Does it Work? (Crypto.com)
• How to avoid crypto scams (Rainbow)
• How to avoid wallet scams? (Odyssey DAO)
• Digital Risks in Blockchain and Web3 (Axur — Free Ebook)
• Digital risks in the Metaverse (Medium)

The original concept behind the invention of blockchain technology is still a great application. Money transfers using blockchain can be less expensive and faster than using existing money transfer services. This is especially true of cross-border transactions, which are often slow and expensive. Even in the modern U.S. financial system, money transfers between accounts can take days, while a blockchain transaction takes minutes.

2. Financial exchanges

Many companies have popped up over the past few years offering decentralized cryptocurrency exchanges. Using blockchain for exchanges allows for faster and less expensive transactions. Moreover, a decentralized exchange doesn’t require investors to deposit their assets with the centralized authority, which means they maintain greater control and security. While blockchain-based exchanges primarily deal in cryptocurrency, the concept could be applied to more traditional investments as well.

3. Lending

Lenders can use blockchain to execute collateralized loans through smart contracts. Smart contracts built on the blockchain allow certain events to automatically trigger things like a service payment, a margin call, full repayment of the loan, and release of collateral. As a result, loan processing is faster and less expensive, and lenders can offer better rates.

4. Insurance

Using smart contracts on a blockchain can provide greater transparency for customers and insurance providers. Recording all claims on a blockchain would keep customers from making duplicate claims for the same event. Furthermore, using smart contracts can speed up the process for claimants to receive payments.

5. Real estate

Real estate transactions require a ton of paperwork to verify financial information and ownership and then transfer deeds and titles to new owners. Using blockchain technology to record real estate transactions can provide a more secure and accessible means of verifying and transferring ownership. That can speed up transactions, reduce paperwork, and save money.

6. Secure personal information

Keeping data such as your Social Security number, date of birth, and other identifying information on a public ledger (e.g., a blockchain) may actually be more secure than current systems more susceptible to hacks. Blockchain technology can be used to secure access to identifying information while improving access for those who need it in industries such as travel, healthcare, finance, and education.

7. Voting

If personally identifiable information is held on a blockchain, that puts us just one step away from also being able to vote using blockchain technology. Using blockchain technology can make sure that nobody votes twice, only eligible voters are able to vote, and votes cannot be tampered with. What’s more, it can increase access to voting by making it as simple as pressing a few buttons on your smartphone. At the same time, the cost of running an election would substantially decrease.

8. Government benefits

Another way to use digital identities stored on a blockchain is for the administration of government benefits such as welfare programs, Social Security, and Medicare. Using blockchain technology could reduce fraud and the costs of operations. Meanwhile, beneficiaries can receive funds more quickly through digital disbursement on the blockchain.

9. Securely share medical information

Keeping medical records on a blockchain can allow doctors and medical professionals to obtain accurate and up-to-date information on their patients. That can ensure that patients seeing multiple doctors get the best care possible. It can also speed up the system for pulling medical records, allowing for more timely treatment in some cases. And, if insurance information is held in the database, doctors can easily verify whether a patient is insured and their treatment is covered.

10. Artist royalties

Using blockchain technology to track music and film files distributed over the internet can make sure that artists are paid for their work. Since blockchain technology was invented to ensure the same file doesn’t exist in more than one place, it can be used to help reduce piracy. What’s more, using a blockchain to track playbacks on streaming services and a smart contract to distribute payments can provide greater transparency and the assurance that artists receive the money they’re owed.

11. Non-fungible tokens

Non-fungible tokens, or NFTs, are commonly thought of as ways to own the rights to digital art. Since the blockchain prevents data from existing in two places, putting an NFT on the blockchain guarantees that only a single copy of a piece of digital art exists. That can make it like investing in physical art but without the drawbacks of storage and maintenance.

NFTs can have varied applications, and ultimately they’re a way to convey ownership of anything that can be represented by data. That could be the deed to a house, the broadcast rights to a video, or an event ticket. Anything remotely unique could be an NFT.

12. Logistics and supply chain tracking

Using blockchain technology to track items as they move through a logistics or supply chain network can provide several advantages. First of all, it provides greater ease of communication between partners since data is available on a secure public ledger. Second, it provides greater security and data integrity since the data on the blockchain can’t be altered. That means logistics and supply chain partners can work together more easily with greater trust that the data they’ve provided is accurate and up to date.

13. Secure Internet of Things networks

The Internet of Things (IoT) is making our lives easier, but it’s also opening the door for nefarious actors to access our data or take control of important systems. Blockchain technology can provide greater security by storing passwords and other data on a decentralized network instead of a centralized server. Additionally, it offers protection against data tampering since a blockchain is practically immutable.

14. Data storage

Adding blockchain technology to a data storage solution can provide greater security and integrity. Since data can be stored in a decentralized manner, it will be more difficult to hack into and wipe out all the data on the network, whereas a centralized data storage provider may only have a few points of redundancy. It also means greater access to data since access isn’t necessarily reliant on the operations of a single company. In some cases, using blockchain for data storage may also be less expensive.

15. Gambling

The gambling industry can use blockchain to provide several benefits to players. One of the biggest benefits of operating a casino on the blockchain is the transparency it provides to potential gamblers. Since every transaction is recorded on the blockchain, bettors can see that the games are fair and the casino pays out. Furthermore, by using blockchain, there’s no need to provide personal information, including a bank account, which may be a hurdle for some would-be gamblers. It also provides a workaround for regulatory restrictions since players can gamble anonymously and the decentralized network isn’t susceptible to a government shutdown.

Blockchain is in its infancy

Blockchain technology has only been around for a dozen years, and businesses are still exploring new ways to apply the technology to support their operations. With the growing amount of digital data used in our lives, there’s a growing need for the data security, access, transparency, and integrity blockchain can provide.

Source: The Motley Fool

The code and the agreements contained therein exist across a distributed, decentralized blockchain network. The code controls the execution, and transactions are trackable and irreversible.

Smart contracts permit trusted transactions and agreements to be carried out among disparate, anonymous parties without the need for a central authority, legal system, or external enforcement mechanism.

Smart contracts are made possible by blockchains, a network of computers that work together to enforce rules on the network without requiring the help of an intermediary.

How smart contracts work

Smart contracts work by following simple “if/when…then…” statements that are written into code on a blockchain. A network of computers executes the actions when predetermined conditions have been met and verified. These actions could include releasing funds to the appropriate parties, registering a vehicle, sending notifications, or issuing a ticket. The blockchain is then updated when the transaction is completed. That means the transaction cannot be changed, and only parties who have been granted permission can see the results.

Within a smart contract, there can be as many stipulations as needed to satisfy the participants that the task will be completed satisfactorily. To establish the terms, participants must determine how transactions and their data are represented on the blockchain, agree on the “if/when…then…” rules that govern those transactions, explore all possible exceptions, and define a framework for resolving disputes.

Then the smart contract can be programmed by a developer – although increasingly, organizations that use blockchain for business provide templates, web interfaces, and other online tools to simplify structuring smart contracts.

With conventional contracts, a document outlines the terms of a relationship between two parties, which is enforceable by law. If one Party A violates the terms, Party B can take Party A to court for not complying with the agreement. A smart contract fortifies such agreements in code so the rules are automatically enforced without courts (or any third party) getting involved.

Benefits of smart contracts

• Speed, efficiency, and accuracy: Once a condition is met, the contract is executed immediately. Because smart contracts are digital and automated, there’s no paperwork to process and no time spent reconciling errors that often result from manually filling in documents.
• Trust and transparency: Because there’s no third party involved, and because encrypted records of transactions are shared across participants, there’s no need to question whether information has been altered for personal benefit.
• Security: Blockchain transaction records are encrypted, which makes them very hard to hack. Moreover, because each record is connected to the previous and subsequent records on a distributed ledger, hackers would have to alter the entire chain to change a single record.
• Savings: Smart contracts remove the need for intermediaries to handle transactions and, by extension, their associated time delays and fees.

What can smart contracts be used for?

Some common ways of using smart contracts are:

• Multisignature accounts: Funds can only be spent when a required percentage of people agree.
• Encoding financial agreements: Manage agreements between users. Say, if one person buys insurance from an insurance company, the rules of when the insurance can be redeemed can be programmed into a smart contract.
• Agreements based on the outside world: Pull in data from the outside world (financial, political, or whatever) with the help of oracles.
• Provide the third party: Similar to how a software library works, smart contracts can work with other smart contracts in a chain.
• Storage: Store information about an application, such as domain registration information or membership records. Storage in a blockchain like Ethereum is unique in that the data is immutable and can’t be erased.

Examples of blockchain platforms supporting smart contracts

• Bitcoin: Provides a Turing-incomplete script language that allows the creation of custom smart contracts on top of Bitcoin like multisignature accounts, payment channels, escrows, time locks, atomic cross-chain trading, oracles, or multi-party lottery with no operator.
• Cardano: A blockchain platform for smart contracts, using proof of stake
• Ethereum: Implements a Turing-complete language on its blockchain, a prominent smart contract framework.
• EOS.IO: A blockchain platform for smart contracts
• Tezos: A blockchain platform modifying its own set of rules with minimal disruption to the network through an on-chain governance model