Crypto Wallet Glossary

Every term you will meet while setting up a hardware wallet, in plain English. The definitions people most often get wrong are marked.

A#

Address. A public identifier you share to receive funds, derived from your public key. Not secret - sharing it is safe. It is chain-specific: a Bitcoin address means nothing on Ethereum.

Address poisoning. An attack where someone sends you dust from an address whose first and last characters match one of yours, hoping you will later copy the wrong one from your history. Never copy addresses from transaction history.

Air-gapped. A device that never connects to a network - signing happens by QR code or SD card. More isolated than USB, and more cumbersome.

Approval. On EVM chains, permission you grant a smart contract to move your tokens. Malicious or unlimited approvals are how wallet drainers work without ever seeing your keys.

B#

BIP39. The standard defining recovery phrases - the 2,048-word list and how words map to a seed. It is why your 24 words restore into wallets from other manufacturers.

BIP44 / derivation path. The scheme for deriving many accounts from one seed, written like m/44'/60'/0'/0/0. Ledger Live and MetaMask use different defaults, which is the usual reason a balance "disappears" - it is at a different path, still yours.

Blind signing. Approving a transaction the device cannot display in readable form. The single most dangerous setting on a hardware wallet. Keep it off; enable it only for a specific, trusted transaction.

BOLOS. Ledger's operating system, which isolates coin apps from each other. Closed source - the main criticism levelled at Ledger.

C#

Clear signing. The opposite of blind signing: the device renders a contract interaction as human-readable text. Practical on the larger Flex and Stax screens.

Cold storage. Keys held on a device that is not connected to the internet. A hardware wallet is the common consumer form.

Common Criteria (EAL5+, EAL6+). An international certification scale for security hardware. Higher numbers mean more rigorous evaluation. Ledger's secure elements are EAL5+ or EAL6+ depending on model.

Custodial. Someone else holds the keys - an exchange account, for instance. You own a claim, not the asset.

D#

dApp. A decentralised application - a website that talks to smart contracts through your wallet.

Derivation path. See BIP44.

Drainer. Malicious contract code that sweeps a wallet once you sign an approval. Requires no access to your recovery phrase.

Dust. A negligible amount of crypto, often sent as part of an address-poisoning or tracking attempt.

E#

E Ink. The low-power display technology in the Ledger Flex and Stax. Readable in daylight, holds an image without power.

ERC-20. The Ethereum token standard. All your ERC-20 tokens live at your single Ethereum address; you do not need an account per token.

ERC-7730. An open metadata standard that lets contracts describe themselves so wallets can clear-sign them.

F#

Firmware. The software running on the device itself. Update it through the official app only, with your recovery phrase to hand.

G#

Gas. The fee paid to have a transaction included on Ethereum and similar chains. Always keep a little of the native token for gas, especially before unstaking.

Genuine check. Ledger Live's cryptographic verification that the secure element was provisioned by the manufacturer. The only meaningful anti-counterfeit test - stickers and seals prove nothing.

H#

Hardware wallet. A dedicated device that stores private keys and signs transactions internally. Longer explanation.

Hot wallet. A wallet whose keys sit on an internet-connected device. Convenient, and appropriate only for amounts you can afford to lose.

K#

Key (private / public). The private key authorises spending and must never be revealed. The public key derives your address and is safe to share.

M#

Multisig. A setup requiring several keys to authorise a transaction - for example 2 of 3. The correct answer for large balances, because no single device, vendor or firmware can move funds alone.

N#

Node. A computer running a blockchain's software. Running your own is the privacy-maximal way to use a wallet.

Non-custodial. You hold the keys. This entire site is about doing that competently.

P#

Passphrase (the "25th word"). An optional extra secret mixed into seed derivation, producing an entirely separate hidden wallet. Powerful for protecting against a found backup - and a new way to lose everything if you forget it. Detail here.

PIN. The 4-8 digit code protecting physical access. Three wrong attempts wipes the device, which is why a stolen Ledger is useless.

R#

Recovery phrase / seed phrase / mnemonic. The 12 or 24 words that are your wallet. Never typed into anything except a hardware wallet you are holding. Never photographed, never stored digitally.

Revoke. Withdrawing a token approval you previously granted. Worth doing periodically for any address that touches dApps.

S#

Secure element. A tamper-resistant chip built to protect secrets against physical attack. The same category of chip used in passports and bank cards.

Seed. The master secret your recovery phrase encodes, from which every key derives.

Self-custody. Holding your own keys, with the responsibility that implies.

Shamir backup. Splitting a seed into shares where a threshold reconstructs it. Offered by some Trezor models; Ledger uses passphrases and standard BIP39 instead.

Slashing. A penalty applied to a validator - and shared by its delegators - for misbehaviour or extended downtime.

Supply chain attack. Compromising a product or dependency before it reaches the user. Why you buy direct, and what the 2023 Connect Kit incident was.

U#

Unbonding period. The waiting time after you unstake before tokens become liquid - 21 days on Cosmos, around 28 on Polkadot. The most underestimated cost of staking.

UTXO. Bitcoin's accounting model, where your balance is a set of unspent outputs rather than a number. Relevant when you care about coin control and privacy.

X#

xpub (extended public key). A key that can derive all the receive addresses in an account without granting spending power. Useful for watch-only wallets - and a privacy exposure if shared, since it reveals your entire transaction history.