Public addresses and private keys
A public address can be shared so another person or service can send assets to it. A private key is secret information that authorises transactions. A recovery phrase, where used, can recreate access to one or more keys. Anyone who obtains the private key or recovery phrase may be able to control the associated assets.
Treat a recovery phrase like the master key to a safe. Do not enter it into a website because a support agent, social-media account or investment platform asks you to.
How a wallet interacts with the XRP Ledger
On the XRP Ledger, accounts use addresses and transactions to make changes to ledger state. Transactions can transfer XRP or tokens and can create, accept or cancel offers. A wallet application helps prepare and sign transactions, but the network rules determine whether a transaction is valid and confirmed.
Always verify the network, destination address, amount and transaction details before signing. A confirmed blockchain transaction may be difficult or impossible to reverse.
Custodial and self-custody wallets
In a custodial arrangement, a provider controls the keys or holds assets on a customer's behalf. In self-custody, the user controls the keys. Custody changes who is responsible for access, security, recovery and operational continuity.
Neither model removes all risk. A custodian can be hacked, fail or restrict withdrawals; a self-custody user can lose a recovery phrase, approve a malicious transaction or install compromised software.
Wallet connection safety
Check the exact website domain before connecting. Review the permissions requested by an application and read transaction details before approving. Use official app stores or the wallet provider's verified website to obtain software, and keep devices and browsers updated.
Be suspicious of unsolicited messages, fake support accounts, urgent security warnings and requests to move assets to a new address. A legitimate support representative should not ask for your recovery phrase.
Wallets and platform onboarding
If a trading or arbitrage platform asks you to connect a wallet, understand why the connection is required and what permissions it grants. Ask whether it can request transactions, access token balances, interact with smart contracts or move funds. Read the platform's terms and understand how to disconnect access.
Do not connect a wallet holding significant assets to an unfamiliar site merely to see what happens. Consider using a separate wallet with limited funds for testing, while recognising that this does not make a malicious contract safe.
A wallet security checklist
Store recovery information offline in a secure place, use a device lock and multi-factor authentication where available, verify addresses carefully, and never share private keys. Review token approvals and revoke permissions you no longer need using trusted tools.
Wallet software cannot guarantee asset recovery after theft or a mistaken transfer. Learn the basics before signing transactions or connecting to financial applications.
Frequently asked questions
Does a Web3 wallet store cryptocurrency?
Usually, assets are recorded on a blockchain; the wallet manages keys and helps the user view and authorise transactions.
Can someone steal XRP with my recovery phrase?
A person who obtains the relevant secret recovery information may be able to gain control of the wallet. Keep it private and offline.
Is connecting a wallet the same as sending funds?
Not always. A connection may reveal a public address, while a separate signed transaction may authorise an action. Always inspect the permission and transaction request.