TL;DR
A private key is ownership. A seed phrase is all private keys in words. Whoever has them has the money — no “recover password,” no bank to call. In H1 2025, private-key and front-end (“infrastructure”) attacks drove 80% of $2.1B stolen. Wallet compromise alone was $1.7B. Keys are everything because math does not negotiate.
| CONCEPT | WHAT IT IS | IF YOU LOSE IT |
|---|---|---|
| Private key | 64-hex number that proves ownership | Funds gone. No reset exists. |
| Seed phrase (12/24 words) | Human-readable backup of all keys | Funds gone. Whoever finds it wins. |
| Address | Public hash of the key (safe to share) | Nothing — addresses are public. |
| Hardware wallet | Air-gapped signer; key never touches net | Still safe if seed is safe. |
| Multisig (2-of-3) | 3 keys, 2 needed to move funds | One key lost ≠ funds lost. |
| Session key | Short-lived, scoped permission (agents, games) | Revocable. Expires. Low blast radius. |
| Allowance / approval | Permission for a contract to move tokens | Drainer can take everything approved. |
Start with the sentence that breaks most newcomers’ models: there is no support department for keys. If you get phished for your seed phrase, you are not “locked out” — someone else now owns the account. The FBI’s Operation Level Up intervened in cases like a victim about to cash out a $750K 401(k) and another about to sell a house to invest $500K. Those are not technical failures. They are key-management failures under social pressure.
Separate your wallets by blast radius. A hot wallet (browser/mobile) that touches new sites daily will eventually sign something malicious. That is the design assumption. A cold wallet (hardware, air-gapped) holds savings and signs rarely, via explicit verification. Multisig splits trust so no single device or person can move funds alone — the right primitive for treasuries, teams, and anyone forwarding this school to family.
Session keys are the AI-era answer. Agents, games, and bots should never hold your long-lived seed. Give them scoped, expiring permissions: spend limit, allow-listed contracts, short lifetime. ERC-4337 smart accounts make this native. If an agent can drain you in one call, the architecture is wrong, not the agent.
HOT
Daily driver
Small balance, frequent use, new sites. Assume exposure. Revoke aggressively.
WARM
L2 / app wallet
Base/Arbitrum activity, session keys, per-app allowances. Separate from savings.
COLD
Savings vault
Hardware + multisig. Signs rarely. Seed on metal, split, tested. Inheritance plan exists.
NEVER
Never type a seed phrase into a website, “validator,” or “support” form. Legitimate dapps never ask.
Never photograph, cloud-store, or email your seed. Never screenshot it.
Never buy a “pre-seeded” hardware wallet from secondary marketplaces.
ALWAYS
Store the seed offline, in two physical locations. Metal > paper. Test the backup once.
Use a hardware wallet for anything you would regret losing.
Check and revoke allowances monthly. Prefer limited approvals over unlimited.
THE 10-MINUTE KEY AUDIT
List every wallet → tag hot/warm/cold → move ~90% of value to cold → revoke all unlimited approvals → test seed backup → write an inheritance note (where the seal is, who verifies it). Do this before Modules 03–06. Everything else is decoration if keys are wrong.
DEFENSE CHECKLIST — MODULE 02
[01] Seed = ownership. No website ever needs it. If asked, it is a scam. Full stop.
[02] Hot holds spending money. Cold holds everything else. Different devices, different threat models.
[03] Hardware wallet bought direct from manufacturer. Verify seals, update firmware before first use.
[04] Multisig for shared/large funds. At least 2-of-3, parties in different locations.
[05] Sessions scoped + expiring for agents. Revoke on schedule, not on incident.
SCHOOL INDEX
← PREVIOUS · MODULE 01
The Threat Landscape
The 2025–2026 numbers that should change how you operate: $11.3B reported by the FBI, ~$17B on-chain, and why AI scams pay 4.5x better.
NEXT · MODULE 03 →
Phishing & Impersonation
Fake sites, fake support, fake airdrops, clipboard hijackers, and approval phishing — how a $500 phishing kit scales to 330,000 texts a day.
PNTHR SCHOOL · FREE + OPEN · SOURCES: FBI IC3 2025 · CHAINALYSIS 2026 · TRM LABS · CERTIK · IMMUNEFI · TUTELA · EDUCATION ONLY · NOT FINANCIAL ADVICE · NOT LEGAL ADVICE