A private key is a secret number that proves you own the crypto at a particular address and authorises you to spend it. Whoever holds it controls the funds. No password reset exists. No account recovery, no authority who can override it.
Hence "not your keys, not your coins." Crypto ownership is not a record of your name against a balance. It is possession of a number.
What a private key actually is
A very large random integer. On Bitcoin and Ethereum it runs to 256 bits, which is usually displayed as a string of 64 hexadecimal characters that means nothing to look at.
Size is the security. Roughly 10^77 possible private keys exist, a number close to the estimated count of atoms in the observable universe. Guessing one is not difficult. It is arithmetically impossible.
How the key chain works
Three things, derived in one direction only.
- Private key. The secret random number.
- Public key. Derived from the private key using elliptic curve multiplication.
- Address. Derived from the public key, usually by hashing it and adding a checksum.
Forward each step runs easily. Backward, not at all. That asymmetry is precisely what makes it safe to publish a crypto address anywhere you like while the key sitting behind it stays permanently secret.
How signing works
Here is the part that explains why the key never needs to be shared.
Sending a transaction makes your wallet produce a digital signature over that specific transaction's details, using the private key. Against your public key, the network then verifies the signature.
Verification proves two things at once. The signer held the private key, and the transaction has not been altered since signing. Never does it reveal the key itself.
So the key stays on your device. Only the signature travels.
Where private keys live
| Location | Who holds the key | Trade-off |
|---|---|---|
| Hardware wallet | You, on a dedicated offline device | Strongest self-custody, costs money, easy to lose |
| Software wallet | You, on a phone or computer | Convenient, exposed to malware |
| Paper wallet | You, printed | Offline, fragile, awkward to spend from |
| Exchange | The exchange | Recoverable account, platform risk |
| MPC custody | Split across parties, no single holder | No single point of compromise, requires trust in the setup |
MPC, or multi-party computation, changes the shape of the problem. Rather than one key existing in one place, signing capability is split into shares held separately. No single share can sign. No complete key ever assembles anywhere.
Private key vs seed phrase vs public key
Three terms people mix up constantly.
- Private key. Controls one address. Spends the funds.
- Public key. Derived from the private key. Used to verify signatures.
- Seed phrase. The master secret from which a wallet derives many private keys. Backs up everything.
So a seed phrase is more sensitive than any single private key, because it unlocks all of them.
How private keys get lost or stolen
- Phishing. Fake wallet sites and support impersonators asking you to "verify" a key. This is the largest loss category by far.
- Malware. Clipboard hijackers and keyloggers on an infected device.
- Digital storage. Screenshots, cloud notes, and password managers all sync somewhere.
- Discarded hardware. Somewhere between 3 and 4 million bitcoin sit in wallets whose keys no longer exist.
- Bad randomness. Weak random number generators have produced keys that were later brute-forced. Hence why keys should come from a wallet, never invented by hand.
- Physical theft. A written key that someone else finds is a wallet that someone else empties, and there is no second factor standing between those two events.
Note what is missing from that list. Never has anyone cracked a properly generated private key by guessing.
Rules that actually matter
- Never share it. Not with support, not with a project team, not with anyone.
- Never type it into a website or app you did not initiate.
- Never store it digitally, in any form.
- Generate it inside a reputable wallet, never by choosing a number yourself.
- Assume any key that has touched an internet-connected device could be compromised.
Security you can verify on mb.io
Self-custody puts the entire burden on your key management. Moving it to an audited institution is a different trade rather than a strictly better one.
mb.io is a regulated crypto spot exchange backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Institutional-grade MPC custody powered by Fireblocks, so no single complete key exists in one place
- Segregated client funds
- 10/10 security score from Hacken, an independent blockchain security auditor
- Regulated by VARA in the UAE and AUSTRAC in Australia
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 customer support, on web and on the iOS and Android apps
Open your account and start trading on mb.io.
Frequently asked questions
What happens if someone gets my private key?
They can spend everything at that address immediately, and the transactions cannot be reversed. Revoking a compromised key is impossible. Moving funds to a new address faster than the attacker does is the only response.
Can a private key be guessed or cracked?
No. Roughly 10^77 possible keys exist, putting brute force beyond any conceivable hardware. Every documented loss has come from phishing, malware, weak key generation, or physical exposure.
What is the difference between a private key and a seed phrase?
A private key controls a single address. Used to derive many private keys and addresses, a seed phrase is the master secret, which makes it the more sensitive of the two.
Is my private key stored on the blockchain?
No. Addresses and transactions are what the blockchain records. Your private key exists only on your device or with whoever holds custody for you.
Do I need to know my private key to use crypto?
Generally not. Behind a seed phrase, modern wallets manage keys, and exchanges hold keys for you. Most users never see a raw private key.
What is MPC custody?
Multi-party computation, where signing capability is split into shares held by separate parties. Authorising a transaction takes more than one share, and no complete key ever assembles in one place.
Can I change my private key?
No. Keys are fixed for their address. Changing keys means generating a new address and moving the funds there.
Why is "not your keys, not your coins" true?
Because control of the key is control of the asset. On an exchange, the platform holds the key, so your access depends on its solvency and conduct rather than on cryptography.
