What crypto is—and what it is not

Start with the record, not the coin

A crypto asset is a digital entry governed by software and a network or issuer. Nothing is stored inside your phone. What a wallet holds is the authority to request changes to a record that other computers maintain and check. If every copy of that record disappeared, the app on your phone would have nothing left to display.

This is why the usual physical metaphors mislead. A wallet is not a purse holding objects; it is closer to a signing key for an account you do not personally host. Understanding that one sentence explains most of what follows in this course: why a recovery phrase is so dangerous to expose, why a transaction cannot be recalled, and why “the exchange has my coins” describes a very different arrangement from “my wallet controls them.”

Public blockchains let many independent observers verify the same history. That is a real and unusual property. It does not make every token decentralized, every user anonymous, or every transaction reversible—those are separate claims that have to be checked separately.

Three families of ownership

Almost everything marketed as crypto falls into one of three families, and the family determines what can go wrong. A network-native coin, such as the asset used to pay fees on its own network, exists because the protocol's rules create it. There is no company to ask for it and no company that can withhold it.

An issued token lives inside a smart contract on someone else's network. The contract's author decides how many units exist and may keep the ability to mint, pause, freeze, or upgrade. The network records the token faithfully, but the network is not the source of its value or its rules.

A provider-held balance is a claim against a company. When a trading service shows a balance, that number is usually an entry in the company's own database, not a network record you control. The company owes you the asset. Whether you receive it depends on its security, solvency, and policies—the same questions you would ask of any financial institution.

• Is this a network-native coin, a contract-issued token, or a company's promise?
• If it is a token, which network records it and who deployed the contract?
• If it is a balance at a service, which legal entity owes it to you?

Decentralization is a spectrum, not a badge

Projects describe themselves as decentralized far more often than the description survives inspection. Decentralization is not one property; it is several, and a project can score very differently on each. Who can run a node and verify independently? Who can change the protocol rules, and through what process? Does anyone hold administrator keys that can pause, upgrade, or mint? Who operates the website most users rely on, and who controls that domain name?

A project can settle transactions on a genuinely open network while every meaningful decision about the token is made by a handful of people. That is not a contradiction or a scandal by itself—many useful products are built that way—but it means the risk profile is closer to trusting a company than to trusting a protocol. The failure you should plan for is the one that matches the actual control structure, not the one implied by the marketing.

Public is not private

On most networks, every transaction is permanently visible to anyone. Addresses are pseudonymous, meaning they are not labelled with your name, but pseudonymity is fragile. Reusing an address, moving funds between an exchange account that verified your identity and a personal wallet, or posting an address publicly can all connect the two.

Treat the assumption as reversed from what feels natural: assume that anything you do on a public network may eventually be linked to you, and treat exceptions as something you would have to deliberately engineer. This matters for ordinary safety as much as for privacy—an address known to hold value is an address worth targeting.

Ask four questions before anything else

Before researching price, community, or roadmap, answer four questions. Who can change the rules? Who validates transactions? Who can freeze, upgrade, or issue more units? What happens if a particular company or website disappears tomorrow?

These questions are useful precisely because they are boring. They cannot be answered with enthusiasm, and the answers rarely appear on a landing page. Where you cannot find an answer, that absence is itself the finding: record it as an explicit unknown rather than assuming the reassuring version.

• Identify the network and the asset issuer, if any.
• Identify who controls signing authority.
• Identify any administrator, custodian, or reserve manager.
• Assume public addresses are pseudonymous, not automatically private.

The common beginner mistake

Do not treat technical vocabulary as proof of safety. A project can use a blockchain, publish a whitepaper, list an audit, and still have concentrated control, weak security, misleading marketing, or no useful reason to exist. The words describe the machinery, not the intentions of the people operating it.

The reverse error is also common: dismissing everything because some of it is fraudulent. The useful stance is neither belief nor cynicism but the habit of asking what specifically is being claimed, by whom, and how it could be checked.