Ethereum · Wallets

Ethereum Wallets Explained

EOAs vs contract wallets, MetaMask, hardware wallets with Ethereum, seed phrases, and how to stay secure — everything you need to hold ETH safely.

Ashir Khan
By Ashir Khan3 min read

Ashir Khan writes about cryptocurrency security, self-custody, macro market analysis, and regulatory policy at CryptoBeacon.

Last updated:

Two types of Ethereum wallets

Ethereum has two types of accounts, each functioning as a wallet in different ways:

Externally Owned Account (EOA)

The standard wallet type. Controlled by a private key derived from your seed phrase. This is what MetaMask, Ledger, and most wallets create. You sign transactions with your private key. No code attached to the account.

Contract Wallet (Smart Contract Wallet)

Controlled by smart contract code. Examples: Safe, Argent, account abstraction wallets (ERC-4337). Can support multi-sig, spending limits, social recovery, and session keys. More flexible but more complex to set up.

MetaMask: the dominant Ethereum wallet

MetaMask is a browser extension and mobile app that creates and manages Ethereum EOA wallets. It generates a 12-word seed phrase on first setup, derives your private key locally, encrypts it with your password, and stores the encrypted version on your device.

When you connect MetaMask to a dApp, the website can request transaction signatures. MetaMask displays the transaction details and you approve or reject. MetaMask never sends your private key to any server. Your keys are always local.

Security note: MetaMask is a hot wallet — it runs in a browser or on a phone with internet access. For significant ETH holdings, a hardware wallet paired with MetaMask is the standard security upgrade.

Hardware wallets with Ethereum

Hardware wallets like Ledger and Trezor store your Ethereum private keys on a dedicated offline device. When signing a transaction, the signing happens on the device — the private key never touches your computer or the internet.

You can connect a Ledger or Trezor to MetaMask as the signing backend. This gives you the convenience of MetaMask's interface with the security of hardware key storage. Your Ethereum address (derived from the hardware wallet's seed phrase) appears in MetaMask normally, but every transaction requires physical confirmation on the device.

Seed phrases on Ethereum

Ethereum wallets use the same BIP-39 seed phrase standard as Bitcoin wallets. Your 12 or 24-word phrase generates a master key, from which the wallet derives your Ethereum private key (and any other keys for other blockchains) using BIP-44 derivation paths.

The derivation path for Ethereum is m/44'/60'/0'/0/0. This is why the same seed phrase generates a different address for Bitcoin (coin type 0) and Ethereum (coin type 60).

For seed phrase security: How to Store a Seed Phrase Safely →

A critical Ethereum wallet risk: token approvals

Unlike Bitcoin, interacting with Ethereum dApps often requires granting token approvals — permissions for a smart contract to spend tokens from your wallet. Malicious or poorly designed contracts can exploit unlimited approvals to drain your wallet.

Best practices: use limited approvals where possible, and regularly review and revoke unnecessary approvals. Read: How to Revoke Smart Contract Approvals →