When the app asks you to write down twelve words on a sheet, almost everyone understands the request as the usual "forgot my password": a way to recover in case the phone is lost. This interpretation is wrong and costly. Those twelve words do not recover your wallet. They are your wallet.
The previous lesson showed that the device does not store coins, it stores the authorization to move them. This authorization is a number. A private key has 256 bits, which, when written the way computers do, results in sixty-four scrambled characters — nobody copies that by hand without making a mistake. And it's not just one number: a wallet uses a different key for each receipt.
The standard that solved the problem has a name and a date. In September 2013, a document called BIP-39 proposed translating the number into words. The list has 2048 words in English, carefully chosen: none can be confused with another by the first four letters, so a note with messy handwriting still works. Twelve words from this list carry 128 bits of randomness, plus a small checksum. Twenty-four words carry 256.
From these words comes a seed, and from the seed come all the wallet's keys, always the same and always in the same order. This is what makes a piece of paper worth the entire wallet: type the words into any compatible app, from any brand, and the keys are reborn identical, with the addresses, history, and balance. The standard is public, so the manufacturer of the broken device owns nothing. How this derivation works internally is covered in the intermediate track.
The order is part of the secret. The words are not a set; they are a sequence, and swapping the fifth for the ninth gives you another wallet. Most of the time, the app rejects the input: that checksum flags a wrong or misplaced word. But it's short: a shuffled order passes through it roughly one in sixteen times, and then no error appears on the screen. It opens a legitimate, empty wallet that was never yours. Write them down numbered.
The other side of this convenience is what scares people. There is no registered owner, no document, no security question. Whoever types those words moves the money, without proving anything to anyone. That's why photographing the sheet is the most common and silent mistake: the photo automatically uploads to the cloud, and from there your money is protected by your email password.
And those who want these words will go after them. In July 2020, the wallet manufacturer Ledger had a database leaked with the name, phone number, and residential address of 272,000 customers. The following year, some of these people received a sealed box at home, with a device resembling the real one and a letter explaining it was a security replacement: just type in the twelve words. It was fake, and it had the correct address on the label.
From this comes the only rule that survives any new scam: no one needs your words. Not support, not the manufacturer, not the exchange, not the app you already use. They are typed once, when the wallet is created, and then only on the day you restore it yourself. Any request outside of that is a scam, without exception and without special cases.
Where to write them down is a long-term decision. Paper fades, gets wet, and burns, and metal plates exist precisely for this reason. Two copies in two places protect against fire and theft at the same time, and the only way to know that the note works is to restore it once, before you need it. There is also an optional extra word that creates a second invisible wallet from the same sheet — the intermediate track has an entire module on this.
With the seed written down, the wallet already has all the keys it will use in its lifetime. What's missing is what it shows to the world. In the next lesson, addresses, and why the wallet gives you a new one every time you ask.