Crypto

How does cryptocurrency work?

At its core, a cryptocurrency is a shared accounting book that no single person controls. Instead of a bank keeping the master copy of who owns what, thousands of computers around the world each keep a copy and constantly agree on updates. When you want to send funds, your wallet writes a short instruction — "move this amount from my address to theirs" — and signs it with a secret key that only you hold. That signed instruction is broadcast to the network.

From there, independent computers check that the rules are followed: that your signature is valid, that you actually have the funds, and that you are not trying to spend the same coins twice. If everything checks out, the transaction is gathered with others into a batch, and the network uses a consensus mechanism to agree that this batch is the next official page in the shared book. Once added, undoing it would mean convincing the whole network to rewrite history, which is designed to be prohibitively hard.

The result is a system where value can move between strangers without a trusted middleman, enforced by mathematics and by the sheer difficulty of cheating a large, open network. The rest of this guide unpacks each moving part — blockchains, keys, wallets, consensus, fees, smart contracts, and how to stay safe — in plain language for beginners and the curious alike.

What is cryptocurrency?

Cryptocurrency is digital money that lives on a shared, public network rather than inside one company's database. "Crypto" refers to the cryptography — the mathematics of secret keys and digital signatures — that lets people prove ownership and authorise transfers without a central authority vouching for them.

Unlike the balance in a bank app, which the bank can freeze, reverse, or edit, a cryptocurrency balance is controlled by whoever holds the matching private key. That is a double-edged design: it gives you genuine self-custody, but it also means there is no help desk to reverse a mistake or recover a lost key. Ownership is defined entirely by control of the key.

There are many different cryptocurrencies, and they are not all the same thing. Some are designed mainly to move value from person to person. Others are platforms for running programs called smart contracts. Some, called stablecoins, try to track the value of a traditional currency. What they share is the underlying idea: a record kept by many independent participants, updated by rules that everyone can inspect. If you are new to all of this, the honest starting point is that crypto is a technology for recording ownership and moving it around — the prices and speculation you hear about are a separate layer built on top of that foundation, and understanding the foundation first makes everything else easier to judge.

What is a blockchain?

A blockchain is the shared record that most cryptocurrencies run on: a list of transaction batches, called blocks, where each block carries a cryptographic fingerprint of the block before it. That linking is what the word "chain" describes, and it is the reason the history is hard to tamper with.

Each block bundles together a set of recent transactions, a timestamp, and a hash — a short fingerprint produced by feeding the block's contents through a one-way maths function. Crucially, every block also includes the previous block's hash. So if someone tried to alter a transaction buried deep in the history, that block's fingerprint would change, which would break the link in the next block, and the next, all the way to the present. Rewriting the past means redoing every block since, in front of a network watching for exactly that.

Because copies of the blockchain are held by many independent computers, there is no single database to hack or single administrator to bribe. To change the accepted record, you would need to out-muscle the honest majority of the whole network — the barrier that makes the ledger trustworthy. For a deeper walk-through with examples, see what a blockchain actually is, and for how the batching structure inside a block is organised efficiently, see what is a Merkle tree.

How does a crypto transaction get confirmed?

A transaction is "confirmed" when it has been included in a block that the network accepts as part of the official chain — and each additional block built on top of it makes reversal even less likely. Confirmation is not instant approval by a company; it is agreement by a decentralised network.

The journey has clear steps. First, your wallet creates the transaction and signs it with your private key, proving you authorised it. Second, it broadcasts the transaction to the network, where it waits in a shared holding area of unconfirmed transactions, often called the mempool. Third, whoever is building the next block — a miner or validator, depending on the network — selects transactions from that pool, usually favouring those offering higher fees, and assembles them into a candidate block. Fourth, the network's consensus rules decide that this block is valid and appends it to the chain.

Once your transaction sits in an accepted block it has one confirmation; as more blocks stack on top, the count rises and the odds of it being undone shrink toward zero. That is why exchanges and merchants often wait for several confirmations before treating a large payment as final. You can watch this entire process yourself on a public tool — see how a crypto transaction gets confirmed and how to read a block explorer.

What are public and private keys?

Public and private keys are a matched pair of numbers at the heart of every crypto wallet. The private key is a secret only you should hold; the public key (and the address derived from it) is safe to share so others can send you funds. They are linked by mathematics so that the private key can produce signatures the public key can verify — but you cannot work backwards from the public key to the private one.

Think of the address as a transparent mailbox slot. Anyone can drop funds in, and anyone can see what is inside because the blockchain is public. But only the person with the private key can open the box and move what is there. When you send crypto, your wallet uses the private key to create a digital signature over the transaction. The network checks that signature against your public key and confirms the transfer is genuinely authorised, without you ever revealing the secret itself.

This is why "not your keys, not your coins" is repeated so often. Ownership in crypto is not a name on an account; it is control of a private key. Whoever holds the key controls the funds, full stop. For a fuller explanation with diagrams of how signing works, see public and private keys explained and the glossary entry for private key.

What is a private key, and why does it matter so much?

A private key is the single secret that controls your funds — a very large, randomly generated number that your wallet uses to sign transactions. Its importance is hard to overstate: possession of the private key is ownership, and there is no higher authority that can override it, restore it, or reverse a transfer made with it.

That design gives crypto its defining property, self-custody, but it also removes the safety nets people expect from banks. If someone copies your private key, they can drain your funds and the transaction will look perfectly legitimate to the network, because it is correctly signed. If you lose the key with no backup, the funds are stranded forever — not deleted, but permanently unreachable. Nobody can call support to fix either outcome.

In practice you rarely handle the raw key directly. Wallets generate and store it for you and back it up as a seed phrase, a human-readable form of the same secret. The security rules follow directly from what the key is: never enter it or your seed phrase into a website, never store it in a screenshot or cloud note, and be deeply suspicious of anyone who asks for it, because no legitimate service, support agent, or airdrop ever needs it. Understanding the private key is understanding why crypto security is really about protecting one secret extremely well. See also private key in the glossary.

How do crypto wallets work?

A crypto wallet is not a container that holds coins — it is a key manager. Your funds live on the blockchain; the wallet stores your private keys and uses them to prove ownership and sign transactions on your behalf. When people say their crypto is "in" a wallet, what they really mean is that the wallet controls the keys to addresses that own that crypto.

When you set up a wallet, it generates a private key (usually from a seed phrase) and derives one or more public addresses from it. To receive funds, you share an address. To spend, the wallet builds a transaction, signs it with the matching private key, and broadcasts it. It also reads the blockchain to display your balance, which it calculates by tallying the transactions tied to your addresses. The coins are never inside the app.

Wallets come in different shapes: mobile and desktop apps, browser extensions, and dedicated hardware devices, each trading convenience against security. What unites good wallets is that they keep your keys under your control and make it clear what you are signing. The most important choice is whether a wallet is custodial or non-custodial — that is, whether you or a company holds the keys — which the next section unpacks. For a hands-on comparison, see hardware vs software wallets.

What's the difference between custodial and non-custodial wallets?

The difference is who holds the private keys. In a custodial wallet, a company — typically an exchange — holds the keys for you, much like a bank holds your money. In a non-custodial wallet, you alone hold the keys, with full control and full responsibility.

Custodial services are convenient. They can reset a password, offer support, and spare you from managing a seed phrase. But you are trusting the company to stay solvent, honest, and secure, and you must usually pass identity checks. If the platform is hacked, frozen, or fails, your access depends on them — which is the meaning of the phrase "not your keys, not your coins." Non-custodial wallets flip that: no one can freeze your funds or lose them on your behalf, but no one can help you if you lose your seed phrase or approve a malicious transaction, either.

Neither is simply "better"; they suit different needs. Many people keep spending money in a custodial account for convenience and hold longer-term savings in a non-custodial wallet they control directly. The key is to know which model you are using at any moment, because it changes who is responsible if something goes wrong. See custodial vs non-custodial for a fuller comparison, and what happens when an exchange is hacked for why custody matters.

What is a seed phrase?

A seed phrase is a list of ordinary words — commonly 12 or 24 of them — that encodes the master secret behind a wallet. From this one phrase, a wallet can regenerate every private key and address it controls, on any compatible device. In effect, the seed phrase is the wallet, condensed into words you can write down.

The words come from a fixed, standardised list, which is why any compatible wallet can restore from a phrase generated by another. This is genuinely useful: if your phone breaks, you can recover your funds by entering the phrase into a new wallet. But it also means the phrase deserves the same protection as the funds themselves. Anyone who reads it can recreate your wallet and take everything, from anywhere, without your device.

The safety rules follow directly. Write the phrase on paper (or stamp it into metal) and store it offline, ideally in more than one secure location. Never type it into a website, never store it as a photo or cloud note, and never share it — not with "support", not to claim an airdrop, not to "verify" anything. Legitimate services never ask for it. A wallet may occasionally ask you to re-enter your phrase to confirm your backup, but that happens inside the wallet app you already trust, never on a random web page. For more, see seed phrases explained.

What's the difference between hardware and software wallets?

A software wallet runs as an app on an internet-connected device; a hardware wallet is a dedicated physical device that keeps your private keys offline. Both let you receive and send crypto, but they defend against different threats and suit different amounts.

Software wallets — mobile apps, desktop programs, and browser extensions — are free, fast, and convenient, which makes them ideal for everyday use and small balances. Their weakness is that the keys live on a device that also browses the web and installs other apps, so malware or a malicious website has more opportunity to reach them. Hardware wallets close that gap by generating and storing keys inside a chip that never exposes them to your computer. When you send funds, the transaction is sent to the device, you confirm it on the device's own screen, and only the signature comes back — the secret never leaves.

The trade-off is cost and convenience: hardware wallets must be bought, carried, and kept safe, and signing takes an extra step. A common approach is to use a software wallet for small, active amounts and a hardware wallet for long-term savings you rarely move. Whichever you choose, the seed phrase backup rules still apply, because both types are ultimately built around the same secret. See hardware vs software wallets and, for the most protective setup, what is cold storage.

What is cold storage?

Cold storage means keeping the private keys for your crypto completely offline, on a device or medium that never connects to the internet. Because online attacks need an online target, taking the keys offline removes an entire category of risk, which is why cold storage is the standard advice for funds you want to hold for the long term.

A hardware wallet used carefully is the most common form of cold storage: the keys are created and stored inside the device, and transactions are signed on it without the secret ever touching an internet-connected computer. Other forms include a dedicated offline computer or, historically, keys printed on paper. The defining feature is not the object but the isolation — the secret is not reachable by any remote attacker because it is not connected to anything they can reach.

Cold storage trades convenience for security. Moving funds requires physically accessing the device and confirming on it, which is exactly the friction that stops a distant hacker or a malicious website from draining an account in seconds. It does not remove your responsibility for the seed phrase, though: if the device is lost or destroyed and the phrase is gone too, the funds are unrecoverable. For higher-value or shared holdings, some people combine cold storage with multiple required signatures — see what is a multisig wallet — and the full explainer at what is cold storage.

What is a multisig wallet?

A multisignature, or "multisig", wallet requires more than one private key to approve a transaction. Instead of a single key being able to move funds, you set a rule such as "two of three keys must sign" — so no single lost, stolen, or compromised key is enough to cause a loss.

This is powerful for two reasons. It removes single points of failure: an attacker who steals one key still cannot move the funds, and you can lose one key without losing access, as long as enough of the others survive. And it enables shared control, which is why organisations, funds, and DAOs use multisig to require agreement from several people before treasury money can move. You can split the keys across different devices and locations so that compromising any one place is not enough.

The trade-off is added complexity. You must manage several keys and their backups, and you need a clear plan for what happens if a keyholder is unavailable. Set the threshold too high and you risk locking yourself out; too low and you weaken the protection. For individuals with significant holdings, a well-designed multisig setup can be far safer than a single key, but it should be understood and tested before it holds anything important. See what is a multisig wallet for setups and trade-offs.

How do I keep my crypto safe?

Keeping crypto safe comes down to protecting your keys and being sceptical of anyone who creates urgency. Because a correctly signed transaction is final, most losses are not high-tech hacks but people being tricked into signing something or revealing a secret. Good defence is mostly good habits.

A practical checklist: use a reputable, well-reviewed wallet, and download it only from the official source. Back up your seed phrase offline, in more than one secure place, and never enter it into any website. For meaningful amounts, move funds to a hardware wallet or cold storage. Before you approve any transaction, read what it actually does, and verify addresses and contracts rather than trusting a link — see verify a contract address. Periodically review and revoke old token approvals you no longer use.

The mindset matters as much as the tools. Treat unsolicited messages, "support" agents who contact you first, giveaways that ask you to send funds first, and anything demanding a seed phrase or private key as scams by default. Slow down when a message pushes you to act immediately; urgency is the scammer's main weapon. No legitimate service will ever need your keys or recovery phrase. Learning how the common attacks work — covered below and in how crypto phishing attacks work — is itself one of the strongest protections you can have.

Proof of work vs proof of stake — what's the difference?

Proof of work and proof of stake are two ways a decentralised network agrees on the ledger without a central authority. Both make cheating expensive, but they use different costs: proof of work spends electricity, while proof of stake locks up coins as a bond.

In proof of work, computers called miners compete to solve a hard mathematical puzzle by brute force. The first to find a valid answer earns the right to add the next block and collect a reward. Solving the puzzle requires real computing power and electricity, so rewriting history would mean out-spending the entire honest network — a deliberately costly barrier. In proof of stake, participants called validators lock up (stake) their own coins as collateral. The network chooses validators to propose and confirm blocks, and anyone who tries to cheat can have their stake taken away. Here the cost of attacking is putting a large amount of your own capital at risk of being destroyed.

Both achieve the same goal — honest agreement enforced by cost — but with different trade-offs in energy use, hardware requirements, and how new participants join. Neither is universally "better"; they are different answers to the same problem of trust among strangers. For a fuller comparison, see proof of work vs proof of stake and consensus.

What do miners and validators do?

Miners and validators are the participants who keep a blockchain running by proposing new blocks and confirming that transactions follow the rules. Miners do this job on proof-of-work networks; validators do the equivalent on proof-of-stake networks. Both are rewarded for honest work and stand to lose if they cheat.

A miner gathers pending transactions, checks them, and repeatedly tries to solve the network's puzzle so it can publish the next block. Success earns a block reward plus the transaction fees inside that block. A validator, by contrast, has staked collateral and is selected by the protocol to propose or attest to blocks; it earns rewards for doing so correctly and risks losing part of its stake for going offline or acting dishonestly. In both cases, the network as a whole double-checks each new block, so a single bad actor cannot force through invalid transactions.

What matters for a newcomer is the effect: these participants are why you do not need to trust any one company. Their competing self-interest, combined with the network's rules, is what makes the shared ledger reliable. They cannot secretly reverse your payment or invent coins, because every other participant would reject a block that broke the rules. For more on their role, see what miners and validators do.

What is a smart contract?

A smart contract is a program stored on a blockchain that runs automatically and exactly as written when it is called. It can hold funds and release them under defined conditions, all without a middleman — and, importantly, no one can quietly alter its logic once it is deployed.

Think of it as a vending machine for agreements. The rules are fixed in code and visible to anyone; when you send the right input, the contract produces the agreed output — swapping one token for another, lending, or unlocking funds when conditions are met. Because it runs on the blockchain, every participant can verify that it executed correctly, and its behaviour does not depend on trusting the person who wrote it to act fairly at the moment of the deal.

That power comes with real risks a beginner should respect. Code can contain bugs, and because contracts are hard to change and often hold money, a flaw can be exploited for large losses. Some contracts are written to be malicious, designed to look normal while draining anyone who interacts with them. This is why verifying a contract before use, and being careful about the permissions you grant it, matters so much — see verify a contract address and token approvals explained. For the fundamentals, see what a smart contract is.

What is gas, and why do fees change?

Gas is the fee you pay to have the network process your transaction, and it changes because block space is limited and demand for it rises and falls. When many people want their transactions processed at once, they compete by offering higher fees, and the price of getting in goes up.

Every action on a smart-contract network — a simple transfer, a token swap, interacting with a contract — requires a certain amount of computational work, measured in units of gas. A basic transfer uses little; a complex contract interaction uses much more. You pay for that work at a per-unit price that the market sets moment to moment. Because each block can only hold so much, whoever is building the next block tends to include the transactions offering the most, so during busy periods fees spike and during quiet periods they fall. Nothing about your specific transaction changed; the competition around it did.

Understanding this helps you avoid overpaying. The same action can cost very different amounts depending on network conditions, and many wallets let you see current fee levels or wait for cheaper times. It also explains why "the fee was so high" is usually about timing and demand, not a hidden charge by any company — the fee goes to the network participants who process the work. For a fuller explanation of where the money goes, see what gas fees pay for.

What are token approvals, and why do they matter?

A token approval is permission you grant a smart contract to move a specific token from your wallet. Many apps need this to function — a marketplace or exchange contract cannot swap your tokens unless you first allow it — but an approval is a standing permission that can be abused if you grant it carelessly.

The risk is subtle because approving is not the same as spending. When you approve a contract, you are not sending funds; you are authorising that contract to withdraw up to a certain amount later, sometimes an unlimited amount. If the contract is malicious, or is later exploited, that standing approval can be used to drain the token without asking you again. Scams frequently rely on tricking people into signing an approval on a fake site, after which the "transfer" looks like a normal, authorised action.

The defence is to treat approvals deliberately: only approve contracts you have verified, prefer limited amounts over unlimited where your wallet allows, and periodically review and revoke approvals you no longer need using a reputable approval-management tool. Making a habit of reading what a signature actually authorises — rather than clicking through — closes one of the most common paths to loss. See token approvals explained and verify a contract address.

What is a Layer 2, and why does it exist?

A Layer 2 is a separate network built on top of a main blockchain to make transactions faster and cheaper, while still relying on the main chain for security. It exists because popular blockchains have limited space, which pushes fees up and slows things down when demand is high.

The idea is to move most of the activity off the crowded main chain — the "Layer 1" — and process it on a second layer that can handle many more transactions. The Layer 2 periodically settles or proves its results back to the main chain, so it inherits much of the underlying network's security rather than starting from scratch. In practice this can mean dramatically lower fees and quicker confirmations for everyday actions, which is why Layer 2s have become a common way to use busy networks affordably.

For a beginner, the key point is that a Layer 2 is not a different coin or a competitor so much as an extension: it is designed to do the heavy lifting while leaning on the base chain for final security. Moving funds between the two typically involves a bridge, which carries its own considerations. Related structures — sidechains, which run alongside a main chain with their own rules — solve a similar problem differently. See what is Layer 2, what is a sidechain, and what is a crypto bridge.

What are sidechains and bridges?

A sidechain is a separate blockchain that runs alongside a main chain with its own rules and its own security, connected so assets can move between them. A bridge is the tool that moves assets from one chain to another. Both exist to let value and activity flow across networks that were not originally designed to talk to each other.

A sidechain typically has its own validators and its own trade-offs — often faster or cheaper than the main chain, but secured independently rather than inheriting the main chain's protection. That independence is the difference from a Layer 2, which leans on the base chain for security. Sidechains are useful for specialised needs, but "its own security" means you should understand how robust that security actually is before relying on it.

Bridges deserve particular caution. To move an asset from one chain to another, a bridge usually locks it on the first chain and issues a matching version on the second. Because bridges hold large pools of assets and are complex, they have historically been a favourite target for attackers, and bridge exploits have caused some of the largest losses in crypto. For a beginner, the lesson is not to avoid bridges entirely but to prefer well-established ones, move modest amounts, and understand what you are doing. See what is a sidechain and what is a crypto bridge.

What is a Merkle tree?

A Merkle tree is a clever way of summarising many transactions into a single fingerprint, so that a huge batch of data can be verified quickly and cheaply. It is a behind-the-scenes structure that helps blockchains stay both trustworthy and efficient.

The idea is to hash transactions in pairs, then hash those results in pairs, and repeat until a single hash remains at the top — the "Merkle root". That one root sits in the block header and effectively fingerprints every transaction beneath it. If any single transaction changed, its hash would change, which would ripple up and change the root, so the root acts as a compact seal over the whole batch.

The practical payoff is that you can prove a specific transaction is included in a block without downloading the entire block. You only need a short trail of hashes leading up to the root, which lets lightweight devices — like a phone wallet — verify inclusion efficiently. For a curious beginner, the Merkle tree is a good example of how crypto uses simple hashing, repeated in a structured way, to make large-scale verification fast and tamper-evident. See what is a Merkle tree and the glossary entry for hash.

How do I read a block explorer?

A block explorer is a free website that lets anyone look up transactions, addresses, and blocks on a public blockchain. Because the ledger is public, a block explorer is your window into it — a way to independently verify that a transaction happened, without trusting anyone's word.

To check a transaction, you paste its identifier (the transaction hash) into the explorer's search box. It shows you the status — pending or confirmed — along with the sender and receiver addresses, the amount, the fee paid, the block it landed in, and how many confirmations it has. Search an address instead, and you can see its balance and full history of transactions, since everything on the chain is visible. Search a block, and you see all the transactions it contains and its place in the chain.

This is genuinely useful for a beginner. If someone claims a payment was sent, you can verify it yourself. If a transaction seems stuck, the explorer shows whether it is still pending or already confirmed. It is also a reality check on the "anonymous" myth: the transparency that lets you verify your own transaction lets anyone trace addresses too. Learning to read an explorer turns trust into verification. See how to read a block explorer.

Is crypto anonymous?

Mostly no — crypto is pseudonymous, not anonymous. Transactions are tied to addresses rather than to your name, but every transaction is public and permanent, and those addresses can often be linked back to real identities through analysis or through the exchanges people use.

An address is like a nickname. It does not display your name, but it appears on a public ledger that anyone can read forever, using a block explorer. Once any single transaction connects an address to your identity — for example when you withdraw from an exchange that verified your identity, or receive a payment tied to you — much of that address's history can be associated with you. Specialised firms build a living map of address activity, and law enforcement and businesses use these tools routinely.

For a beginner, the honest framing is that crypto offers privacy from a casual observer but not true anonymity. Reusing one address makes tracing easier; identity checks at exchanges create clear links; and because nothing on the chain is ever deleted, an analysis made years later can still connect the dots. Some projects aim for stronger privacy, but the mainstream networks most people use are transparent by design. Understanding this protects you from both overconfidence and from schemes that rely on a false belief that crypto is untraceable.

How do crypto scams work, and how do I avoid them?

Most crypto scams work by tricking you into either sending funds or signing a transaction yourself, because a correctly authorised transfer cannot be reversed. The technology is rarely broken; the person is targeted. Knowing the common patterns is the best defence, and this section is written to help you recognise and refuse them.

The recurring shapes are worth memorising. "Send first" schemes promise a giveaway, doubled coins, or guaranteed returns if you send funds or pay a fee — the funds simply vanish. Impersonation scams involve fake "support" agents, fake versions of real projects, or people posing as this or another publication, who contact you first and steer you toward a malicious site. Approval-draining scams trick you into signing a token approval on a fake page, after which your tokens are withdrawn "legitimately". And rug pulls involve a project that attracts money and then disappears or disables withdrawals.

Avoiding them comes down to a few firm rules. Never share a seed phrase or private key — no legitimate service needs it. Distrust anyone who contacts you first, and distrust urgency, guaranteed returns, and "act now" pressure. Verify addresses and contracts before interacting — see verify a contract address — and read what you are signing. When something feels rushed or too good, stop; that pause is your strongest protection. For deeper coverage, see how crypto phishing attacks work and social engineering in crypto.

How do phishing and social engineering attacks work?

Phishing and social engineering attacks work by manipulating you rather than the technology — impersonating something you trust to get you to reveal a secret or sign a harmful transaction. Understanding the playbook, so you can spot it early, is a core part of keeping funds safe.

Phishing typically uses a convincing fake: a website, email, or message that mimics a real wallet, exchange, or project, hoping you will enter your seed phrase, connect your wallet, or approve a transaction on it. The fake may arrive via a search ad, a lookalike domain, a direct message, or a compromised community channel. Social engineering is the human layer: attackers build false trust or urgency — posing as support, a helpful stranger, a job recruiter, or an authority — to lower your guard until you take the action they want.

The defences are behavioural. Slow down when a message creates pressure, because urgency is engineered on purpose. Reach services through official channels you navigate to yourself, never through a link someone sends you. Never enter a seed phrase into a website, and remember that real support never asks for it or contacts you first. Before connecting a wallet or approving anything, check the domain carefully and verify contracts. These attacks succeed on haste and trust; deliberate, verify-first habits defeat most of them. See how crypto phishing attacks work and social engineering in crypto.

What are rug pulls, and what happens when an exchange is hacked?

A rug pull is when the people behind a crypto project take investors' money and abandon it, often after hyping it to attract funds. An exchange hack is when attackers breach a custodial platform and steal assets it was holding for its users. Both are ways people lose funds through others' actions rather than their own mistake, and both point to the same lesson about where risk sits.

In a rug pull, a token or project is promoted heavily, draws in buyers, and then the creators disappear — selling everything, disabling withdrawals, or draining the pooled funds through a hidden ability in the code. Warning signs include anonymous teams with grand promises, pressure to buy quickly, guaranteed returns, and contracts that grant the creators special powers. Verifying a contract and being wary of hype are practical defences — see rug pulls explained.

An exchange hack is different: here you did nothing wrong, but because the exchange held your keys, its breach became your loss. This is the flip side of custodial convenience and the reason for "not your keys, not your coins." It is also why many people keep only what they are actively using on exchanges and hold longer-term funds in wallets they control. For what typically follows a breach, see what happens when an exchange is hacked and, on custody choices, custodial vs non-custodial.

How is crypto regulated?

Crypto is regulated, but the rules differ sharply from one country to another and are still evolving. There is no single global rulebook; instead, each jurisdiction decides how crypto is treated for taxes, how exchanges must operate, and what protections — if any — users receive. This is educational information, not legal or tax advice, and the specifics depend on where you live.

Broadly, regulation tends to focus on a few areas. Exchanges and other intermediaries are increasingly required to register, follow anti-money-laundering rules, and verify customer identities. Tax authorities in many places treat crypto as property or as taxable in certain events, so buying, selling, or earning it can carry reporting obligations. Some regions have built comprehensive frameworks, while others have light or unclear rules, and the picture keeps changing as new laws pass.

For a newcomer, the practical takeaways are simple. Assume your local tax rules apply to your crypto activity, and check the current rules for your own country rather than relying on general statements or on what applies elsewhere. Understand that using a regulated, identity-verifying exchange is common and lawful in many places, even though it reduces privacy. And treat any claim that crypto is "unregulated" or "tax-free" with caution. For a jurisdiction-by-jurisdiction overview, see crypto regulation by jurisdiction, and for the identity rules exchanges apply, see the next section.

What are KYC and AML?

KYC ("Know Your Customer") and AML ("Anti-Money Laundering") are the identity and compliance rules that most regulated crypto services must follow. KYC is the process of verifying who a customer is; AML is the broader set of measures aimed at stopping illegal funds from moving through the financial system. Together they explain why an exchange asks for your identity documents.

When you sign up for a custodial exchange, KYC is why you are typically asked for a name, address, and identification, and sometimes a photo. AML rules are why platforms monitor for suspicious patterns and may report or restrict certain activity. These requirements come from laws that apply to financial businesses, not from crypto being uniquely suspect — banks follow similar rules — and they are one reason crypto is more traceable than many assume, since verified identities create clear links to on-chain addresses.

For a beginner, the useful framing is that KYC and AML are a normal, lawful part of using regulated services, and they trade some privacy for consumer access and legal compliance. Non-custodial wallets you control yourself generally do not require KYC, because you are not opening an account with a company — but you remain responsible for your own tax and legal obligations. Knowing the difference helps you understand what information you are sharing and why. See KYC and AML in crypto and, for related tax and legal context, crypto regulation by jurisdiction.

What is a crypto fork?

A fork is a change to a blockchain's rules that, in some cases, splits it into two separate chains. Because a blockchain is run by many independent participants following shared rules, changing those rules requires them to agree — and when they do not fully agree, the network can divide.

There are two flavours. A "soft fork" tightens the rules in a backward-compatible way, so participants who do not upgrade can still take part; the network stays unified. A "hard fork" changes the rules in a way that is not backward-compatible, so everyone must upgrade to stay on the same chain. If a portion of the community declines to adopt a hard fork, the chain splits into two: the original and the new version, each continuing with its own participants and history from the split point onward.

Forks are how decentralised networks evolve without a central authority pushing updates, and they can be routine upgrades or contentious splits that create an entirely new coin. For a beginner, the point to remember is that "the community agreeing on rules" is a real, ongoing process, and forks are its visible outcome — sometimes a smooth improvement, sometimes a genuine disagreement made permanent in code. Scammers sometimes exploit fork confusion, so be cautious of anything asking you to "claim" forked coins by entering a seed phrase. See crypto forks explained.

What is a testnet?

A testnet is a practice version of a blockchain, used by developers to try things out without risking real money. It behaves like the real network — the "mainnet" — but its coins have no value, so mistakes cost nothing. It is where new software and smart contracts are shaken out before they go live.

Developers use testnets to deploy and test smart contracts, wallets, and applications under realistic conditions. Test coins are usually free from a "faucet", precisely because they are not meant to be worth anything; their only purpose is to exercise the system. Once code works reliably on a testnet, it can be deployed to the mainnet, where transactions involve real value and real consequences.

For a beginner, testnets are worth knowing about for two reasons. First, they are a safe place to learn: you can practise sending transactions and using a wallet without any financial risk. Second, awareness of testnets protects you from a scam angle — because test coins are worthless by design, any offer to "buy" testnet coins, or claims that testnet tokens will become valuable, is a red flag. Understanding the difference between a valueless practice network and the real one is a small piece of literacy that prevents confusion. See what is a testnet.

Where should a beginner start?

A good starting point is to understand the fundamentals before touching any money: what a blockchain is, how keys and wallets work, and how to recognise scams. Crypto rewards patience and understanding, and the most expensive mistakes tend to come from acting before the basics are clear. This publication is built to help with exactly that.

A sensible path is to read first and go slowly. Start with how the ledger works — what a blockchain actually is and how a crypto transaction gets confirmed. Then get comfortable with custody: keys, seed phrases, and wallets. Finally, build your defensive instincts with the security articles on phishing and social engineering. Our full glossary is a quick way to look up any unfamiliar term as you read.

One boundary is worth stating plainly. cryptopronetworkcom.org is an independent editorial publication that explains how crypto works — it is not a trading platform, exchange, wallet, or advice service, and it never asks you to deposit funds or share keys. If you are looking to buy or trade, that decision, and the choice of a regulated provider, is yours to make elsewhere; our job is only to help you understand. If a site or message uses this publication's name to solicit money, see our disambiguation page. Nothing here is financial advice.

Frequently asked questions