The short version
- A cryptocurrency is an entry on a shared ledger (a blockchain); whoever controls the private key controls the coins.
- Coins left on an exchange are held by that company, so its security and solvency become your risk.
- Crypto transfers cannot be reversed, which makes checking addresses and platforms essential.
How crypto works comes down to one idea: instead of a bank keeping the record of who owns what, thousands of computers keep identical copies of a shared ledger, and cryptography decides who may update it. Everything from Bitcoin to stablecoins builds on that foundation, and most of the risks newcomers face come from misunderstanding who holds the keys.
How crypto works underneath: the blockchain
A blockchain is a list of transactions grouped into blocks, each linked to the one before by a cryptographic fingerprint. Changing an old entry would change every fingerprint after it, so tampering is obvious to everyone else keeping a copy. New blocks are added by network participants following agreed rules, using either proof of work (competing to solve a costly puzzle, as Bitcoin does) or proof of stake (locking up coins as a deposit that can be lost for cheating).
The result is a record nobody can quietly edit and nobody can reverse. That permanence is the feature and the danger: a mistaken or fraudulent payment stays paid.
Coins, tokens and stablecoins
- Coins are native to their own blockchain, such as bitcoin on the Bitcoin network or ether on Ethereum. They pay the fees for using that network.
- Tokens are created by software (smart contracts) on an existing blockchain. Anyone can create one in minutes, which is why copycat and scam tokens are so common.
- Stablecoins are tokens designed to hold a steady value, usually one US dollar, backed by reserves held by an issuer. USDT is the largest example; see what USDT is.
For a closer look at the original cryptocurrency, read what Bitcoin is. For how people rank thousands of tokens, see our note on top 100 lists.
Wallets and keys: the part that decides ownership
A crypto wallet does not store coins. It stores a private key, a secret number that lets you sign transactions moving coins recorded under your address. Most wallets derive the key from a seed phrase of 12 or 24 words. Anyone who learns the seed phrase can take everything, from anywhere, without your permission.
| Type | Who holds the key | Main risk |
|---|---|---|
| Exchange account | The exchange | The company is hacked, freezes withdrawals or fails |
| Software wallet on your phone | You | Malware, phishing, losing the seed phrase |
| Hardware wallet | You, on a dedicated device | Losing the device and the seed backup, fake devices |
No legitimate service, support agent or "wallet validation" website will ever need your seed phrase. A request for it is always an attempt at theft.
Where crypto is bought and sold
Centralised exchanges are companies that run order books, hold customer funds and usually require identity checks (know-your-customer, or KYC). They are convenient but act as custodian: coins you leave there are, in practice, an IOU from the company. Their licensing varies enormously, which is why the checklist in how to choose a broker applies to them too.
Decentralised exchanges are programs on a blockchain that swap tokens directly from your own wallet. You keep your keys, but you also carry the risk of buggy code, fake tokens and malicious "approvals" that let a contract drain a wallet.
Brokerage-style apps sell you crypto at a quoted price. Some let you withdraw coins to your own wallet; others only give you price exposure. Always check which you are getting.
Funding routes, including PayPal to crypto
Most platforms accept bank transfers and cards, and some accept e-wallet payments. Going from PayPal to crypto is possible in some countries, either through a platform that accepts PayPal as a payment method or through crypto features offered inside some payment apps. Before using any route, check three things: the total fee, whether you can move the coins to a wallet you control, and whether withdrawals back to the same method are supported.
Be wary of anyone who asks you to pay them through PayPal's "friends and family" option, a gift card or a bank transfer in return for crypto sent later. Person-to-person deals like these are a favourite route for fraud because the payment is hard to recover once the other side disappears.
What buying really costs (illustrative numbers)
Suppose you buy $200 of a coin with a card. The platform charges a 3.5% card fee and quotes a price 1% above the market mid-price.
- Card fee: $200 × 3.5% = $7, leaving $193 to spend.
- At a price 1% above mid, $193 buys coins worth about $193 ÷ 1.01 = $191.09 at the mid-price.
- To get back to $200 you would need a rise of about 200 ÷ 191.09 − 1 = 4.7%, before any selling costs.
Our crypto profit calculator includes fees on both the buy and the sell, and the fees guide lists the charges that are easy to overlook, such as network fees on withdrawals.
A first purchase, with a safety check at each step
- Check the platform. Confirm the company is registered or licensed where you live, using the regulator's own register. Download its app only from an official app store, reached by typing the name yourself rather than tapping a link from a message.
- Secure the account. Use a unique password and app-based two-factor authentication rather than text messages, which can be intercepted through SIM-swap fraud.
- Fund it with a small amount. Note every fee along the way: payment method, spread and trading fee.
- Buy, then check what you hold. Is it the coin itself, withdrawable to a wallet, or only price exposure?
- Decide where it lives. If you move coins to your own wallet, write the seed phrase on paper, store it offline and never photograph it.
- Keep records. Dates, amounts, prices and fees, for tax and for your own understanding of results.
Nobody legitimate will ever contact you to "help" with any of these steps. Unsolicited assistance, especially by phone or messaging app, is the single most common opening for crypto fraud.
Sending crypto safely
Every blockchain has its own address format, and many tokens exist on several networks at once. Sending on the wrong network, or to a mistyped or swapped address, usually means the funds are lost. Good habits:
- Copy addresses with the copy button, then check the first and last several characters against the source.
- Send a small test amount before a large transfer.
- Never copy an address from your transaction history; scammers plant look-alike addresses there ("address poisoning").
Rules and protections
Regulation of crypto is uneven. The EU's Markets in Crypto-Assets Regulation (MiCA) licenses crypto-asset service providers and sets rules for stablecoin issuers. The UK requires crypto firms to register with the Financial Conduct Authority for anti-money-laundering purposes and bans the sale of crypto derivatives to retail consumers. In many countries there is no compensation scheme if a crypto platform fails, and tax is usually due on gains when you sell or swap, so keep records of every transaction.
Tax and record keeping
In many countries, selling crypto, swapping one token for another or spending it can count as a disposal that may create a taxable gain. Rules vary, and some platforms report customer activity to tax authorities. The practical step is the same everywhere: keep a record of the date, amount, price in your home currency and fees for every purchase, sale, swap and transfer between your own wallets. Reconstructing that history years later is far harder than recording it as you go.
The main risks, in one list
- Volatility: prices can fall by half or more, sometimes quickly.
- Custody: platforms can be hacked, freeze withdrawals or collapse.
- Irreversibility: payments to scammers or wrong addresses rarely come back.
- Fraud: crypto is the payment method in many investment scams; see how to spot trading scams.
Reader questions
Do I need a wallet to buy crypto?
Not to buy it on an exchange, which holds coins for you. But if you want to control the coins yourself, you need a wallet whose seed phrase only you know.
Can I buy crypto with PayPal?
In some countries, yes, either through platforms that accept PayPal as a payment method or through crypto features inside some payment apps. Check the fees and whether you can transfer the coins out before you buy.
Can a crypto transaction be cancelled?
No. Once a transaction is confirmed on the blockchain it cannot be reversed by anyone. Only the recipient can choose to send funds back.
Sources
- European Union, Markets in Crypto-Assets Regulation (MiCA)
- UK Financial Conduct Authority, cryptoasset registration regime and retail crypto-derivatives ban