Learn about crypto exchanges and wallets — Stock-Market notes

Overview

Crypto exchanges and wallets form the infrastructure layer that enables buying, selling, storing, and transferring digital assets. Understanding their mechanics, security models, and tradeoffs is essential before interacting with cryptocurrency markets.

Figure — Learn about crypto exchanges and wallets

Core Concepts

Definition Crypto Wallet

A crypto wallet is software or hardware that stores your private keys and allows you to interact with blockchain networks. It does NOT store coins directly—coins exist as entries on the blockchain. The wallet stores:

Private key: Secret number that signs transactions (proves ownership)
Public key: Derived from private key, used to generate your address
Address: String (like "0x742d35...") where others send you crypto

Types by connectivity:

Hot wallet: Connected to internet (mobile app, browser extension, exchange account). Convenient but vulnerable to hacks.
Cold wallet: Offline storage (hardware device, paper wallet). Secure but less convenient for active trading. Types by custody:
Custodial: Third party (exchange) holds your keys. You trust them not to lose/steal funds.
Non-custodial: You hold your keys. You're responsible for security and backups.

How Centralized Exchanges Work

Operational Model

When you use a CEX like Coinbase:

Account Creation: KYC (Know Your Customer) verification—you prove your identity with government ID, address proof.
Deposit: You send fiat (bank transfer, credit card) or crypto (blockchain transfer) to the exchange's omnibus wallet.
Internal Ledger: The exchange credits your account. Your balance now exists in their off-chain database, not on-chain.
Trading: You place orders. The exchange matches you with counterparties instantly because it's all internal accounting—no blockchain transactions during trades.
Withdrawal: You request to send funds out. The exchange broadcasts an on-chain transaction from their wallet to your personal wallet.

Why this model?

Speed: Off-chain matching = millisecond execution, not waiting for blockchain block confirmations (10 min for Bitcoin, 12 sec for Ethereum).
Complexity: Advanced order types (limit, stop-loss, margin, futures) are easier to implement in traditional software than in smart contracts.
Liquidity: Centralized order books aggregate buyers/sellers, providing better prices for large trades.

Tradeoffs:

Counterparty risk: Exchange bankruptcy (FTX 2022), hacks (Mt. Gox 2014), or fraud means you lose funds.
Custody: "Not your keys, not your coins"—you're trusting the exchange's security andolvency.
Censorship: Exchange can freeze your account, block withdrawals (government order, AML flags, terms-of-service violation).

Worked example CEX Trading Flow

Scenario: You want to buy 0.5 ETH at $2,000/ETH on Binance.

Step 1: You already deposited $1,200 via bank transfer (shows as$ 1,200 in your Binance USD balance).

Step 2: You place a market buy order for 0.5 ETH.

Binance's matching engine finds the best available sell orders: Maybe 0.3 ETH at $2,000, 0.2 ETH at$ 2,001.
Why market order? You want immediate execution, accepting current market price. Step 3: Binance executes instantly:
Debits your USD balance: $1,000.15 (0.3×$ 2,000 + 0.2× $2,001 +$ 0.15 fee).
Credits your ETH balance: 0.5 ETH.
Why instant? No blockchain involved—just database updates.

Step 4: Your0.5 ETH sits in Binance's Ethereum wallet (along with millions of other users' ETH). Their internal ledger tracks that0.5 ETH belongs to you.

Step 5: Later, you withdraw to your MetaMask wallet (0xYourAddress..). Binance broadcasts an Ethereum transaction: transfer(0xYourAddress, 0.5 ETH) from their wallet. After ~12 seconds (1 block confirmation), you truly own the ETH on-chain.

Why this matters: Between Step 3 and Step 5, if Binance is hacked or colapses, your ETH is at risk even though your account "shows" 0.5 ETH.

How Decentralized Exchanges Work

Operational Model (Automated Market Maker Example)

DEXs like Uniswap use Automated Market Makers (AMMs) instead of order books:

Liquidity Pools: Users deposit pairs of tokens (e.g., ETH and USDC) into a smart contract. The pool now has reserves $R_{ETH}$ and $R_{USDC}$ .
Constant Product Formula: The AM maintains $R_{ETH} \times R_{USDC} = k$ (constant).
Swap Execution: You want to buy ETH with USDC. You send USDC to the pool; it calculates how much ETH to send you such that $k$ stays constant (minus a small fee).
Price Discovery: Price = ratio of reserves. As people buy ETH, $R_{ETH}$ decreases and $R_{USDC}$ increases, so price of ETH rises.

Deriving the swap formula: Suppose the pool has $R_x$ of token X and $R_y$ of token Y, with $k = R_x \cdot R_y$ . You send $\Delta x$ of token X. How much $\Delta y$ of token Y do you get?

After the swap: $(R_x + \Delta x)(R_y - \Delta y) = k = R_x R_y$

Expand: $R_x R_y - R_x \Delta y + \Delta x R_y - \Delta x \Delta y = R_x R_y$ Cancel $R_x R_y$ and solve for $\Delta y$ : $\Delta x R_y - R_x \Delta y - \Delta x \Delta y = 0$ $\Delta y (R_x + \Delta x) = \Delta x R_y$ $\Delta y = \frac{\Delta x \cdot R_y}{R_x + \Delta x}$

Why this form? As $\Delta x$ increases, denominator grows, so $\Delta y$ grows slower (you get worse price for larger trades = slippage). This is the price impact of your trade.

Including a fee $\phi$ (e.g., 0.3%), the actual formula becomes: $\Delta y = \frac{\Delta x (1 - \phi) \cdot R_y}{R_x + \Delta x (1 - \phi)}$

Why AMs?

No order book: Smart contracts can't efficiently maintain sorted order lists on-chain (too gas-expensive). Constant product is a simple formula executable in one transaction.

Permissionless: Anyone can create a pool or add liquidity; no company gatekeping.

Always available: As long as the blockchain runs and the pool has liquidity, you can trade 24/7 with no downtime.

Tradeoffs:

Slipage: Large trades get progressively worse prices. On a CEX, a big order might be filled at a narrow price range; on a DEX, you're moving the pool curve.

Gas fees: Every swap is an on-chain transaction. Ethereum gas can cost $5–$50+ during congestion.

Impermanent loss: If you provide liquidity and prices diverge, you may end up with less value than just holding the tokens.

Smart contract risk: Bugs or exploits in the DEX code can drain funds.

[!example] DEX Swap Calculation Scenario: Uniswap ETH/USDC pool has $R_{\text{ETH}} = 1000$ ETH, $R_{\text{USDC}} = 2{,}000{,}000$ USDC. Current price: $2,000/ETH. You want to swap 10,000 USDC for ETH. Fee = 0.3%. Step 1: Calculate ETH received (no fee first, for clarity): $\Delta y_{ETH} = \frac{\Delta x_{USDC} \cdot R_{ETH}}{R_{USDC} + \Delta x_{USDC}} = \frac{10{,}000 \cdot 1000}{2{,}000{,}000 + 10{,}000} = \frac{10{,}000{,}000}{2{,}010{,}000} \approx 4.975 \text{ ETH}$ Why divide by $(R_{USDC} + \Delta x)$ ? We're adding USDC to the pool, so denominator grows, reducing ETH output.

Step 2: Include 0.3% fee: $\Delta x_{effective} = 10{,}000 \times 0.997 = 9{,}970$ $\Delta y_{ETH} = \frac{9{,}970 \cdot 1000}{2{,}000 + 9{,}970} \approx 4.963 \text{ ETH}$

Step 3: Implied price: $\text{Price} = \frac{10{,}000}{4.963} \approx \$2{,}014.91/\text{ETH}$ *Why higher than $2,000?* Your trade moved the pool. Before:$ \frac{2{,}000{,}000}{1000} = 2000 $. After:$ \frac{2{,}010{,}000}{995.037} \approx 2020 $. You paid the **average** price across your trade's impact curve, which is$ 2,014.91.

Slippage: $(2{,}014.91 - 2{,}000) / 2{,}000 \times 100\% \approx 0.75\%$ . For a small trade, this is tolerable; a 100,000 USDC trade would face much higher slippage.

Wallet Security Model

Private Keys and Seed Phrases

Your wallet displays a 12-word or 24-word seed phrase (e.g., "witch collapse practice feed shame open despair creek road again ice least..."). This phrase is your private key, encoded as words for easier backup.

Derivation process (BIP39 standard):

Seed phrase → 512-bit seed (via PBKDF2 hashing)
Seed → Master private key (via HMAC-SHA512)
Master key → Child keys for different accounts/addresses (hierarchical deterministic derivation)

Why? One phrase can generate infinite addresses for Bitcoin, Ethereum, etc., in a deterministic sequence. Backup once, recover everything.

Security principles:

Never share seed phrase: Anyone with it can recreate your wallet and steal all funds. No legitimate service will ever ask for it.
Offline backup: Write on paper/metal, store in safe or bank deposit box. Never type into computer unless recovering.
Multi-sig wallets: Require $m$ of $n$ keys to sign transactions (e.g., 2-of-3). Protects against single key compromise. Used by institutions.

Formula Address Generation (Ethereum Example)

Elliptic Curve Cryptography (secp256k1 curve):

Private key: Random 256-bit number $k$ (your seed phrase generates this deterministically).
Public key: Point $P = k \cdot G$ on the elliptic curve, where $G$ is the generator point.

Elliptic curve: $y^2 = x^3 + 7$ (for secp256k1)
Point multiplication: $P = G + G \cdots + G$ ( $k$ times)
Why secure? Given $P$ , finding $k$ (discrete log problem) is computationally infeasible.

Ethereum address: Last 20 bytes of Keccak-256 hash of public key, prepended with "0x".

$\text{Address} = \text{0x} + \text{last20bytes}(\text{Keccak256}(P))$ Signing a transaction: You want to send 1 ETH to Bob's address. You create a transaction message $m$ (to, amount, gas, nonce) and compute: $\text{signature} = \text{ECDSA}(k, \text{hash}(m))$

The signature $(r, s, v)$ proves you possess $k$ without revealing it. Miners verify using your public key: $\text{Verify}(P, \text{hash}(m), \text{signature}) \stackrel{?}{=} \text{True}$

Why this matters: Your private key never leaves your wallet. The signature is sufficient proof of ownership. If someone gets your private key, they can sign any transaction as you—irreversibly transfering funds.

Worked example Hot vs. Cold Wallet Comparison

Scenario: You hold $50,000 worth of crypto. Hot Wallet Setup (MetaMask browser extension):

Advantages:
One-click connection to DEXs, NFT marketplaces, DeFi protocols.
Free (just download).
Easy to use—signs transactions with a password.
Risks:
Private key stored encrypted on your computer. Malware can potentially steal it.
Phishing sites can trick you into signing malicious transactions.
Real incident: User clicks on fake Uniswap link, signs a token approval transaction. Attacker drains their USDC balance.

Cold Wallet Setup (Ledger Nano X hardware wallet):

Advantages:
Private key never leaves the hardware device. Even if your computer has malware, key stays safe.
Transactions require physical button press on device (confirms you're intentionally signing).
Seed phrase backup stored offline (you write24 words on paper).
Risks:
Cost: $150 device.
Inconvenience: Must plug in device, press buttons, wait for confirmation—slower workflow.
Physical security: If someone steals your device AND your PIN, they have access (time to transfer funds out before you recover with seed phrase).

Recommended strategy:

Cold wallet for long-term holdings (majority of funds).
Hot wallet for active trading (only what you're willing to risk, like keeping cash in your physical wallet vs. savings in a bank vault).
Never keep more than you can afford to lose on an exchange (counterparty risk) or in a hot wallet (hack risk).

Regulatory and Practical Considerations

KYC/AML on Centralized Exchanges

KYC (Know Your Customer) and AML (Anti-Money Laundering) regulations require exchanges to:

Verify user identity (government ID, selfie, proof of address)
Monitor transactions for suspicious patterns (large/rapid transfers, connections to sanctioned entities)
Report to regulators (FinCEN in US, FCA in UK, etc.)

Why exchanges enforce this:

Legal compliance: Operating without KYC = potential criminal charges for exchange operators.
Banking relationships: Exchanges need fiat on/off ramps (partnerships with banks). Banks require AML compliance.

Implications for users:

Privacy tradeoff: Your trades are linked to your identity, unlike the pseudonymous nature of blockchain addresses.
Jurisdictional risk: Exchange must comply with your government's orders (asset freezes, tax reporting).
DEX appeal: Non-custodial DEXs don't require KYC because they never custody funds—you trade directly from your wallet.

Taxation

In most jurisdictions (US, UK, India, EU), cryptocurrency is property (not currency) for tax purposes:

Capital gains tax: Selling crypto (even for another crypto) = taxable event. If you bought BTC at $20k, sold at$ 40k, you owe tax on $20k gain.
Income tax: Receiving crypto (mining rewards, staking, airdrops, salary) = ordinary income at fair market value.
Record-keeping burden: You must track cost basis and date for every transaction. Exchanges provide CSV exports; walets don't (you need third-party tools like Koinly, CoinTracker).

Common mistake: Trading between cryptos (BTC → ETH) "doesn't count" as a sale. Wrong—it triggers capital gains on the BTC appreciation.

Common mistake Common Mistake: "I can avoid tax by not withdrawing to fiat"

Why it feels right: If I just trade crypto-crypto and never touch my bank account, the government can't track it.

The fix:

Most tax codes treat crypto-crypto as a taxable sale (disposing of one property to acquire another). When you swap1 BTC for 20 ETH, you're selling BTC at its current value.
Centralized exchanges report to tax authorities (IRS Form 1099-K in US). DEX trades are on public blockchains—forensic tools (Chainalysis, Elliptic) can link addresses to exchange accounts where you KYC'd.
Penalty risk: Tax evasion charges if caught. In the US, failure to report cryptocurrency is explicitly flaged by the IRS (checkbox on Form 1040: "Did you receive, sell, send, or exchange any virtual currency?").
Better strategy: Use tax-loss harvesting (sell losers to offset gains), hold >1 year for long-term capital gains rate (lower), track cost basis diligently.

Connections

Blockchain fundamentals — understanding how transactions are verified and recorded
Order book vs AM trading — deeper dive into exchange mechanism design
DeFi protocols — how walets interact with lending, borrowing, yield farming
Cryptocurrency market structure — how exchanges affect price discovery and liquidity
Digital asset custody solutions — institutional-grade multi-sig and insurance options
Smart contract security — risks when connecting walets to DeFi protocols
Tax accounting for crypto trades — detailed treatment of cost basis methods (FIFO, LIFO, specific ID)

Active Recall Practice

Recall Explain to a12-year-old

Imagine you have special video game coins (cryptocurrency). To buy or sell these coins, you need two things:

An exchange (like a store where people trade game coins). Some stores are run by a company (centralized)—you give them your coins to hold, and they let you trade super fast on their computers. Other stores are more like a vending machine (decentralized)—you use your own wallet to trade directly with other people through automatic rules in a smart program. No company boss can close your account because there is no company!
A wallet (like a backpack for your coins, but digital). Your wallet has a secret password (private key) that proves the coins are yours. If you write the password on paper and hide it somewhere safe, that's a "cold wallet" (like burying treasure). If you keep it on your phone so you can spend coins anytime, that's a "hot wallet" (easy to use, but if someone hacks your phone, they can steal the password and take your coins).

The important rule: If you keep your coins in the company's store, they're holding your password for you. That's easier, but if the store gets robed or goes bankrupt, you lose your coins. If you use the vending-machine-style exchange and keep your password in your own backpack, you're in control, but you also have to be super careful not to lose your password—there's no "forgot password" button because no one else knows it!

Mnemonics & Memory Aids

#flashcards/stock-market

What are the two main types of crypto exchanges and their key tradeoff? :: Centralized exchanges (CEX) like Coinbase offer speed, liquidity, and convenience but require trusting the exchange with custody (counterparty risk). Decentralized exchanges (DEX) like Uniswap offer non-custodial trading and censorship resistance but have higher slippage, gas fees, and require users to manage their own keys.

What is the difference between a private key, public key, and address in crypto walets?

The private key is a secret number that signs transactions and proves ownership. The public key is mathematically derived from the private key using elliptic curve cryptography and is used to verify signatures. The address is a shortened hash of the public key (e.g., 0x123..) that serves as your receiving address. Only the private key can spend funds; losing it means irreversible loss of access.

How does the constant product formula work in AM-based DEXs?

In an AMM like Uniswap, liquidity pools maintain k = R_x × R_y (constant). When you swap Δx of token X for token Y, the formula Δy = (Δx × R_y) / (R_x + Δx) determines how much Y you receive. As you buy more of one token, its reserve decreases, making each additional unit more expensive (causing slippage).

Why is "not your keys, not your coins" important in crypto?

When you hold crypto on a centralized exchange, the exchange controls the private keys, not you. You have an IOU, not actual ownership on the blockchain. If the exchange is hacked (Mt. Gox), goes bankrupt (FTX), or freezes your account, you can lose access to your funds. True ownership means possessing the private key that can sign transactions from the address holding your coins.

What is slippage and why does it occur on DEXs?

Slippage is the difference between expected price and executed price. On AM-based DEXs, your trade changes the pool's reserve ratio (from k = R_x × R_y). Large trades remove more of one token, increasing its price progressively. Example: buying ETH when pool has 1000 ETH might get you the first bit at

2000, but the last bit at

2020, averaging $2010 (0.5% slippage).

What is the purpose of a seed phrase and how should it be secured?

A seed phrase (12 or 24 words) encodes your master private key using BIP39 standard. It can deterministically generate all your wallet addresses. Security: write it on paper/metal, never digitally (no photos, cloud storage, email). Store offline in a safe or bank deposit box. Never share with anyone—possession of the seed phrase = full control of all funds.

What triggers capital gains tax in cryptocurrency?

Selling crypto for fiat, trading crypto for another crypto, or using crypto to buy goods/services are all taxable events in most jurisdictions (treating crypto as property, not currency). Each event requires calculating capital gain/loss: sale price minus cost basis. Holding doesn't trigger tax; disposing does. Trading BTC for ETH = selling BTC at current value (taxable).

What is the difference between custodial and non-custodial wallets?

Custodial wallets (exchange accounts) = third party holds your private keys, you trust them. Easy to use, can recover account with email/phone, but vulnerable to exchange hacks and bankruptcy. Non-custodial wallets (MetaMask, hardware wallets) = you hold your private keys, responsible for security and backups. No counterparty risk, but lose keys = lose funds permanently.

Why do centralized exchanges require KYC?

KYC (Know Your Customer) is legally required in most jurisdictions to comply with AML (Anti-Money Laundering) regulations. Exchanges need banking partnerships for fiat on/off ramps; banks demand AML compliance. Exchanges must verify identity, monitor for suspicious activity, and report to financial regulators. Operating without KYC risks criminal charges and loss of banking access.

What is impermanent loss in liquidity provision?

When you provide liquidity to an AMM pool (e.g., deposit equal value of ETH and USDC), you earn trading fees but face impermanent loss if prices diverge. If ETH doubles, the pool rebalances (you end up with less ETH, more USDC than if you'd just held). The loss is "impermanent" because it disappears if prices return to original ratio. Only realized when you withdraw liquidity.

Concept Map

Hinglish (regional understanding)

Intuition Hinglish mein samjho

Hinglish (regional understanding)

Intuition Hinglish mein samjho

Dekho, crypto exchange aur wallet ko samajhna aise hai jaise banking system ko samajhna. Exchange ek combined stock brokerage plus currency exchange booth ki tarah hai jahan tum apna fiat money (jaise rupees ya dollars) crypto mein badalte ho, ya ek crypto ko doosre se swap karte ho. Wallet ek safe-deposit box jaisa hai, lekin isme actual coins store nahi hote - isme tumhare cryptographic keys store hote hain jo prove karte hain ki blockchain par recorded coins tumhare hain. Yahan sabse important baat yeh hai ki jo private key hold karta hai, wahi asli owner hai.

Ab why it matters - traditional banking se yeh bilkul alag hai. Agar tum apna bank password bhool jao, toh manager reset kar dega. Lekin crypto mein agar tumne apni private key kho di, toh koi bhi tumhe help nahi kar sakta - paisa gaya toh gaya. Agar kisi ne key chura li, toh koi credit card company transaction reverse nahi karegi. Isiliye "not your keys, not your coins" wala funda itna famous hai. Exchanges do type ke hote hain - CEX (centralized, jaise Coinbase/Binance) jahan company tumhare funds custody karti hai, aur DEX (decentralized, jaise Uniswap) jahan tum khud apni keys ke saath control rakhte ho.

Ek aur practical baat - CEX itne fast kyun hote hain? Kyunki jab tum trade karte ho, sab kuch unke internal off-chain database mein hota hai, blockchain par nahi. Isse execution milliseconds mein ho jaata hai, warna Bitcoin ke block confirmation ke liye 10 minutes wait karna padta. Lekin iska tradeoff yeh hai ki counterparty risk aa jaata hai - agar exchange bankrupt ho jaye (jaise FTX 2022 mein hua) ya hack ho jaye (Mt. Gox 2014), toh tumhara paisa doob sakta hai. Isliye hot wallet (internet-connected, convenient) aur cold wallet (offline, secure) ka balance samajhna zaroori hai - active trading ke liye thoda amount hot mein rakho, aur bada holding cold storage mein safe rakho.

Test yourself — Commodities, Forex & Crypto