Welcome to the NZRT Wiki Podcast. Today we’re looking at Wallets & Keys.

So let’s start with the core idea, because everything else builds on it. A blockchain wallet doesn’t actually hold your crypto the way a physical wallet holds cash. What it holds is your private key. And that private key is what signs your transactions and proves you own what you own. Put simply: whoever controls the key controls the assets. That’s the most important sentence in this entire topic, and it’s worth keeping front of mind as we go through the rest.

Let’s talk about the different types of keys and identifiers you’ll encounter. There are four to know about. First is the private key itself — this is a 256-bit secret value, and it’s what signs every transaction you make. Second is the public key, which is mathematically derived from your private key and is used to verify those signatures. Third is your address — this is the last 20 bytes of a specific hash of your public key, and it’s your on-chain identity, the thing other people send funds to. Fourth is the seed phrase, sometimes called a mnemonic — this is either 12 or 24 words following the BIP-39 standard, and it can regenerate all the keys in your wallet. Lose the seed phrase and you lose access. Share the seed phrase and you’ve handed over control.

Now let’s look at wallet types, because not all wallets work the same way. There are four main types you’ll come across at NZRT. The first is an EOA, or Externally Owned Account. This is the most common type — it’s directly controlled by a private key, and you use it for regular transactions. The second type is a smart contract wallet, like Gnosis Safe. Instead of being controlled by a single key, it’s controlled by code. This makes it great for multisig setups or team accounts where you want more than one person to approve a transaction. Third is a hardware wallet, like a Ledger device. With this, the private key is stored offline on the device itself, which makes it the most secure option for high-value assets because the key never touches the internet. Fourth is MetaMask, which is a browser extension that acts as an EOA. It’s the tool you’ll typically use for development work and signing transactions in a Web3 environment.

Now let’s talk about how NZRT specifically has things set up. There are two wallets to be aware of. The first is a MetaMask wallet used for deployer work — testnet deployment and signing — running on the Base Sepolia network. The credentials and seed for that live in the ICS Blockchain folder under MetaMask Seed. The second is a Gnosis Safe configured as a two-of-three multisig. That means at least two out of three authorised signers need to approve any transaction. It runs on the Base testnet and is used for contract ownership. You can find the signer details in the ICS Blockchain folder under safe-signers.

Before we wrap up, let’s go through the security rules, because this is where things get serious. First — and this cannot be overstated — never commit private keys or seed phrases to a Git repository. If a key ends up in version control, treat it as compromised immediately. Second, store your seeds in encrypted, offline storage. Not in a notes app, not in email, not in a cloud document with no encryption. Third, when you’re working locally with environment variables that contain keys, use a dot-env file and make absolutely sure that file is listed in your dot-gitignore so it never gets pushed. Fourth, on mainnet — meaning real money, real assets — you should always be using either a hardware wallet or a multisig setup. No exceptions. And fifth, any testnet EOA you use for development should never hold mainnet funds. Keep those environments completely separate. A testnet account is for testing; treat it accordingly.

The related topics to dig into from here are Gnosis Safe Multisig, Key Security, and MetaMask Setup — all of which go deeper on the specific tooling mentioned today.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.