Browser-extension crypto wallet (EVM): how it works

When you create a wallet it generates a recovery phrase: twelve or twenty-four ordinary English words drawn from a standard list. Those words are not a password on top of your account — they are the account. Every private key the wallet will ever use is derived from them by a deterministic process, which is why the same phrase restores the same addresses in any compatible wallet software.

The derived keys are encrypted with your password and stored in the extension's local storage on your machine. They are not uploaded, synced, or escrowed. The practical consequence is that the wallet's authors cannot help you recover anything — not as a policy choice, but because they have never had it.

Signing happens locally. A site can ask your wallet to sign something, and the wallet shows you the request, but nothing is signed without your approval and nothing leaves your device except the finished signature.

The Ethereum Virtual Machine is the execution environment Ethereum uses, and many other networks have adopted it wholesale. Base, Arbitrum, Optimism and Polygon all run EVM-compatible chains, which is why one wallet and one address work across all of them.

Here is the part that catches people: the address is the same on every chain, but the balances are not. Tokens exist on a specific network. USDC on Ethereum and USDC on Base are separate balances at the same address, and sending one to an address expecting the other does not convert between them.

Layer-2 networks matter mostly for cost. They batch transactions and settle to Ethereum, which makes a swap that might cost several dollars in gas on mainnet cost cents on Base or Arbitrum. For anything but large trades, this is the difference between an on-chain swap being sensible and being absurd.

Connecting is narrower than it sounds. The site asks the wallet for permission to see your address, and if you agree, that is all it gets — an address and the ability to ask you for things later. A connection does not grant spending power.

Modern wallets and sites use a discovery standard so that having several wallets installed does not turn into a fight over which one answers. If you have more than one extension, a well-built site lets you choose rather than silently picking whichever loaded first.

Disconnecting is worth knowing about too. Removing a site's connection stops it seeing your address, but it does not revoke token approvals you granted while connected. Those are on-chain permissions and are cleared separately.

A transaction changes state on-chain and costs gas: sending tokens, swapping, approving a contract. Your wallet shows the destination, the value, the network, and an estimated fee. This is the category where mistakes cost money, and it is the one worth slowing down for.

A plain message signature costs nothing and changes nothing on-chain. It is normally used to prove you control an address — logging in to a site, for example. Signing a message cannot move funds by itself.

Structured data, sometimes shown as typed data, sits between the two. It is a signature over a defined set of fields rather than free text, and it is how gasless approvals and some order types work. Because it can authorize a later on-chain action, it deserves the same attention as a transaction: read what the fields say, particularly amounts and expiry.

Every transaction is paid for in the network's own token — ETH on Ethereum, Base, Arbitrum and Optimism, POL on Polygon. This holds regardless of what you are moving, so a wallet holding only USDC on Base cannot send that USDC anywhere until it also holds a small amount of ETH on Base.

This is the single most common source of the wallet is stuck confusion. The funds are fine and the wallet works; there is simply nothing available to pay the network with. Keeping a small native balance on each chain you use avoids it entirely.

Never enter your recovery phrase into a website. There is no legitimate reason for a site to ask. Support staff will not ask, wallet migrations do not require it, and validating or syncing a wallet is not a thing that exists.

Check the URL before connecting, particularly if you arrived from a link. Phishing sites clone interfaces faithfully and the address bar is usually the only difference.

Review token approvals occasionally and revoke ones you no longer need. An old unlimited approval to a contract that later turns out to be compromised is a live risk long after you stopped using the site.

Split by purpose. A browser wallet is a hot wallet — connected, convenient, and exposed to whatever your browser encounters. Holdings you are not actively trading belong in a hardware wallet, and treating the two differently is normal practice rather than paranoia.

The 1stopcrypto wallet is a non-custodial EVM extension for Chrome, Edge, Firefox and Opera. It generates and encrypts your keys on your device, supports Ethereum, Base, Arbitrum, Optimism and Polygon at a single address, and implements the standard connection and discovery interfaces so it works with other on-chain sites, not only ours.

It docks alongside the terminal so quotes, charts, and signing live in one place instead of three windows. Token balances refresh automatically and can be refreshed by hand when you have just received something and do not feel like waiting.

Everything above about custody applies to it without exception: we cannot see your recovery phrase, cannot sign on your behalf, and cannot restore your wallet if the phrase is lost.