Ask anyone who has tried to set up a cryptocurrency wallet for the first time what they remember most, and the answer is rarely the thrill of owning digital assets. It is the twelve or twenty-four random words they were told to write down on paper, store somewhere safe, never photograph, never type into a computer, and never, under any circumstances, lose. That list of words is the entire security model for a self-custodied wallet, and for the better part of a decade it has also been the single biggest reason ordinary people try crypto once and never come back. A seed phrase asks a newcomer to instantly become their own bank, their own security team, and their own disaster-recovery plan, with no customer support line to call if any part of that fails.
A quieter shift has been underway since 2022 that treats this not as an unfortunate but unavoidable cost of decentralization, but as a solvable design problem. The shift centers on passkeys, the same technology that now lets people unlock a laptop or approve a payment with a fingerprint or a glance at their phone, and on a cluster of supporting technologies — account abstraction, multi-party computation, and familiar email or social logins — that together let a wallet feel like any other modern app rather than a piece of specialized financial infrastructure. Instead of a string of words a person must generate, transcribe, and guard forever, the private key materials live inside secure hardware on a device the person already owns, unlocked the same way they unlock everything else on that device.
It is worth being precise about what is genuinely new here, because crypto has a long history of promising to fix its own usability problems and only partially delivering. Passkeys themselves are not a crypto invention; they are a broader authentication standard, built on protocols called WebAuthn and FIDO2, that major technology companies have spent years pushing across banking apps, social media, and operating systems specifically to kill the password. What is new is the deliberate adaptation of that same standard, paired with smart-contract wallet architecture and distributed key-management techniques, to replace the seed phrase specifically. That adaptation has moved, over the last two to three years, from research papers and hackathon demos into products with real, measured usage, which is a meaningfully different claim than another round of promises about crypto finally becoming easy to use.
The timing of this shift is not incidental. Passkey support only became a standard, cross-platform feature across major operating systems, browsers, and device manufacturers around 2022 and 2023, and it took roughly another year beyond that for wallet developers and blockchain infrastructure teams to build the account-abstraction and key-management layers needed to safely wire that authentication feature into a crypto wallet rather than just an ordinary app login. That sequencing explains why the verified examples examined later in this article cluster so tightly around 2023 through 2025: the underlying authentication standard had to reach broad, reliable device support before crypto-specific applications of it could move past internal prototypes and into products real people were actually using.
This article walks through why seed phrases fail so many everyday users in the first place, what a passkey actually is at a technical level and how it gets wired into a crypto wallet through account abstraction and multi-party computation, and what familiar logins add on top of that foundation. It examines three documented, verifiable examples of this shift in practice — a major exchange’s passkey-secured smart wallet, the broader Ethereum standard that makes these wallets possible, and a global payments network’s own research into passkey authentication — each with real dates, real institutions, and real reported numbers rather than a vague promise of future adoption. It also takes seriously where this approach still falls short: the questions about device loss, custodial trust, and the tension between making crypto easier and keeping it meaningfully decentralized. None of this suggests seed phrases are about to disappear overnight. It is a look at a genuine, ongoing attempt to make the first ten minutes of using a crypto wallet feel less like a security exam and more like signing into an app, and at how far that attempt has actually gotten.
The Problem: Why Seed Phrases Fail Everyday Users
A seed phrase, sometimes called a recovery phrase or mnemonic phrase, is a sequence of ordinary-looking words, typically twelve or twenty-four of them drawn from a standardized list, that encodes the master private key controlling every asset in a self-custodied wallet. The idea behind it was genuinely elegant when it was standardized in the mid-2010s: rather than asking a person to back up an unreadable string of random characters, encode that same cryptographic information as words a human can write down, read aloud, and re-enter by hand if a device is lost or destroyed. Anyone who possesses those words possesses the wallet, in full, with no password reset, no customer service line, and no third party able to intervene. That last property is precisely the point of self-custody, and it is also precisely what makes the seed phrase such an unforgiving piece of design.
The most common and best-documented failure mode is simple loss. Industry estimates and blockchain analytics firms have repeatedly suggested that a meaningful share of all bitcoin ever mined sits in wallets whose owners can no longer access them, often because a seed phrase was written on paper that got thrown away, damaged, or simply forgotten in a drawer that no longer exists. Unlike a forgotten bank password, there is no identity-verification process that restores access; the cryptography does not know or care who the legitimate owner is, only whether the correct words are presented. A newcomer who treats a seed phrase with anything less than the seriousness of a physical asset — because it does not look like money, it looks like a grocery list — can lose everything in a single moment of carelessness, and that loss is permanent and unappealable. Blockchain-analytics researchers who study wallet activity over time have repeatedly pointed to large clusters of coins that have sat untouched for years in patterns consistent with lost access rather than deliberate long-term holding, and while any single estimate of “how much” is inherently imprecise, the broader pattern is not seriously disputed within the industry: a meaningful and permanent share of circulating supply is effectively gone, not because it was spent or stolen, but because a piece of paper was misplaced.
A second, equally well-documented failure mode is phishing and social engineering aimed specifically at extracting seed phrases. Because the phrase is the wallet, an attacker who convinces a victim to type it into a fake wallet-recovery website, a fraudulent customer-support chat, or a malicious app has instantly and completely compromised that wallet, with no fraud department able to reverse the transaction once it is broadcast. Security researchers and wallet providers have spent years training users on a single rule — never enter your seed phrase anywhere except your own wallet software during initial setup — and that rule is violated constantly, because the entire user experience around seed phrases requires people to occasionally type or photograph a set of words that looks, to an unfamiliar eye, exactly like the kind of thing a legitimate support agent might plausibly ask for.
Beyond loss and theft, seed phrases impose a subtler, more pervasive cost: the psychological burden of constant vigilance. A person who has written down their recovery phrase on paper has to think, indefinitely, about fire risk, flood risk, whether a house guest might find it, whether a photo taken for an unrelated reason might have accidentally captured it in the background, and what happens to that access if they are incapacitated or die without telling anyone where the paper is kept. Financial institutions spent the better part of a century building recovery mechanisms, fraud departments, and legal frameworks specifically to remove this kind of anxiety from everyday money management, and self-custodied crypto wallets, by design, offer none of it. For a security-conscious enthusiast, that tradeoff can feel like a reasonable price for true ownership. For an ordinary newcomer trying to buy a small amount of cryptocurrency out of curiosity, it is frequently the exact moment they decide the whole system is not worth the trouble, and it is the specific gap that passkey-based wallets are built to close.
What Passkeys Actually Are and How They Secure a Wallet
A passkey is, at its foundation, a credential built on public-key cryptography that never requires the user to see, type, or remember a secret. When a passkey is created, the device generates a mathematically linked pair of keys: a public key that gets shared with whatever service the passkey is for, and a private key that never leaves the secure hardware inside the device — a dedicated chip designed specifically to store cryptographic secrets and perform operations with them without ever exposing the raw key material, even to the device’s own operating system. Unlocking that private key to sign in or approve an action requires a biometric check, such as a fingerprint or face scan, or a device PIN, and that unlock happens entirely on the device itself. Nothing about the underlying secret is ever transmitted, typed, or written down anywhere a person could lose or leak it, which is the exact opposite of how a seed phrase works.
The standards underneath passkeys, called WebAuthn and FIDO2, were developed by a coalition of major technology companies specifically to replace passwords across the wider internet, and adoption has been substantial well outside of crypto: banking apps, social media platforms, and operating system logins have all rolled out passkey support over the past several years, meaning most newcomers to a passkey-secured wallet have already used the same underlying interaction — a fingerprint prompt or a face scan — somewhere else in their daily life. That familiarity is itself a meaningful part of the design’s appeal, because it means a crypto wallet’s login screen can look and feel exactly like unlocking any other modern app, rather than presenting a newcomer with an entirely unfamiliar ritual involving numbered word lists.
Bringing a passkey into a crypto wallet specifically, however, requires more than swapping out the login screen, because a passkey by itself is built to authenticate a person to a service, not to directly hold and control blockchain assets the way a seed-derived private key does. Making a passkey do that job requires additional wallet-architecture work — smart-contract wallets that treat the passkey as an authorization signal rather than the asset-controlling key itself, and distributed key-management schemes that split trust across multiple parties so no single device failure becomes a permanent loss. Those two pieces, covered in the next two sections, are what actually let a passkey stand in for a seed phrase without recreating the same all-or-nothing risk in a different form.
This decoupling of authentication from direct asset control is the conceptual hinge the rest of this article turns on, and it is worth stating plainly because it is easy to miss. A traditional crypto wallet collapses two separate jobs — proving who you are, and directly authorizing where funds move — into a single private key, which is precisely why losing that one key is catastrophic. Passkey-based wallets split those jobs apart deliberately, using the passkey to answer the first question and a programmable smart-contract or key-sharing layer to answer the second, and that separation is what makes recovery options, spending limits, and familiar sign-in screens possible without weakening the underlying cryptographic guarantee that only the rightful owner can move assets.
WebAuthn, FIDO2, and Device-Bound Cryptography Explained
WebAuthn is the web standard, and FIDO2 is the broader specification that includes it, defining exactly how a device, a browser, and an online service communicate to create and later verify a passkey. The process a beginner actually experiences is short: a service asks the device to create a passkey, the device’s secure hardware generates the public-private key pair, the public half is sent to the service and stored there, and from that point forward, signing in means the service sends a one-time cryptographic challenge that only the correct private key can answer correctly, without that private key ever leaving the device or crossing the internet in any form. This design is specifically resistant to phishing in a way that passwords and even seed phrases are not, because a passkey is cryptographically bound to the exact website or app that created it. A fake login page built to imitate a real wallet service simply cannot receive a valid response from a passkey created for the genuine service, since the underlying protocol checks the requesting domain automatically, without relying on the user to notice a misspelled web address.
The secure hardware that stores the private key, often called a secure enclave or trusted execution environment depending on the device manufacturer, is a deliberately isolated piece of the device built so that even malicious software running elsewhere on the same phone or laptop cannot extract the raw key material. This is a different threat model than a seed phrase written on paper, where the only risk is physical discovery or loss, and it is also different from a seed phrase typed into password-manager software, where the risk shifts to whatever system stores that entry. A passkey’s private key is designed, from the moment of its creation, to never exist anywhere outside that one piece of isolated hardware, which is precisely why it cannot be phished, copied over the network, or extracted by malware in the way a typed password or a photographed seed phrase can.
For a wallet developer deciding whether to trust this hardware-backed model, the standard also includes a verification mechanism called attestation, which lets a service confirm what kind of secure hardware actually generated a given passkey before relying on it to secure real financial assets rather than simply trusting a device manufacturer’s claims.
Synchronization is the feature that makes passkeys practical for everyday use, and it is also the feature that requires the most careful explanation for anyone coming from a crypto background trained to be suspicious of any key material touching a cloud service. Major device ecosystems now sync passkeys across a person’s own devices through end-to-end encrypted backup systems, meaning a passkey created on a phone becomes usable on that same person’s laptop without the underlying private key ever being visible in plain form to the company operating the sync service. This is a meaningfully different security model than seed-phrase backup, where the phrase itself, once written down or stored digitally, is a single flat secret that grants full access to whoever obtains it; a synced passkey system is built so that even the operator of the sync infrastructure cannot read or reconstruct the private key from what it stores.
Account Abstraction, MPC, and Familiar Logins
Account abstraction, formalized on Ethereum through a standard called ERC-4337 and deployed starting in early 2023, is the piece of wallet architecture that lets a passkey actually control blockchain assets rather than just authenticating a person to a website. Under the older wallet model, a single private key both proved ownership and directly authorized every transaction, which is exactly why losing that key meant losing everything. Account abstraction replaces a simple externally owned key with a smart contract that defines its own rules for what counts as valid authorization — rules that a wallet developer can program to accept a passkey signature, to require a fingerprint check plus a spending limit, or to allow a designated backup device to regain access under specific conditions. The wallet becomes programmable in a way a raw private key never was, which is what opens the door to recovery options, spending limits, and multiple approved devices that a traditional seed-phrase wallet simply cannot offer.
One practical feature that account abstraction unlocks, and that shows up repeatedly in the case studies later in this article, is gas-fee sponsorship through what the standard calls a paymaster. Because a smart-contract wallet’s rules are programmable, a developer can configure it so that an application itself, rather than the new user, covers the small network fee required to process a transaction, which matters enormously for onboarding because a brand-new user typically has no cryptocurrency of any kind yet and would otherwise be stuck unable to pay the fee needed to receive their very first funds. This single feature, made possible only because account abstraction replaced a rigid private key with a programmable contract, removes a chicken-and-egg problem that has frustrated crypto onboarding for years.
Multi-party computation, generally shortened to MPC, tackles the same underlying problem from a different angle and is often used alongside or instead of account abstraction, particularly by wallet providers built for institutions or for apps that want key management to stay entirely invisible to the end user. Rather than a single private key existing anywhere in whole form, MPC mathematically splits the signing process across multiple independent parties — for example, a share held on the user’s device and a share held by the wallet provider’s servers — such that a valid transaction signature can only be produced when a required number of those shares participate together, and no individual share ever reveals the underlying key on its own. This means neither the user’s device alone nor the provider alone can move funds unilaterally, and a lost device does not automatically mean a lost wallet, because the remaining shares, combined with an identity-verification process, can be used to generate a new share and restore access.
Familiar logins are the layer most visible to an actual newcomer, and they ride on top of whichever of these two architectures a given wallet provider has chosen. Instead of the first screen a new user sees being a warning about backing up twelve words, it is an ordinary-looking sign-in screen offering an email address, a phone number, or an existing social media account, followed by a passkey prompt to secure that specific wallet going forward. Behind that simple screen, the wallet provider is typically using the email or social login purely as an identity anchor for account recovery purposes, while the actual signing authority lives in the passkey and, depending on the provider, in an account-abstraction contract or an MPC key-share arrangement. None of this removes cryptographic security from the picture; it relocates where that security lives, moving it from a piece of paper a person must protect indefinitely to hardware and protocols most people already trust with their banking and their photos. Together, WebAuthn’s phishing-resistant, device-bound key storage, account abstraction’s programmable authorization rules, and MPC’s split-trust key management form the practical toolkit that lets a wallet feel like signing into any other app while still resting on genuine cryptographic self-custody rather than a company’s private database of who owns what.
Documented Case Studies in Passkey and Account-Abstraction Wallets
The gap between a compelling pitch for passkey-based wallets and what is actually operating at scale is worth examining carefully, because crypto’s usability narrative has a long history of announcements that outpaced real adoption. Three examples in particular clear a high bar for verification: a major exchange’s passkey-secured wallet product with a specific, recently reported user-count milestone; the broader Ethereum account-abstraction standard with ecosystem-wide usage data published by an independent analytics dashboard; and a global payments network’s own research comparing passkey authentication against older methods, which fed directly into a named commercial product.
It also matters that these three examples span different layers of the same stack rather than simply repeating the same story from three angles. Coinbase’s Smart Wallet is a consumer-facing product that an ordinary person actually opens and taps. ERC-4337 is the shared technical standard operating underneath many such products, including Coinbase’s own, whose health can be measured independently of any single company’s marketing. Visa’s research sits a level above both, evaluating the raw authentication technology on its own security merits, in a context entirely disconnected from crypto adoption goals. Reading the three together, rather than any one in isolation, is what makes it possible to say with real confidence that this shift is happening at the product level, the infrastructure level, and the underlying-technology level all at once, rather than in just one of those places while the others lag behind.
Each of these examples has something the others do not. The wallet-level case study shows what adoption looks like for a single, specific consumer product tied to a real company. The ecosystem-wide standard shows whether the underlying infrastructure is actually being used broadly across many independent applications rather than by one company alone. The payments-network research shows how this technology is being evaluated and adopted by an institution entirely outside the crypto industry, for reasons that have nothing to do with promoting Web3 specifically and everything to do with reducing fraud and improving checkout completion. Taken together, they offer a more complete picture than any single example could on its own, and each is grounded in dated, named, independently reported figures rather than a company’s own marketing language about future potential.
Coinbase Smart Wallet and the Base App Surge
Coinbase, one of the largest cryptocurrency exchanges in the United States, first previewed its passkey-secured Smart Wallet in February 2024 and then launched the full product in June 2024, built as an addition to its existing Coinbase Wallet software development kit. The pitch was direct: a developer building any decentralized application could let a brand-new user create a fully functional crypto wallet using nothing but a passkey — no browser extension to install, no app to download in advance, and no seed phrase to generate or write down at any point in the process. Under the hood, Smart Wallet is built on account-abstraction architecture, meaning the passkey authorizes a smart contract wallet rather than directly controlling a traditional private key, which is what allows Coinbase to layer in features like optional gas-fee sponsorship so a new user’s very first transaction does not require them to already own cryptocurrency to pay network fees.
For roughly a year after launch, Smart Wallet grew steadily but without the kind of headline adoption numbers that would settle the question of whether passkey-based onboarding actually changes user behavior at scale. That changed in the second half of 2025. On-chain analytics tracked through Dune dashboards showed total Smart Wallet account creations crossing 1,074,277 in August 2025, with the growth heavily concentrated around the mid-July 2025 launch of Coinbase’s reimagined Base app, an all-in-one wallet, social, and payments product built on Coinbase’s Base network. Roughly 270,000 new Smart Wallet accounts were created on a single day, August 16, 2025, marking one of the largest single-day account-creation spikes the product had recorded, and the Base app rollout alone was reported to account for close to 279,000 of the new accounts, or roughly one quarter of the total wallets ever created.
What makes this case study meaningful is not simply that a large company reported a large number, but that the surge tracked so closely to a specific, dated product change — the Base app’s mid-July 2025 launch — rather than to generalized market conditions or a broad crypto price rally that might have driven wallet creation regardless of onboarding method. A newcomer downloading Base to try its social and payment features could create a working, passkey-secured wallet as an incidental part of using the app, with no separate seed-phrase ritual required at any point, and the account-creation data suggests a meaningful share of people did exactly that. Coinbase has separately described its own internal data showing that passkey-based signups for Smart Wallet complete in roughly fifteen seconds, compared to several minutes for the traditional seed-phrase wallet-creation flow, a gap that helps explain why bundling wallet creation into an ordinary app experience, rather than treating it as a distinct and intimidating setup step, appears to meaningfully change how many people follow through.
It is also worth noting what Smart Wallet’s growth curve looked like before this spike, since a single surge tied to one app launch could otherwise be mistaken for the whole story. Coinbase built Smart Wallet as an open addition to its existing Wallet software development kit specifically so outside developers, not just Coinbase’s own apps, could integrate passkey-based onboarding into their own decentralized applications, and a portion of the account growth prior to the Base app rollout came from exactly that kind of third-party integration rather than from Coinbase-owned products alone. The concentration of growth around the Base app launch shows how much a single, well-distributed consumer app can accelerate an already-growing base, rather than showing that adoption depended entirely on that one moment.
Ethereum’s ERC-4337 Standard: Ecosystem-Wide Adoption Data
Where the Coinbase example shows adoption for one company’s product, the broader account-abstraction standard that underlies it, known as ERC-4337, shows whether the same underlying technology is gaining traction across the wider Ethereum ecosystem rather than in one walled garden. ERC-4337 was deployed to the Ethereum mainnet in March 2023, and because it was designed to work without requiring any change to Ethereum’s core protocol, it was quickly adopted by a range of independent wallet providers, decentralized applications, and infrastructure companies rather than remaining tied to a single sponsor. BundleBear, an independent analytics dashboard that tracks account-abstraction activity across Ethereum and its layer-2 networks, has published detailed, dated usage figures that make it possible to evaluate this adoption with real numbers rather than a general sense that “account abstraction is growing.”
According to BundleBear’s 2024 Year in Review report, more than 103 million so-called UserOperations — the account-abstraction equivalent of a standard blockchain transaction — were executed across 2024, more than ten times the 8.3 million recorded in 2023. Monthly activity peaked at 18.4 million UserOperations in August 2024 before declining to 9.8 million by December, a pattern consistent with a technology moving through an initial adoption surge rather than settling immediately into steady, mature usage. Nearly 20 million new ERC-4337 smart accounts were deployed during 2024 alone, contributing to a cumulative total of more than 40 million smart accounts deployed across Ethereum and its layer-2 networks since the standard’s introduction, with Polygon, Base, and Optimism among the networks carrying the largest shares of that activity. Bundler services, the infrastructure layer responsible for processing and submitting account-abstraction transactions to the network, collectively processed 59 million bundled transactions over the year, with Coinbase’s own bundler alone handling more than 30 million UserOperations, a figure that connects directly back to the Smart Wallet activity described in the previous section.
The network distribution of this activity is itself informative, because it shows account abstraction spreading across separate ecosystems with different priorities rather than concentrating on one chain built specifically to showcase the standard. Polygon, a network historically focused on low-cost payments and enterprise partnerships, carried more than 7 million smart accounts, the largest share of any single network, while Base and Optimism, both layer-2 networks in the broader Ethereum family, followed close behind, and most new accounts during the year were deployed using a standardized wallet template called Alchemy’s LightAccount factory, which accounted for 58 percent of new deployments and suggests a meaningful degree of shared infrastructure and tooling across otherwise-independent projects rather than each application building its own account-abstraction system from scratch.
The same report is notably candid about a genuine limitation in this data: the majority of smart accounts created in 2024 transacted only once, a pattern BundleBear’s analysts attribute partly to users farming token-incentive programs and airdrop-style rewards rather than adopting these wallets for sustained, ordinary use. Monthly active accounts that transacted more than once peaked at 1 million in October 2024, a meaningfully smaller number than the tens of millions of total accounts created, and a useful reminder that raw account-creation figures can overstate genuine, lasting adoption if read without this context. Even accounting for that caveat, a tenfold year-over-year increase in transaction volume, tens of millions of new smart accounts, and adoption spread across multiple independent networks and bundler providers together describe a standard that has moved well past experimental status and into infrastructure that a substantial share of the Ethereum ecosystem now actively relies on.
Visa’s Passkey Research and the Payment Passkey Service
The third case study comes from entirely outside the crypto industry and is arguably the most telling, precisely because Visa has no particular interest in promoting Web3 adoption; its interest is reducing payment fraud and cart abandonment across its existing card network. Visa conducted an internal analysis of VisaNet transaction data globally across July through December 2023, comparing outcomes when biometric authentication was used for a security step-up against outcomes when the same step-up relied on a one-time passcode sent by text message, the older and still extremely common method of confirming a cardholder’s identity during an online purchase. The finding Visa has publicly reported from that analysis is direct: biometric authentication reduced fraud rates by as much as 50 percent compared to SMS-delivered one-time passcodes, a substantial difference for a network processing the volume of transactions Visa handles globally.
That research fed directly into a named, dated commercial product. Visa introduced its Payment Passkey Service, built on the same FIDO and WebAuthn standards described earlier in this article, unveiling the service at its 2024 Payments Forum and positioning it as a direct replacement for password- and text-message-based checkout authentication. The stated motivation, drawn from Visa’s own public materials, centers on a specific, well-documented problem: fraud rates on online, card-not-present transactions run roughly seven times higher than fraud rates on in-person purchases, precisely because a stolen password or an intercepted text message is comparatively easy for a criminal to obtain, while a passkey tied to a specific device’s secure hardware is not. By letting a cardholder confirm an online purchase with the same fingerprint or face scan they already use to unlock their phone, Visa’s service aims to close a meaningful share of that gap between online and in-person fraud rates, while also reducing the checkout friction that causes some legitimate shoppers to abandon a purchase rather than dig up a one-time code.
Visa is not a crypto company, and the Payment Passkey Service is not a crypto wallet, but its relevance to Web3 onboarding is direct rather than incidental. It demonstrates, through a large, independent institution’s own fraud data rather than a crypto company’s marketing claims, that the core security case for passkeys over older authentication methods holds up under real transaction volume, and it shows one of the world’s largest payment networks committing to the exact same underlying standard that Coinbase’s Smart Wallet and the broader ERC-4337 ecosystem are built on. For a technology sometimes dismissed as a crypto-industry talking point, having a payments giant with no Web3 agenda reach the same conclusion, using its own data, is a meaningful form of independent validation that the wallet-specific case studies alone cannot provide.
The specific comparison Visa evaluated also deserves a moment of attention, because it goes directly to a claim made throughout this article about why passkeys are more secure than what came before them. SMS-delivered one-time passcodes, the method Visa measured its biometric results against, are vulnerable to a well-documented category of attack in which a criminal reroutes or intercepts a victim’s text messages, often by tricking a mobile carrier into transferring a phone number onto a device the criminal controls. A passkey is not vulnerable to that particular attack at all, because there is no message sent anywhere for an attacker to intercept; the cryptographic proof of identity never leaves the legitimate device in the first place. Visa’s fifty-percent fraud-reduction figure is, in that sense, a direct measurement of how much damage that one specific, well-understood attack category was doing before passkey-style authentication closed it off.
Benefits by Stakeholder: Everyday Users, Developers, and Institutions
The advantages of passkey-based, account-abstracted wallets look different depending on who is evaluating them, and understanding those differences helps explain why adoption is happening from several directions simultaneously rather than through a single top-down push. For a first-time newcomer with no prior crypto experience, the most immediate benefit is simply that wallet creation no longer requires an intimidating, unfamiliar ritual before any actual use of the product can begin. Signing in with an existing email address or social account, then securing that wallet with the same fingerprint check used to unlock a phone, removes the specific moment — writing down and safely storing twelve unfamiliar words — that has historically caused a large share of curious newcomers to abandon the process before ever completing it. Coinbase’s own reported figure of roughly fifteen seconds for a passkey-based signup, against several minutes for the traditional flow, reflects exactly this kind of friction reduction, and friction reduction of that magnitude tends to show up directly in completion rates for any onboarding flow, not just a crypto-specific one.
Existing crypto users, who are generally more tolerant of seed phrases because they have already learned to manage them, still gain something meaningful from this shift: a wallet architecture that supports account recovery options a traditional seed-phrase wallet cannot offer at all. Because account abstraction lets a wallet’s authorization rules be programmed rather than fixed, a user can set up a designated recovery device, a spending limit that requires additional confirmation above a certain amount, or a delay period on large transfers that gives them a window to cancel a transaction if their device is compromised, none of which is possible when a single private key is the entire security model. This matters particularly for anyone who has previously experienced or narrowly avoided losing access to a wallet, since it converts self-custody from a strictly all-or-nothing proposition into something closer to the layered protections people are used to from traditional financial accounts, without necessarily handing custody back to a third party.
Application developers building on top of these wallet standards benefit from a substantially lower barrier to bringing new users into their specific product. A decentralized application that previously required a visitor to already have a separate wallet browser extension installed, funded with cryptocurrency to cover network fees, and comfortable navigating unfamiliar seed-phrase prompts, can instead let that same visitor create a working wallet inline, during their very first visit, with fees optionally covered by the application itself through gas-sponsorship features built into account-abstraction infrastructure. The BundleBear ecosystem data described in the previous section, showing adoption spread across gaming, social, and decentralized finance applications rather than concentrated in one category, reflects exactly this kind of developer-driven pull, where teams building consumer products chose account abstraction specifically because it removed onboarding steps that were costing them users before those users ever reached the actual product.
Institutions sitting outside the crypto industry entirely, exemplified by Visa’s own research and product development, benefit in a different but related way: passkey infrastructure gives them a path toward supporting crypto-adjacent features, such as self-custodial wallet interactions layered on top of existing card networks, without having to build or vouch for an entirely new authentication system from scratch. Because passkeys were already being adopted across banking, e-commerce, and device manufacturers for reasons that have nothing to do with crypto, an institution like a payments network or a traditional bank can extend features into the Web3 space using a security model its compliance and fraud teams already understand and trust, rather than being asked to evaluate an unfamiliar crypto-specific technology on its own merits. This lowers the internal approval burden considerably, since a fraud or compliance team can point to the standard’s track record across banking and e-commerce rather than assessing an unfamiliar technology from scratch. Across all of these groups, the shared thread is that passkey-based wallets do not ask any particular stakeholder to take a leap of faith in an unproven, crypto-only innovation; each group benefits from a mature, independently validated authentication standard being extended into a new context, which is a meaningfully easier sell than convincing an institution or a first-time user to trust something built specifically and only for crypto.
Risks, Tradeoffs, and Open Questions
None of the benefits described above eliminate genuine, unresolved questions about this approach, and the most immediate of them concerns device loss and recovery. A seed phrase, for all its drawbacks, has one clarifying property: it is entirely independent of any single device, so a phone being lost, stolen, or destroyed has no bearing on wallet access as long as the phrase itself survives. A passkey, by contrast, is generated and stored inside a specific device’s secure hardware, which means the recovery story for a lost device depends entirely on whichever synchronization or backup system a particular wallet provider has built. Passkeys synced through a major device ecosystem’s encrypted backup service generally survive a single lost device without incident, but a person who loses access to their entire synced ecosystem at once — through a compromised or deleted account, for instance — faces a recovery process that varies significantly by provider and is nowhere near as standardized as the seed-phrase backup process it replaces.
A second, closely related concern is the custodial trust question raised by account-abstraction and MPC architectures specifically. When a wallet provider’s servers hold one share of an MPC key split, or when a smart-contract wallet’s authorization logic includes a provider-controlled recovery path, that provider is, in a meaningful if limited sense, back in the position of a party that must be trusted, even if it never holds enough of the key material to move funds unilaterally on its own. This is a deliberate and disclosed tradeoff in most well-built systems, not a hidden flaw, but it does mean that a user evaluating a passkey-based wallet needs to understand exactly what role the provider plays in that specific wallet’s architecture, since the answer varies considerably from one product to another and a system with weaker guarantees can look, from the outside, identical to one with much stronger ones. Independent security audits and published documentation of exactly how a given provider’s recovery path works are the main tools available to a cautious user trying to tell the two apart, and their absence should itself be read as a warning sign rather than a neutral gap.
Cross-device and cross-platform compatibility remains a genuine, unresolved friction point as well. Passkey synchronization generally works well within a single device ecosystem but has historically been less seamless when a user wants to move between different ecosystems entirely, and a wallet built around a specific provider’s account-abstraction infrastructure on one blockchain network does not automatically carry over to a different network without additional engineering work on the provider’s part. A newcomer who created a Smart Wallet through Coinbase’s Base app, for example, is using an experience specifically built around Coinbase’s infrastructure and Base’s network, and while the underlying standards are open and other providers have built comparable systems, the experience of moving assets or identity between fundamentally different wallet providers is nowhere near as frictionless as the initial onboarding these systems are designed to streamline.
Finally, there is a deeper, more philosophical tension between this approach and the decentralization principles that motivated self-custody in the first place. Part of what made seed phrases uncompromising was precisely that no company, government, or third party could ever be positioned between a user and their assets; every mechanism that makes recovery easier — a designated backup device, a provider-assisted MPC reconstruction process, a spending-limit rule enforced by a smart contract — necessarily reintroduces some structure that did not exist in the pure, no-recovery-possible model. The BundleBear retention data discussed earlier, showing that most accounts created in 2024 transacted only once, is a useful reminder that easier onboarding does not automatically translate into sustained, meaningful usage, and that the harder work of building products people actually want to keep using remains separate from, and in some ways more difficult than, the onboarding problem this article focuses on. Passkey-based wallets appear to have made real, measurable progress on getting people through the front door; whether that progress converts into lasting engagement with self-custodied crypto, rather than a one-time wallet created to claim a reward and then abandoned, is a question the data available so far cannot fully answer.
Final Thoughts
The most significant thing passkey-based wallets have demonstrated so far is not that crypto has become simple, but that its historic complexity was never as unavoidable as it looked. For years, the seed phrase stood in as both the security foundation of self-custody and, unintentionally, the single biggest reason ordinary people never got past the first screen. Separating those two roles — keeping the cryptographic guarantees of self-custody while removing the specific, unforgiving ritual that made it feel like a test only specialists could pass — turns out to have been an engineering problem with a real answer, not a permanent tradeoff baked into how blockchains have to work. That answer arrived by borrowing infrastructure the rest of the internet had already spent years building and testing for entirely unrelated reasons, which is itself a notable departure from crypto’s more usual habit of building bespoke, unfamiliar systems from scratch.
The broader implications reach further than convenience for any single new user. Financial inclusion arguments around cryptocurrency have always run into an uncomfortable contradiction: a technology pitched as more accessible than traditional banking, especially in regions with limited banking infrastructure, has historically demanded a higher bar of technical literacy and risk tolerance to use safely than the traditional systems it claims to improve on. A person with a smartphone but no bank account, precisely the population many Web3 inclusion arguments are aimed at, is exactly the person least equipped to safely generate, transcribe, and permanently protect a seed phrase with no institutional safety net if something goes wrong. Passkey-based onboarding, riding on biometric hardware that now ships in even modestly priced smartphones, narrows that gap in a way that matters far beyond any single company’s user-growth numbers; it moves self-custody closer to something a person can adopt safely without first becoming their own security expert.
That shift carries real social responsibility alongside its promise. A wallet architecture that quietly reintroduces provider trust through account-abstraction recovery rules or MPC key shares needs to be honest about exactly what it is offering, because a newcomer drawn in by a simple, familiar login screen may not appreciate the specific tradeoffs of the system underneath unless the industry building these products commits to explaining them clearly rather than letting “no seed phrase” stand in as an implicit claim of no risk at all. The institutions best positioned to build that trust responsibly are not necessarily the ones with the flashiest onboarding numbers, but the ones willing to disclose plainly where recovery authority actually sits.
Looking forward, the more durable test of this technology will not be how many wallets get created in a single day when a popular app launches, but whether the people who create them keep using self-custodied crypto for genuine reasons months and years later, long after any signup incentive has expired. The infrastructure examined throughout this article — device-bound cryptography, programmable authorization, split-trust key management — has cleared the technical hurdle of making that first step feel ordinary. Whether it becomes the foundation for a genuinely more inclusive financial system, or simply a smoother front door to the same small circle of existing crypto users, depends on choices the industry has not yet fully made.
FAQs
- What is a passkey, in simple terms?
A passkey is a digital credential built on public-key cryptography that lets you sign in or approve an action using your device’s biometric check, such as a fingerprint or face scan, instead of a password or a typed secret. The cryptographic key itself is generated and stored inside your device’s secure hardware and never has to be seen, typed, or written down by you. - How is a passkey different from a seed phrase?
A seed phrase is a flat, portable secret that anyone who obtains it can use to fully control a wallet, which is why it must be written down and guarded indefinitely. A passkey’s private key never leaves the secure hardware of the device that created it and cannot be typed, copied, or phished the way a seed phrase can, though this also means recovery depends on device and account backup systems rather than a single physical object you control directly. - Can a passkey-secured wallet really replace a seed phrase entirely?
In products built on account abstraction or multi-party computation, yes, in the sense that a user never has to generate, write down, or enter a seed phrase to create or use the wallet. The underlying cryptographic security still exists; it is restructured around device-bound keys and programmable smart-contract rules rather than a single exportable phrase. - What is account abstraction, and why does it matter for passkey wallets?
Account abstraction, standardized on Ethereum as ERC-4337, replaces a simple private key with a smart contract that can define its own rules for valid authorization, such as accepting a passkey signature or allowing a backup device under specific conditions. This programmability is what lets a passkey control a blockchain wallet safely, since a raw passkey by itself is designed to authenticate to a website, not to directly hold blockchain assets. - What is multi-party computation and how does it help with wallet recovery?
Multi-party computation, or MPC, splits the wallet’s signing authority across multiple independent parties, such as a share on the user’s device and a share held by the wallet provider, so that no single share reveals the full key and a valid transaction requires a required number of shares acting together. This means a lost device does not automatically mean a lost wallet, since the remaining shares can be used, alongside identity verification, to help restore access. - Is Coinbase’s Smart Wallet actually being used, or is it mostly a marketing announcement?
It is genuinely in use. On-chain data tracked through Dune dashboards showed Smart Wallet account creations crossing 1,074,277 by August 2025, with a surge tied to the mid-July 2025 launch of Coinbase’s Base app, including roughly 270,000 new accounts created on a single day, August 16, 2025. - How much has Ethereum’s account-abstraction standard actually grown?
According to BundleBear’s 2024 Year in Review, more than 103 million UserOperations were executed in 2024, over ten times the 8.3 million recorded in 2023, alongside nearly 20 million new smart accounts deployed that year. The same data shows a retention challenge, since most accounts created in 2024 transacted only once. - Why would a company like Visa, which has nothing to do with crypto, care about passkeys?
Visa’s own analysis of VisaNet transaction data from July through December 2023 found that biometric authentication reduced fraud rates by as much as 50 percent compared to SMS-based one-time passcodes. That finding led directly to Visa’s Payment Passkey Service, unveiled at its 2024 Payments Forum, aimed at reducing the roughly sevenfold higher fraud rate seen in online purchases compared to in-person transactions. - What are the biggest risks or downsides of passkey-based crypto wallets?
The two most significant are device and account recovery, since losing access to an entire synced device ecosystem is a less standardized problem than losing a seed phrase, and the reintroduction of some provider trust through account-abstraction recovery rules or MPC key shares, which is a deliberate tradeoff but one that varies considerably in strength from one wallet provider to another. - Does easier onboarding mean more people are sticking with self-custodied crypto long term?
The evidence so far is mixed. Passkey-based onboarding has clearly reduced the friction of creating a wallet, reflected in Coinbase’s reported fifteen-second signup time and the account-creation surges described in this article, but BundleBear’s data shows that most accounts created in 2024 transacted only once, suggesting that easier onboarding has not yet fully solved the separate challenge of sustained, meaningful usage.