Hot Wallets vs Cold Wallets: Where Your Crypto Keys Should Live

A hot wallet is a crypto wallet whose private keys are stored on a device that's connected to the internet, such as a phone app, a browser extension or an account on an exchange. A cold wallet stores the private keys on a device that stays offline, typically a hardware wallet, and signs transactions without the key ever touching a networked computer. Both can hold the same coins. What changes is how easy the keys are to use and how easy they are to steal.

What is the difference between a hot wallet and a cold wallet?

Start from what a wallet actually is. Your coins don't live in it. They live on the blockchain as balances tied to an address, and the wallet holds the private key that can sign transactions from that address. Whoever holds the key controls the coins. ethereum.org puts it simply: the wallet is a tool for managing your account, and the account is the thing on-chain.^[1]

Hot and cold describe where that key sits. Hot means the key is on a device that talks to the internet: a phone, a laptop, a browser, a server. Cold means the key is on a device that doesn't. A hardware wallet plugged into your laptop is still cold, because the key never leaves the secure chip; the laptop sends an unsigned transaction in and gets a signed one back. An air-gapped wallet goes further and never plugs in at all, passing transactions by QR code or memory card.

The distinction is separate from custody. An exchange account is a hot wallet you don't control. MetaMask is a hot wallet you do. A Ledger is a cold wallet you control; an exchange's cold storage vault is a cold wallet you don't. Hot or cold is about attack surface. Custodial or self-custody is about who holds the key, and the guide to self-custody covers that axis in full.

How a hot wallet works

A hot wallet is software. Browser extensions (MetaMask, Rabby, Phantom), mobile apps (Trust Wallet, Coinbase Wallet, Phantom again) and desktop clients all generate a seed phrase, derive private keys from it, and store those keys encrypted on the device behind a password. When you sign, the software decrypts the key in memory, signs the transaction and broadcasts it. It's fast, it's free, and it's the interface most DeFi apps expect.

Exchange accounts are hot wallets too, from the exchange's side. The exchange keeps a float of coins in internet-connected wallets to process withdrawals, and those are the wallets that get hit when an exchange gets hacked. The exchange failures guide runs the history.

The weakness is structural. Any key that exists on an internet-connected device can be reached by anything else that runs on that device. Malware that reads browser storage, a fake wallet update, a phishing page that asks for the seed, a clipboard hijacker that swaps the address you pasted: all of these are attacks on the host, and the hot wallet has no defense against a compromised host.

How a cold wallet works

A cold wallet keeps the private key on hardware built for one job. Hardware wallets from Ledger, Trezor, Coldcard, BitBox and Keystone store the key in a secure chip, show the transaction details on their own screen, and sign only when you physically confirm on the device. The connected computer sees the unsigned transaction going in and the signed one coming out. It never sees the key, so malware on the computer can't copy it.

Air-gapped variants remove the cable entirely. Coldcard and Keystone, among others, accept an unsigned transaction by QR code or microSD card, sign it offline, and hand back a signed transaction the same way. Paper wallets and metal seed plates are the extreme end: no device at all, just the seed phrase stored physically and restored into a device only when you need to move funds. bitcoin.org has recommended for years that savings sit in an offline wallet with the spending balance kept separate.^[2]

Cold doesn't mean the wallet can't touch DeFi. A hardware wallet paired with MetaMask or Rabby can sign any transaction a hot wallet can. It just does the signing on the device. Some people call that setup a warm wallet, since the key is cold but the interface is hot. The catch is that the device can only protect you from what it can show you. Confirm a transaction you don't understand, and cold storage signs it just as faithfully.

Hot vs cold wallets side by side

Which is safer?

Cold, for the threat that matters most. The bulk of crypto stolen from individuals goes through compromised hot wallets: drainer scripts on phishing sites, malicious approvals, infostealer malware, fake support agents asking for the seed. A hardware wallet doesn't make those attacks impossible, but it removes the easiest route, which is copying the key. An attacker has to trick you into signing something instead of just taking it.

Cold wallets have their own failure modes, and they're physical rather than digital. A lost or destroyed device is fine if the seed phrase is backed up and a disaster if it isn't. A seed phrase photographed and synced to cloud storage turns the cold wallet hot without you noticing. A device bought secondhand or from an unofficial reseller can arrive pre-seeded by the seller. And no hardware protects against the person who confirms a transaction on the device without reading what it says. ethereum.org's security page is blunt about the common thread: most losses come from people being tricked, not from cryptography being broken.^[3]

So "safer" splits. Against remote theft, cold wins clearly. Against your own mistakes, both are unforgiving, and the cold wallet adds the risk of locking yourself out through a bad backup. That's why the seed phrase rules in the self-custody guide matter more than the choice of device.

How do hot wallets get hacked?

The methods are worth knowing, because they're the reason cold storage exists.

Malicious approvals and signatures. On EVM chains, a token approval lets a smart contract spend tokens from your wallet. A phishing site dressed up as an airdrop or a mint asks you to sign an approval, and a drainer contract empties the approved tokens. Off-chain signature standards make this worse, because a single signed message can authorize a transfer without an on-chain approval showing up first. Checking and revoking approvals through a blockchain explorer is basic hygiene.

Seed phrase phishing. Fake wallet apps, fake browser extensions and fake support channels ask for the 12 or 24 words. Anyone who has them has everything.

Malware on the device. Infostealers target browser extension storage and clipboard contents. Address poisoning sends dust from an address that looks like one you've used before, hoping you'll copy it from your history later.

Exchange compromise. If the hot wallet is an exchange account, the attack surface includes SIM swaps against your phone number, credential stuffing, and the exchange's own infrastructure. The hack news impact guide covers how those events ripple through prices.

How do cold wallets fail?

Bad backups. The seed phrase is the wallet. A device can be replaced; a lost seed can't. Paper burns, ink fades, and a single copy in a single location is a single point of failure.

Seed exposure. Typing the seed into a computer, photographing it, or storing it in a password manager converts the cold wallet into a hot one. Every one of those has led to drained wallets.

Supply chain. A tampered device, a counterfeit, or a box with a pre-printed seed card inside. Buy from the manufacturer, and generate your own seed on first setup.

Blind signing. Complex DeFi transactions can show as opaque data on a small screen. Confirming what you can't read hands the attacker the same power a hot wallet would. The Bybit theft in early 2025, about $1.5 billion, came from a multisig wallet whose signers approved a transaction that a compromised interface displayed incorrectly. The keys were never stolen. The signatures were.

Physical coercion. The wrench attack: someone who knows you hold crypto forces you to sign. A passphrase that opens a separate hidden wallet and multisig setups that need more than one device are the standard mitigations for large holdings.

Which should you use?

Both, in most cases, with the split set by how much you hold and how often you move it.

You hold a small amount and use it. Hot wallet. If the balance is smaller than the price of a hardware wallet, or you'd shrug at losing it, a well-maintained hot wallet on a clean device is fine.

You hold more than you'd be comfortable losing. Cold wallet for the bulk, with the seed phrase backed up in at least two physical locations. The common rule of thumb is that once a balance is worth several times the price of a hardware device, the device has paid for itself.

You're active in DeFi. A hot wallet funded with the working balance, and a hardware wallet paired to the same interface for anything larger. Keep the two on separate seeds, so a drained hot wallet can't reach the cold one.

You trade on a centralized exchange. The exchange account is a custodial hot wallet. Keep the trading balance there and withdraw the rest. The CEX vs DEX guide covers why an exchange is for trading rather than storage.

You manage funds for a group or a business. Multisig with hardware wallets as signers. No single device or person should be able to move everything.

You're holding for years and rarely transacting. Cold, with a rehearsed recovery. Restore the seed onto a second device once, so you know the backup works before you need it.

The short version: the hot wallet holds what you'd carry in your pocket, and the cold wallet holds what you'd put in a safe. Whichever you choose, the seed phrase is the thing that controls the funds. Protect it like the money it is.