A hot wallet keeps your private keys on a device that connects to the internet. A cold wallet keeps them on one that does not. That is the entire distinction, and everything else follows from it: hot wallets are convenient and permanently exposed to remote attack; cold wallets are inconvenient and effectively immune to it.
Two things muddy this in practice. The first is that it is a spectrum, not a switch. The second is that most people confuse it with a completely different question — so let us clear that one up first, because getting it wrong is expensive.
The confusion that costs people money
Hot versus cold is about where the keys are. Custodial versus self-custody is about whether you have keys at all. They are independent, and the second matters more.
| You hold the keys | Someone else holds them | |
|---|---|---|
| Online | Mobile or browser wallet | Exchange account |
| Offline | Hardware wallet, air-gapped signer | Custodian’s deep storage |
Coins on an exchange are not “in your hot wallet”. You do not have a wallet there. You have a claim against a company, and its balance page is a promise. That promise fails through insolvency, fraud, freezes and compliance holds — risks that no amount of hot-versus-cold thinking touches.
So the first question is not “hot or cold” but “am I actually holding this”. Only once you hold your own keys does the rest of this page apply.
The real spectrum
From most exposed to least:
- Browser extension wallet. Keys on a machine that browses the web. Maximum convenience, maximum exposure. Every malicious site and extension is a candidate attacker.
- Mobile wallet. Somewhat better — phone operating systems sandbox apps more aggressively than desktops — but still a connected, general-purpose device.
- Hardware wallet over USB or Bluetooth. The device connects, but the keys never leave it. Still cold, despite the cable.
- Air-gapped signer. The device has no data connection at all; transactions move by QR code or SD card. Removes even the theoretical attack surface of the USB stack.
- Keys that exist only on paper or metal. Maximally cold, and unusable until imported somewhere — at which point the security is whatever you imported into.
Point 3 is where people get confused. Plugging a hardware wallet into an infected computer does not make it hot. The whole design is that the machine sends an unsigned transaction and receives a signature back — the key never crosses the cable. That is why a hardware wallet works at all.
What each is actually good for
Hot wallets earn their place for money you are actively using: paying for things, trading, interacting with applications, anything needing sign-off in seconds. Their failure mode is theft. Their strength is that funds are never stranded by a lost device.
Cold wallets are for money you are holding rather than spending. Their failure mode is loss — the device breaks, the backup was never tested, nobody knows it exists after you die. Notice these are the failures a hot wallet is less prone to, which is why the answer for most people is not one or the other.
The two-wallet setup
The arrangement that works for almost everyone:
- A hot wallet holding what you would not mind losing. A month of spending, an amount you would be annoyed but not damaged by losing. Treat it as a physical wallet in your back pocket.
- A cold wallet holding the rest, touched rarely, with a tested backup in two locations.
This gets you the convenience where convenience matters and the security where the money is. It also caps the damage of the most common disaster — connecting to a malicious application and approving something you should not have. That approval can drain a hot wallet, and it cannot touch a cold one you never connected.
Keep them genuinely separate. Two accounts derived from the same recovery phrase are one wallet wearing two hats: whoever compromises the phrase gets both. Separate wallets mean separate phrases.
Where cold storage does not help
Worth being blunt, because “move it to cold storage” is offered as universal advice and it is not:
- It does not protect a leaked recovery phrase. Cold storage protects the key from the network. The written phrase is the same key, and a photograph of it is as good as the coins.
- It does not stop you approving a bad transaction. If you connect the device and sign a hostile approval, it signs.
- It does not survive phishing. Anyone persuaded to type their phrase into a convincing page has defeated their own cold storage.
- It increases the odds of loss. The rarer you touch a wallet, the more likely the backup has quietly rotted, the passphrase is misremembered, or nobody else knows it exists.
Cold storage trades a risk you are unlikely to face for one you very much are. That trade is usually worth it — but only if you take the loss side seriously, which means testing the backup and telling someone it exists.
Rules of thumb
- Anything you would be genuinely hurt to lose does not belong on an exchange.
- Anything you are not spending this month does not belong in a hot wallet.
- Anything in cold storage needs a tested backup before it goes there, not after.
- The amount in your hot wallet should be an amount you can name out loud without flinching.
And the rule that outranks all of them: nothing on either side of this divide ever requires you to type your recovery phrase into a website. No exchange, no wallet, no support agent, no migration tool. Not us either.