Cold Wallet vs Hot Wallet
Offline hardware vs internet-connected apps. Security, trade-offs, practical hybrid.
SK
Short answer
Hot wallet = internet-connected (MetaMask, exchange accounts, mobile apps). Convenient, exposed to remote attack. Cold wallet = offline hardware device (Ledger, Trezor, ColdCard). Requires physical access to compromise. Most users should use both: cold for savings, hot for active use, split based on what you can afford to lose.
The temperature spectrum
"Cold" and "hot" aren\'t binary — they describe a spectrum of internet exposure:
| Type | Example | Internet exposure |
|---|---|---|
| Exchange custody | Coinbase, Binance | Fully hot (exchange keys online 24/7) |
| Mobile/browser wallet | MetaMask, Rabby, Rainbow | Hot (keys on your device, which is online) |
| Hardware wallet (USB) | Ledger, Trezor | Semi-cold (keys on device, connected only when signing) |
| Air-gapped hardware | ColdCard, Keystone, Foundation Passport | Cold (never connects to internet; QR/SD-card signing) |
| Paper wallet / steel | Written seed, steel plate | Fully cold (no electronic device) |
| Multi-sig with distributed keys | Casa, Unchained | Cold (multiple physical devices, distributed) |
Attack vectors by temperature
Hot wallet attacks
- Phishing (fake websites that harvest seed phrase)
- Clipboard hijackers (malware that replaces pasted addresses)
- Malicious smart-contract approvals (sign and lose permissions forever)
- Compromised browser extensions
- Compromised device OS
- SIM swap attacks against SMS 2FA
- Exchange-level breach (if using custodial)
Cold wallet attacks
- Physical theft + PIN/passphrase coercion
- Supply-chain attack at manufacturer (Ledger 2020 customer data breach)
- $5 wrench attack (physical violence against the holder)
- Social engineering to get you to export seed to a hot device
- Phishing that tricks you into signing a malicious transaction on the hardware wallet\'s display
- Flawed firmware (rare but has happened — specific chip-level vulnerabilities patched)
Net: cold wallet eliminates ~90% of remote-attack vectors but introduces physical-risk vectors. For most users, the net is dramatically safer for significant holdings.
When to use which
Use a hot wallet (hardware not required) for…
- Active DeFi interaction (swapping, LP, lending)
- Amounts you can afford to lose — think of it as a checking account
- Testing new protocols or airdrops before moving larger positions
- Day-to-day spending
Use a cold wallet for…
- Long-term holdings beyond ~$1-5k
- Assets you don\'t need to move for months or years
- Crypto you\'d regret losing to a phishing link
- Inheritance-planning positions (see crypto inheritance planning)
Multi-sig for large positions
For holdings beyond ~$100k, single-hardware-wallet cold storage has a single-point-of-failure risk (lost seed, deceased holder without inheritance plan, coerced signing). Multi-sig (2-of-3 or 3-of-5) distributes keys across geographies and people. Services like Casa and Unchained provide professional multi-sig coordination.
Practical hybrid setup
- Buy a hardware wallet (ColdCard for BTC-only, Ledger/Trezor for multi-coin, see best crypto wallets).
- Set it up in an offline environment. Write seed phrase on paper; consider steel backup (Cryptosteel, Billfodl).
- Store seed backup separately from the device — different physical location. Consider split (Shamir SLIP-39).
- Move all long-term holdings to the hardware wallet.
- Maintain a hot wallet (Rabby + exchange account) with only active-use amounts.
- Never type your seed into a computer, never take a photo of it, never save in a password manager.
- For >$100k, upgrade to multi-sig via Casa or Unchained.
- Document everything for inheritance (see crypto inheritance planning).
Common misconceptions
- "Hardware wallets are unhackable." They\'re dramatically more secure, but not unhackable. Supply-chain, firmware, physical-coercion vectors exist.
- "An exchange is as safe as my bank." Your bank has FDIC/FSCS deposit insurance on cash. Crypto at an exchange has no equivalent. Platform bankruptcy converts you to unsecured creditor.
- "Paper wallets are outdated." Paper wallets with a single seed backup are weaker than hardware wallets because they\'re typically created on a potentially-compromised machine. Modern best practice: hardware wallet + steel seed backup.
- "If I lose my hardware wallet, my crypto is lost." No — you restore from the seed phrase on any new hardware wallet. The device itself is not the asset; the seed is.
Related
Frequently asked questions
What is the difference between a cold wallet and a hot wallet? +
A hot wallet is any wallet connected to the internet: mobile apps (MetaMask, Rabby, Rainbow), browser extensions, exchange accounts (Coinbase, Kraken). A cold wallet keeps private keys on an air-gapped device with no internet connection: hardware wallets (Ledger, Trezor, ColdCard, Keystone), paper wallets (written seed phrases), or steel-plate seed backups. Hot wallets are convenient but exposed to remote attacks; cold wallets require physical access to compromise.
Which is safer? +
Cold wallets, by a significant margin. Hot wallet compromise vectors: phishing, malware on your computer/phone, clipboard hijackers, malicious smart-contract signatures, compromised exchange. A remote attacker can drain a hot wallet without physical presence. Cold wallet compromise requires either physical theft of the device + PIN knowledge, or supply-chain attack at manufacturing (rare but documented — Ledger had a data breach in 2020 exposing customer addresses). For significant holdings, cold storage is standard practice.
Do I need both? +
Most users should, yes. The practical hybrid: cold wallet for long-term holdings (the savings portion), hot wallet for active use (the checking portion). Split based on how much you can afford to lose to a remote compromise — typically $1,000-5,000 in a hot wallet is acceptable for active use; larger amounts to cold. This mirrors how people used to split cash between a wallet and a safe.
Is a hardware wallet actually cold? +
Technically yes when stored offline, but during transaction signing it's briefly connected (via USB, Bluetooth, NFC, or QR codes). The distinction: the private keys never leave the hardware wallet during that process. Even when connected, the key is not transmitted. Pure air-gapped devices (ColdCard, Keystone) use QR codes or SD cards to sign without USB — further reducing attack surface. "Cold" is a spectrum; hardware wallets are dramatically colder than software wallets.
What about exchange custody? +
Exchange custody is the hottest custody model from a user-security perspective — you don't control keys, the exchange does. Your security depends entirely on the exchange's operational security and solvency. Good for active trading and small spending balances; wrong for long-term savings. See <a href="/what-happens-if-crypto-bank-goes-bankrupt/">what happens if a crypto bank goes bankrupt</a> for the platform-risk dimension.
Which hardware wallet should I buy? +
For BTC-only holders: ColdCard (US, most paranoid design) or BitBox02 BTC-only. For BTC + ETH + multi-coin: Ledger Nano S Plus / Nano X / Stax (most polished, supports broadest coin list), Trezor Safe 5 (open source firmware, premium), Keystone 3 Pro (air-gapped, QR-based signing). For institutional / multi-sig: Coldcard + Unchained/Casa service layer. See <a href="/best-crypto-wallets/">best crypto wallets</a> for full comparison.
Can a hot wallet ever be safe enough? +
For amounts you can afford to lose, yes. Best-practice hot wallet setup: dedicated device (not your daily-driver laptop), fresh browser profile, hardware 2FA key (YubiKey) for any exchange account, no browser extensions installed beyond the wallet, never click links from Twitter DMs or Discord. Rabby wallet offers better security UX than MetaMask by default (clear transaction preview, spoofing detection). For amounts over a few thousand dollars, move to cold.