The Difference Between Hot and Cold Wallets
A hot wallet keeps private keys on an internet-connected device for quick access, while a cold wallet keeps them offline to cut the risk of remote theft. Most people end up using both.
On this page 10
A hot wallet stores your private keys on an internet-connected device such as a phone, computer or browser, while a cold wallet keeps them isolated from the internet, usually on a dedicated hardware device. The core difference is a trade-off between convenience and security: hot wallets make everyday transactions fast, cold wallets make long-term storage of larger amounts much safer.
In both cases your coins live on the blockchain, not on the device. A crypto wallet only manages the keys that let you spend them, so “hot” and “cold” describe where those keys sit and where transactions get signed.
What is a hot wallet?
Hot wallets include mobile apps like Trust Wallet and Phantom, browser extensions like MetaMask and Rabby, and desktop software. They’re free, take minutes to set up and connect to DeFi apps in a click. Exchange accounts are technically hot storage too, except that the exchange, not you, holds the keys.
The weakness of a hot wallet is that the key lives on a device that’s always online. Malware, fake apps, malicious browser extensions or a misleading signature request can all put funds at risk. A device PIN helps, but if your recovery phrase is stolen, an attacker can simply restore the wallet on their own device.
What is a cold wallet?
The most common cold wallets are hardware wallets from makers like Ledger and Trezor. You prepare a transaction on your computer or phone, but the signature is produced inside the device and the private key never leaves it. You check the recipient and amount on the device’s own screen and confirm with a physical button.
Less common forms of cold storage include signing on a computer that never connects to the internet, and paper wallets. Paper wallets are largely impractical today: to spend from one, you have to import the key into a hot device, which undoes most of the benefit.
Hot vs cold wallets at a glance
- Where the key lives: on an online device (hot) or an offline one (cold).
- Cost: hot wallets are usually free; hardware wallets have to be bought.
- Speed: hot wallets sign in seconds; cold wallets require connecting and confirming on the device every time.
- Remote attack risk: higher for hot wallets, much lower for cold.
- Best for: hot wallets suit spending money and app experiments; cold wallets suit savings and large balances.
Does a cold wallet remove all risk?
No. A cold wallet makes remote key theft much harder, but it doesn’t solve three problems. The first is your recovery phrase: anyone who gets it can restore your wallet without touching your device, so how you store your seed phrase matters as much as the hardware.
The second is what you approve. Malware on your computer can swap the recipient address, and if you confirm without checking the device screen, the money goes to the attacker. The third is token approvals: if you use a hardware wallet to give a contract an unlimited token allowance, that contract can spend those tokens later without asking your device again.
Should I use a hot or cold wallet?
A simple rule of thumb: money you can’t afford to lose belongs in cold storage, and the small balance you use day to day belongs in a hot wallet. For example, you might keep savings on a hardware wallet that you top up monthly, and use a separate hot wallet for DeFi experiments and small payments.
One technical detail matters when you split things up: in many wallet apps, “add account” derives a new address from the same recovery phrase. If you want truly separate risk, create a new phrase for your experimental wallet. For funds shared between several people or a company, a multisig setup is a better fit.
How to use a hot wallet more safely
If you need a hot wallet, a few habits cut the risk considerably:
- Keep the balance small: hold only what you expect to use soon and move the rest to cold storage.
- Keep the device clean: update your operating system and wallet app, and avoid pirated software and browser extensions you don’t recognize.
- Install from the right source: use the link on the developer’s official site rather than a search ad.
- Read what you sign: check the site’s address and the permission being requested, and don’t approve anything you don’t understand.
- Clean up approvals: every few months, revoke token approvals for apps you no longer use.
None of this makes a hot wallet as safe as a cold one, but most everyday losses are the kind these habits prevent.
How to move crypto from a hot wallet to a cold wallet
- Buy the hardware wallet directly from the manufacturer or an authorized reseller, and check that the packaging hasn’t been tampered with.
- Set it up as a new device and write down the fresh recovery phrase it generates. Don’t import your old hot wallet phrase: that key has already lived on an online device, which defeats the point of cold storage.
- Send a small test amount to the new address, verifying the address on the device screen.
- Once the test arrives, move the rest, choosing the correct network for each token.
- If anything stays in the old wallet, review its token approvals. They don’t follow you to the new address, but they remain live on the old one.
What is a watch-only wallet?
You don’t need a private key to see a balance. A watch-only wallet shows your cold wallet’s holdings on your phone without any power to spend them. Seeing your hardware wallet balance in a mobile app therefore doesn’t mean the key is on your phone; when you want to spend, the signature still has to come from the device.
Frequently asked questions
If my hardware wallet breaks, do I lose my crypto?
No. Your coins are on the blockchain, so as long as you have the recovery phrase you can restore access on a new device or a compatible wallet. If both the device and the phrase are gone, there’s no way back.
Does a cold wallet ever connect to the internet?
A hardware wallet connects to a computer or phone over USB or Bluetooth when you transact, but the private key never leaves the device. The connected device simply broadcasts the already-signed transaction.