Can you lose crypto in a cold wallet?

Yes, you can lose crypto in a cold wallet, but usually not in the way people expect. A cold wallet, such as a hardware wallet, holds the private keys that control your coins, while the coins themselves stay on the blockchain. Most losses come from the backup or from what the owner approves, rather than from the device failing.

What happens if you lose your cold wallet?

Ledger notes that your crypto is not stored on the device. If it is lost, stolen or broken, you can restore your accounts on a new compatible wallet with your recovery phrase. A thief also faces a PIN: Ledger devices wipe themselves after three wrong attempts, and the wipe does not touch funds on the blockchain.

Trezor still advises treating a lost device as a possible threat. Its suggested steps are to set up a new wallet with a new backup, send a small test amount, then restore the old wallet and move everything to the new one. Our guide to what happens if your hardware wallet breaks covers the restore process in more detail.

How does a cold wallet seed phrase backup affect your risk?

The backup is where most permanent losses happen. Trezor says a lost backup cannot be regenerated. If you still have a working device, you can make a new wallet and move your funds before anything else goes wrong. If you lose both the device and the backup, Trezor says the accounts cannot be recovered.

A passphrase adds protection but also risk. With one set, nobody can open the wallet without it, even with the device and the backup. If you forget it, Trezor says no one can recover it. The other risk runs the opposite way: anyone who finds your written phrase can take the coins without ever touching the device. See what happens if you lose your seed phrase for more on that case.

Can a cold wallet be hacked?

Pulling keys out of a well-made device is hard, but a cold wallet still signs whatever its owner approves. In February 2025, attackers stole about $1.5 billion from the exchange Bybit, and the FBI attributed the theft to North Korea. Reports say it targeted Bybit's Ethereum multisig cold wallet. Investigators said malicious code was planted in the Safe{Wallet} web interface, which put a disguised transaction in front of the signers. The case is covered in what is the biggest crypto hack.

The same pattern can hit individuals. If a fake website or app asks you to approve something your device cannot show clearly, you may sign away funds. This is why blind signing is a known risk.

What are the main cold wallet risks?

• Losing the recovery phrase together with the device
• Forgetting a passphrase
• Someone else finding the written backup
• Approving a malicious transaction or token approval
• Buying a tampered device or entering your phrase into a fake app

Cold storage protects keys from online theft, not from backup mistakes or bad signatures.