Hot wallet vs cold wallet

The difference between a hot wallet and a cold wallet is where the keys live. A hot wallet keeps its private keys, the secret numbers that authorize spending, on a device connected to the internet. A cold wallet keeps them offline.

What is a hot wallet?

A hot wallet is software on a phone, a computer or a web browser. Mobile apps and browser extensions are the common forms. Because the device is online, the wallet can check balances, connect to apps and send payments in seconds. Most are free.

The weakness is exposure. Keys held on an everyday device share it with email, downloads and web browsing. Malicious software, a fake app or a phishing site, meaning a copy of a real site built to steal credentials, can reach them without the thief ever touching the device.

What is a cold wallet?

A cold wallet generates and stores keys on something that stays offline. The most common form is a hardware wallet, a small device that signs transactions internally and passes only the signature to a computer or phone. Older methods include keys printed on paper and a computer that is never connected to a network, known as an air-gapped machine.

A remote attacker cannot copy a key that is never online. The price is convenience. Each payment means fetching the device, connecting it and confirming on its screen, and a hardware wallet costs money.

Who uses which?

In practice the two are used together, much as people carry some cash and keep the rest in a bank.

• Individuals often keep small amounts for regular use in a hot wallet and move larger, long-term holdings to cold storage.
• Exchanges and custodians generally hold most customer assets in cold storage and keep a smaller working balance in hot wallets to pay withdrawals. Many exchange hacks have drained those hot wallets.
• Companies and funds often add a multisig arrangement, which requires several keys to approve a transfer.

Is a cold wallet completely safe?

No. Cold storage defends against one threat, the remote theft of a key. It does not help if the owner loses the seed phrase, the list of words that backs up the wallet, or stores it where a thief, fire or flood can reach it.

It also does not stop the owner from approving a harmful transaction. A hardware wallet will sign whatever its user confirms, including a transfer to a scammer or a permission that lets a malicious app drain tokens. Many thefts now rely on deceiving the person and leave the key itself untouched.

The terms are also looser than they sound. A seed phrase photographed on a phone or saved to a cloud account is online, whatever device the keys were made on. Cold storage is only as cold as its backup.