A hot wallet stays online for convenience; a cold wallet keeps keys offline for security. Compare risks, uses, and trade-offs.
Hot wallet vs cold wallet comes down to one question: whether your private keys are connected to the internet. Because a hot wallet keeps its keys on an online device, it is quick to use and exposed to remote attacks. A cold wallet keeps them offline (slower to use, and far harder to reach from the other side of the world).
On its own, neither one is the “right” wallet. Most of the confusion around hot vs cold storage comes from treating them as rival products, when the real question is where each part of a holding should sit and who should be responsible for it. In the sections below, this guide compares the two, including a 2025 case where cold storage failed.
The difference between a hot wallet and a cold wallet is where the private keys live. A hot wallet stores them on an internet-connected device, such as a phone app, browser extension, or exchange account. For a cold wallet, they stay offline, usually on a hardware device. Online keys are easier to use; they are also easier to attack.
| Feature | Hot wallet | Cold wallet |
|---|---|---|
| Where keys are stored | Online device (phone, computer, browser, exchange) | Offline device or backup |
| Internet connection | Always or usually connected | Connected only briefly, or never |
| Speed of use | Instant | Slower; requires the device |
| Exposure to remote attacks | Higher (malware, phishing, server breaches) | Much lower |
| Main risks | Hacking, phishing, compromised devices | Loss, damage, theft, signing mistakes |
| Cost | Usually free | Hardware wallets cost money |
| Typical use | Frequent, smaller transactions | Holdings kept for longer periods |
In wallet terms, temperature describes the connection, not who controls the keys. A hot wallet can be custodial, like an exchange account, or non-custodial, like a phone app where you hold the recovery phrase. Once you keep those two questions separate, most wallet comparisons become much easier to read.
A hot wallet is any crypto wallet whose private keys sit on an internet-connected device. Phone apps and exchange accounts both count. Because they make sending, receiving, and trading fast, most people start with one; for the same reason, hot wallets are the main target for online theft, from simple phishing links to large exchange breaches.
On a phone or computer, a wallet app generates keys and stores them in the device's storage, protected by a passcode. If you hold the recovery phrase yourself, it is a non-custodial wallet as well as a hot one. Even so, the keys are only as safe as the device. Phones could get lost, hacked, or stolen.
Browser wallets connect directly to decentralized exchanges and other blockchain apps. For most users, that connection is the whole point. It is also the risk: a malicious site can present a transaction that looks routine but grants another contract permission to move your tokens, and that permission can stay active for months after you have forgotten about it.
Crypto left on a trading platform sits in the platform's wallets (typically a mix of hot and cold), with the platform holding the keys. You get convenience and account recovery. In return, your holdings depend on that business staying solvent and secure.
Every hot wallet shares one weakness: an attacker never needs to be in the room. From anywhere in the world, malware, fake apps, phishing links, and server breaches can reach it. For money you plan to leave untouched for years, that exposure is hard to justify.
A cold wallet is a crypto wallet that keeps its private keys offline, out of reach of remote attackers. In most cases, that means a hardware wallet: a small device that signs transactions internally, so the keys never touch a connected computer. For the full range of offline methods, see our guide to cold storage.
A hardware wallet connects to a phone or computer only when you want to send funds. Once the transaction is prepared on the connected device, the hardware wallet approves and signs it internally. Checking the address on the device's own screen is the step that matters most; skip it, and much of the protection disappears.
Writing a recovery phrase on paper, or stamping it into metal, is also a form of cold storage. Of the two, metal survives fire and water far better. Neither one can sign a transaction, though, so both work as backups and not as wallets you use day to day, and a phrase stamped into steel is only as safe as the place you keep the steel.
Some setups never go online. Instead of a cable, an air-gapped device passes transactions back and forth by QR code or memory card. It is the most isolated option and the least convenient, which is why it tends to appear only in portfolios holding massive amounts of cryptocurrencies.
A cold wallet is safer against remote attacks, but it is not immune to theft. On February 21, 2025, attackers took about $1.5 billion from the Bybit exchange during a transfer out of its cold wallet, according to BleepingComputer. The keys stayed offline; the attackers changed what the signers saw.
According to the same report, the attack worked through a compromised developer machine at the wallet software provider, which let the attackers disguise a malicious transaction as a routine one inside the signing interface. The FBI attributed the theft to North Korea. Nobody broke the cold storage itself. Instead, people approved a transaction that was not what it appeared to be.
For an individual investor, the lesson scales down neatly. A hardware wallet protects the key, but it cannot stop you from approving the wrong request. Reading the address and amount on the device's own screen (not only on your computer) closes most of that gap.
Beyond signing mistakes, cold wallets carry risks that hot wallets do not. A device can break, get lost, or be stolen along with a poorly hidden recovery phrase, and a phrase with no backup turns a broken device into a permanent loss of every coin it controlled.
Hot and cold storage usually work together as two tiers: a smaller hot balance for day-to-day activity and a larger cold balance for holdings that rarely move. Exchanges run the same model. By design, the split limits how much is exposed online at any moment without making every transaction slow.
How much sits in each tier depends on how often you transact and how much you could stand to lose from the hot side. For many people, the more useful question is whether the cold tier should be managed by themselves or by a qualified custodian.
Between the two sits a third option. With institutional custody, a specialist custodian secures assets using multi-party computation (MPC), where no single party ever holds a complete key. You avoid exchange hot-wallet exposure without taking on sole responsibility for a device and a recovery phrase.
Choosing between a hot and a cold wallet comes down to how often you move the funds, how much is at stake, and how comfortable you are managing a device and recovery phrase. Frequent activity favors hot wallets. Over long holding periods, cold storage tends to fit better. In practice, most people use both.
For a step-by-step setup, see our guide to storing crypto safely.
The most common mistakes with hot and cold wallets have little to do with the wallet itself. Keeping savings in a hot wallet, storing a recovery phrase digitally, and trusting a computer screen over a device screen cause more losses than any flaw in wallet design. Once you know them, each one is easy to fix.
Yes, a hardware wallet is the most common type of cold wallet. It stores private keys on a dedicated device and signs transactions inside it, so the keys never reach an internet-connected computer. When you send funds, the device connects briefly, but the keys themselves stay offline throughout.
Remote hacking of a properly used cold wallet is very difficult, because the keys never go online. In practice, the realistic risks are physical theft, a tampered device, a leaked recovery phrase, or approving a manipulated transaction. The 2025 Bybit theft of about $1.5 billion came from exactly that last category.
Mostly, yes. Crypto held in an exchange account is controlled by the exchange, which keeps part of its reserves in hot wallets for withdrawals and part in cold storage, and it decides for itself how that split is managed. As a customer, you do not hold the keys, so your holdings depend on the exchange's security and solvency.
Not necessarily, but many people use both. In that setup, a hot wallet handles frequent transactions and blockchain apps, while cold storage holds longer-term assets. Someone who rarely transacts may only need cold storage or qualified custody. Because the right mix depends on your activity and circumstances, it is a personal decision.
If a hardware wallet breaks, your crypto is still on the blockchain, and you can restore access on a new device, from the same maker or a compatible one, using your recovery phrase. The device is replaceable; the phrase is not. Without a backup of the phrase, a broken or lost hardware wallet means the funds are permanently inaccessible.
Hot wallets are widely used for small, everyday amounts, and the risk is easier to accept when the balance is limited. Even so, safety depends on habits: official app downloads, strong device security, careful transaction approvals, and a protected recovery phrase. Treat a hot wallet the way you treat cash in your pocket.
Deciding where each part of a holding should sit is easier with someone to talk it through. UpTrade is a dedicated crypto brokerage built around real relationships, not a self-serve app.
Read more about our custody approach.
UpTrade is an AUSTRAC-registered digital currency exchange provider (DCE100856266-001). You can verify registered providers at austrac.gov.au.
This article is for general informational purposes only and does not constitute financial, investment, or tax advice. Cryptocurrency investments carry significant risk, including the possible loss of principal. Past performance is not indicative of future results. UpTrade does not make investment recommendations based on your personal financial circumstances. You should conduct your own research and seek independent financial advice before making any investment decisions.
General information only. This article is for educational purposes and does not constitute financial, investment, legal or tax advice, nor a recommendation to buy, sell or hold any asset. Cryptocurrency is a high-risk asset and you should consider your own circumstances and seek independent advice before making any decision. UpTrade does not make price predictions.
Market updates, new explainers and the occasional Alpha Pro report, sent once a week. Unsubscribe anytime.