What is the difference between a hot wallet and a cold wallet?

A hot wallet keeps its private keys on an internet-connected device (browser extension, phone app, exchange account). A cold wallet keeps its private keys on a device that never touches the internet directly — typically a hardware wallet like Ledger, Trezor, or Coldcard. Cold storage eliminates the entire category of remote malware attacks.

Can a hot wallet be hacked?

Yes. The vast majority of crypto thefts from individuals happen on hot wallets — via malware, phishing sites, malicious browser extensions, approval scams, or infected devices. Hot wallets are fine for small active balances but are a poor long-term store of value.

Is a hardware wallet completely safe?

Hardware wallets protect against remote key extraction but not against bad signatures. If you connect a hardware wallet to a compromised computer and approve a malicious transaction, funds can still leave. The key protection is the private key never leaving the device; the weak point is what the user approves on-screen.

How much crypto should I keep in a hot wallet?

A common guideline: only as much as you're willing to lose in a single compromise. For most users that's their active trading or spending balance — typically one to a few thousand dollars. Savings-level balances belong in cold storage.

Hot Wallet vs Cold Wallet: Which Should You Use?

The terms "hot" and "cold" describe one thing only: whether the private key ever touches an internet-connected device. That single distinction drives nearly all the security differences between wallet types.

Hot Wallets: What They Are

A hot wallet stores private keys on a device that regularly connects to the internet. Examples:

Browser extensions — MetaMask, Phantom, Rabby, Keplr.
Mobile apps — Trust Wallet, Exodus, Coinbase Wallet, Zerion.
Desktop apps — Exodus desktop, Atomic Wallet, Electrum.
Exchange-held wallets — Coinbase, Binance, Kraken. Technically these are custodial, not self-custody, but for day-to-day purposes they behave like hot wallets.

The conveniences are real: instant access, easy dApp connection, quick swaps, simple mobile UX. But every one of those conveniences is a potential attack path.

How Hot Wallets Actually Get Drained

Investigators see a narrow set of patterns repeat across nearly every hot-wallet theft:

Malware on the host device — clipboard hijackers that swap addresses, keyloggers, stealer malware that scrapes extension storage.
Phishing sites that mimic a real dApp and request a malicious signature or approve transaction.
Fake browser extensions — a MetaMask lookalike uploaded to the Chrome store with a similar name and logo.
Seed phrase leaked via photo, cloud backup, or social engineering ("this is our support team, please verify your wallet…").
Approval phishing — you signed an approve() call that let an attacker's contract move tokens at will. See our wallet drainer guide.

The unifying factor: an internet-connected device held the key, which meant the attacker had a path to it.

Cold Wallets: What They Are

A cold wallet holds its private key on a device that never connects directly to the internet. Transactions are constructed on an internet-connected machine, sent to the cold device for signing, and the signed transaction is broadcast back. The private key itself never leaves the device.

Examples:

Hardware wallets — Ledger, Trezor, Coldcard, Keystone, BitBox, Foundation Passport.
Air-gapped computers — a dedicated laptop that never connects to the internet, running Electrum or similar.
Paper wallets — largely obsolete now, but a key generated and printed offline, never digitally touched until spending.

What Cold Storage Protects Against

Malware on your computer — the key isn't there to steal.
Browser extension compromises.
Clipboard hijacking of private keys.
Accidental seed-phrase exposure through cloud sync of a file.

What It Doesn't Protect Against

Approval phishing. If you sign a malicious transaction on a Ledger, the Ledger signs it. The device trusts what you approve.
Seed phrase compromise. If someone finds or photographs your backup, the hardware wallet is irrelevant.
Supply chain attacks. Buying a used or tampered device from an unauthorized reseller is a real risk. Buy only from the manufacturer or authorized retailer.
Firmware flaws. Rare but not zero — keep firmware updated.

Reality checkWe've investigated Ledger and Trezor drain cases. The device wasn't hacked — the user was phished into approving a malicious transaction, or gave their seed to a fake support rep. Hardware wallets defend against remote key extraction, not user error.

The Practical Split

Most serious crypto users use both, deliberately:

Cold wallet for long-term holdings, savings, life-changing balances. Not connected except when moving funds.
Hot wallet for daily activity: DEX trades, NFT mints, small DeFi positions, spending. Fund it from cold storage only as needed.
Separate hot wallet for risky activity — interacting with unaudited contracts, experimental dApps, airdrops. Keep balances tiny.

The logic: if a hot wallet gets drained, the loss is bounded by what's in it. The cold wallet stays intact because it was never exposed to whatever attack vector caught the hot wallet.

What If You Only Have a Hot Wallet Now?

If you're holding meaningful value in a hot wallet today, the move is straightforward:

Buy a hardware wallet from the manufacturer (not eBay, not Amazon third-party).
Set it up in a clean environment, write the seed on paper, verify the seed by wiping and restoring the device.
Send a small test transaction to the hardware wallet's address.
Move the bulk of your holdings. Keep only your active-use balance in the hot wallet.
See our seed phrase storage guide for how to back up the new seed properly.

Bottom Line

Hot wallets are convenience tools for active balances. Cold wallets are vaults for real savings. Treat them as separate tools with separate purposes, and the size of any single compromise drops dramatically.

If a hot wallet has already been drained, the first 24–72 hours are everything. See our first 72 hours guide for the exact sequence.

← Back to Wallet Security Book Free Consultation →