Hot Wallet vs Cold Wallet: Which One Do You Actually Need?
A hot wallet is connected to the internet. A cold wallet is not. Here is what that difference actually protects you from, what it does not, and how to split your crypto between the two.
A hot wallet is a crypto wallet whose private keys sit on an internet-connected device. A cold wallet keeps those keys on something that never goes online.
That is the entire distinction. Everything else follows from it.
The practical version most people land on: use a hot wallet for the money you spend and a cold wallet for the money you keep. You do not have to pick one.
This article explains what each type actually protects you from, why the hot and cold split is a different question from who holds your keys, and the honest case against cold wallets that most guides skip.
What Is a Hot Wallet?
A hot wallet stores your private keys on a device that connects to the internet: a browser extension, a phone app, a desktop program.
MetaMask, Rabby, Rainbow and Coinbase Wallet are all hot wallets. So is any wallet built into an exchange app.
Being online is not a flaw. It is the feature. Because the keys are reachable by software on your device, a hot wallet can sign a transaction the instant you approve it, which is what makes it possible to use a dapp, swap a token, or mint an NFT at all.
The cost is exposure. Anything that can run code on your phone or laptop is one step away from your keys. That includes malware, a malicious browser extension, and a clipboard hijacker that swaps the wallet address you pasted.
Hot wallets are free, instant to set up, and work with everything.
What Is a Cold Wallet?
A cold wallet stores your private keys on a device that never connects to the internet. The standard form is a hardware wallet: a small USB or Bluetooth device from a company like Ledger or Trezor.
“Cold storage” and “cold wallet” mean the same thing. So does “air-gapped,” which describes a device with no network hardware at all.
Here is the part that matters, and the part most explanations get slightly wrong. A hardware wallet does not hide your keys from your computer. It never gives them to your computer in the first place.
When you send ETH from a hardware wallet, your laptop builds the unsigned transaction and passes it to the device. The device shows you the details on its own screen, you press a physical button, and the device sends back a signature. The private key never leaves it.
That is why a compromised laptop cannot drain a hardware wallet by itself. It can ask the device to sign something, but a human has to look at the screen and press the button.
Cold wallets cost roughly $79 to $399 and require you to physically have the device to move funds.
Hot Wallet vs Cold Wallet: Side by Side
| Hot wallet | Cold wallet | |
|---|---|---|
| Where keys live | Phone, browser, or computer | Dedicated offline device |
| Internet connected | Yes | No |
| Cost | Free | ~$79 to $399 |
| Setup time | Minutes | 20 to 30 minutes |
| Remote theft by malware | Possible | Blocked by design |
| Signing a transaction | A click | Physical button press on the device |
| Works with dapps and DeFi | Directly | Yes, through a hot wallet interface |
| Risk if the device is lost | Recover from seed phrase | Recover from seed phrase |
| Risk if you lose the seed phrase | Total loss | Total loss |
| Best for | Spending, experimenting, small balances | Long-term holdings |
Two rows in that table deserve attention because they are the ones people misread.
Losing the device is not losing the money. Both wallet types are recoverable from the seed phrase. The device is a container, not the asset. Buy a new one, enter the phrase, and the funds are there.
Losing the seed phrase is losing the money, in both cases. Cold storage does not protect you from your own record-keeping. It moves the risk rather than removing it.
Hot vs Cold Is Not the Same Question as Custodial vs Non-Custodial
These two distinctions get used interchangeably and they are genuinely different axes.
Hot versus cold is about where the keys live: online or offline.
Custodial versus non-custodial is about who holds the keys: a company or you.
Cross them and all four combinations exist:
| Custodial (company holds keys) | Non-custodial (you hold keys) | |
|---|---|---|
| Hot | Coinbase or Kraken account balance | MetaMask, Rabby, Rainbow |
| Cold | An exchange’s own reserve storage | Ledger, Trezor, air-gapped setups |
The bottom-left cell is the one that surprises people, and it is the answer to a question a lot of beginners ask.
Is Coinbase a Hot or Cold Wallet?
Both, and the distinction depends on whose perspective you are taking.
Coinbase itself keeps the large majority of customer crypto in its own cold storage. That is standard practice at every major exchange, because an exchange holding billions online would be the largest target on the internet. Exchanges keep a smaller hot wallet float to process withdrawals.
But that cold storage is Coinbase’s cold storage, not yours. From your side, your Coinbase balance behaves like a hot account: reachable with a password, a phone, and a login. Your security depends on your account credentials and on Coinbase staying solvent and cooperative.
So “my crypto is in Coinbase’s cold storage” is true and is not the same protection as holding a cold wallet yourself. Exchange cold storage protects Coinbase from hackers. It does not protect you from losing account access, from a frozen withdrawal, or from the company failing.
Coinbase Wallet, confusingly, is a separate product: a non-custodial hot wallet with its own seed phrase. Same brand, opposite custody model. The custodial versus non-custodial guide walks through why that split exists.
Why Do People Say Not to Use Cold Wallets?
This question comes up often enough to deserve a straight answer instead of a reflex. There are four real arguments, and one of them got much stronger in 2026.
1. Offline does not mean flawless. In July 2026 attackers began draining Coldcard hardware wallets by exploiting a build configuration error in firmware version 4.0.1, released back in March 2021. On affected devices the wallet fell back to a weak software random number generator instead of the hardware entropy source when it first generated the seed, collapsing effective key strength from a designed 128 bits to as little as 40 bits. Attackers simply brute-forced the resulting keys.
The critical detail is that this required no physical access and no network connection to the victim’s device. The keys were guessable from the moment they were created. TRM Labs traced roughly 1,816 BTC, about $116 million, from more than 5,200 addresses across four waves in four days; TechCrunch reported the running total above $130 million across at least 7,300 wallets. Estimates vary by source and by the date the count was taken.
The lesson is precise, and it is not “cold wallets do not work.” Being offline defends against your keys being stolen over a network. It does nothing about your keys being badly generated in the first place. Those are different failures, and only the first one is what “air-gapped” buys you.
2. Buying one puts your name and address on a list. In August 2026 Trezor disclosed that a third-party shipping provider had been breached, exposing customer order data. Trezor’s own statement confirmed names, emails, phone numbers and shipping addresses for affected orders, and Bloomberg reported in September that the incident widened to around 67,000 more US customers. No device, seed phrase, or coin was touched. What leaked was the knowledge that a specific person at a specific address owns crypto, which is raw material for targeted phishing and, at the extreme, physical threats. Ledger’s 2020 customer data breach produced years of exactly that.
3. You become your own single point of failure. No support line can restore a lost seed phrase. A meaningful share of all lost crypto was lost this way, not stolen.
4. It adds friction that people route around. A cold wallet you find annoying is a cold wallet you will leave empty while your real balance sits in a hot wallet “temporarily.”
None of that is an argument for keeping life savings in a browser extension. It is an argument for treating a cold wallet as one layer rather than a solved problem. Buy direct from the manufacturer, generate the seed on the device yourself, verify the device is genuine, keep firmware current, and back the phrase up properly.
Should You Put XRP, or Any Other Coin, in a Cold Wallet?
The hot and cold question is identical on every chain. Nothing about Bitcoin, XRP, Solana, or Ethereum changes the logic: keys offline are harder to steal remotely than keys online.
The only thing that varies is support. Check that your specific device handles the coin you hold before you buy, because coverage differs between models and firmware versions. Ledger and Trezor both publish searchable asset lists.
Two practical notes that apply regardless of chain. First, a hardware wallet holding ETH still needs ETH for gas to move anything, so do not sweep the balance to exactly zero. Second, if you hold assets on several networks, confirm you are sending on the right one. Every EVM-compatible chain uses the same address format, so a valid address tells you nothing about whether you picked the right network.
What Are the Best Cold Wallets?
Two manufacturers dominate, and either is a defensible first purchase.
| Device | Price | Notes |
|---|---|---|
| Trezor Safe 3 | ~$79 | Open source firmware, secure element |
| Ledger Nano S Plus | ~$79 | USB-C, no Bluetooth |
| Ledger Nano Gen5 | ~$179 | E Ink touchscreen, NFC |
| Trezor Safe 5 | ~$169 | Color touchscreen |
| Trezor Safe 7 | ~$249 | Quantum-ready secure element |
The main tradeoff is philosophical. Trezor’s firmware is fully open source, which means the code can be independently audited. Ledger’s secure element firmware is closed, which Ledger argues is what lets it resist physical extraction attacks. Both positions are reasonable and both companies have had security incidents.
A bigger screen matters more than the spec sheets suggest. The whole security model rests on you reading the transaction on the device before pressing the button, and a two-line display makes that harder than a touchscreen does.
Our Ledger guide and Trezor guide cover setup, the MetaMask connection, and a direct comparison. The wallets guide has the full current lineup and pricing for both.
How to Split Your Crypto Between Hot and Cold
The standard approach is two wallets with two jobs.
The hot wallet is your checking account. Fund it with what you expect to spend or experiment with over the next few weeks. Connect it to dapps freely. Treat every balance in it as money you could lose to a bad signature without it changing your year.
The cold wallet is your savings account. It holds the bulk. It connects to as little as possible. Ideally it signs a handful of transactions a year.
Pick your hot wallet ceiling as a number, not a feeling, and move the excess out on a schedule rather than when you remember. The number that works is the largest amount you would be genuinely fine losing.
This structure also limits the damage from the mistake that actually drains most beginners, which is not a hacked device. It is approving a malicious token approval that lets a contract move your tokens later. A hot wallet holding $200 turns that into a lesson. Review and revoke standing approvals periodically at revoke.cash.
How to Move Funds From a Hot Wallet to a Cold Wallet
- Set up the cold wallet first. Initialize the device and let it generate the seed phrase itself. Never accept a device that arrives with a phrase already written down, which is a known scam.
- Write the seed phrase on paper or metal. Not a photo, not a notes app, not cloud storage. Store it somewhere that survives fire and water.
- Get the receiving address from the device. Confirm the full address on the device’s own screen, not just in the app on your computer.
- Send a small test transaction. A few dollars. Confirm it arrives before anything else moves.
- Send the rest. Verify the whole address again, and never copy an address out of your transaction history, because address poisoning attacks seed lookalike addresses there specifically to be copied.
- Confirm the balance on the device.
Step 4 is the one people skip and the one that catches wrong networks, wrong addresses, and unsupported assets while the stakes are still trivial.
Common Mistakes
Buying secondhand. A used hardware wallet can be tampered with. Buy from the manufacturer.
Storing the seed phrase digitally. A cold wallet with its phrase in a screenshot is a hot wallet with extra steps.
Keeping the only backup in one place. Fire and flood do not care about your key strength.
Assuming cold means unattended. Firmware updates carry security fixes. The Coldcard failure was a firmware bug that sat unnoticed for five years.
Confirming on the computer instead of the device. The device screen is the only display malware cannot rewrite. Using it is the entire point of owning one.
The Short Version
A hot wallet trades security for access. A cold wallet trades access for security. Neither is a mistake and most people who hold a meaningful amount end up with both.
If you are holding an amount you would be upset to lose, a cold wallet is worth the $79 and the afternoon. If you are holding $50 and learning how Ethereum works, a hot wallet is the right tool and you are not being reckless.
The thing that decides your outcome is not which device you bought. It is whether your seed phrase is backed up somewhere only you can reach, and whether you read the screen before you press the button.
This article is educational and is not financial advice.
Related Reading
- Cryptocurrency Wallets Explained
- Custodial vs Non-Custodial Wallets
- What Is a Seed Phrase?
- Ledger Hardware Wallet Guide
- Trezor Wallet Guide
- Browser Wallet Extensions Compared
- What Is a Crypto Wallet Address?
Sources
- TRM Labs: Inside the $116 million Coldcard hack
- TechCrunch: Hackers steal over $130M by exploiting bug in offline hardware wallets
- Trezor: Recent customer data exposed in shipping provider incident
- Bloomberg: Trezor data breach widens to 67,000 more US customers
- ethereum.org: Crypto wallets
- Ledger product lineup
- Trezor product lineup
