Hot wallets vs cold storage

Some product links in this guide are affiliate links. How that works.

Where your keys live decides how they can be stolen. A hot wallet keeps keys on a device connected to the internet. Cold storage keeps them on a device that never connects. Both have a place, and most people end up using both.

Hot wallets

A hot wallet is an app on your phone or computer. The keys sit on that device, which is online.

Good for: spending money, small amounts, learning. Risk: if the device is infected with malware, or you install a fake app, the keys can be stolen remotely.

Think of a hot wallet like the cash in your pocket. Convenient, and you’d never keep your savings there.

Cold storage

Cold storage keeps keys on a device that has never been, and will never be, connected to the internet. To spend, you build a transaction on an online computer, carry it to the offline device to sign, then carry the signed version back to broadcast.

Good for: savings, anything you’d hate to lose. Risk: mostly user error. Losing backups, not testing recovery, mistakes during setup.

What “air-gapped” means

An air-gapped device has no link to any network. Not Wi-Fi, not Bluetooth, and ideally not even a USB data connection to an online computer.

Data moves across the gap in one of two ways:

• QR codes: the online computer shows a QR on screen, the offline device scans it with a camera, and the reverse. Nothing is physically connected.
• microSD cards or USB sticks: a file is carried across by hand. This works, but a storage device can carry malware, so QR is preferred when available.

A hardware wallet that plugs into your computer by USB isn’t fully air-gapped, but it’s still far safer than a hot wallet, because the keys never leave the device.

Your options, from simplest to strongest

Option	Keys live on	Air-gapped	Cost
Exchange account	The exchange’s servers	No	Free
Phone or desktop app	Your online device	No	Free
USB hardware wallet	A dedicated device	Partly	~$80–200
Air-gapped hardware wallet	A dedicated device	Yes	~$80–350
DIY signer (SeedSigner)	Nowhere; scanned in each time	Yes	~$50–70
Offline laptop with Tails	A computer that never goes online	Yes	$0–250
Multisig (2-of-3)	Three devices in three places	Yes	~$600+

How much security do you need?

Ask one question: would losing this amount change your life?

• No, it would just sting: a good hardware wallet or a SeedSigner, with a steel backup, is plenty.
• Yes: look at 2-of-3 multisig, so no single lost device, stolen backup or bad vendor can cost you everything.

Whatever you pick, keep a small hot wallet for spending and the rest cold.

Watch-only wallets

You don’t need the cold device to check your balance. Wallet software like Sparrow can import a watch-only version of your wallet. It sees your balance and creates receive addresses, but it holds no private keys and can’t spend. You keep it on your normal computer and only bring out the cold device to sign.

Next steps

• Practice on signet with free coins before choosing.
• Compare four complete builds in Four ways to build a cold wallet.
• Or compare devices directly: Hardware wallets compared.