Cold wallet vs hot wallet

The difference is where the private key lives when you are not using it. In a hot wallet it sits on a device that is online; in a cold wallet it sits on one that is not. Convenience, cost and what can go wrong all follow from that one fact.

What is a hot wallet?

The SEC’s December 2025 investor bulletin on crypto custody defines a hot wallet as a crypto wallet connected to the internet, such as a desktop, mobile or web application. Phone wallet apps and browser extensions fall in this group. The bulletin’s summary of the trade: a convenient way to transact, but one that exposes your assets to cyberthreats.

The term has a second meaning. According to the SEC bulletin, exchanges and other custodians keep customer keys in hot wallets, cold wallets or a mix; Bybit, for example, describes routine transfers from an Ethereum multisig cold wallet to a “warm wallet”. If your coins sit in an exchange account, the exchange decides how much is kept hot, and it holds the keys either way. That is custody, not a wallet you control; see self-custody, explained.

What is a cold wallet?

A cold wallet keeps the key on something that is not connected to the internet. The SEC says it is typically a physical device, with examples ranging from a USB drive or an external hard drive to a piece of paper; dedicated hardware wallets are the devices this site documents. With a hardware wallet, transactions are built in an online app, signed on the offline device and sent back for broadcast. A key kept on paper cannot sign; it has to be loaded into software to spend. The full explanation is in what is a cold wallet?

Cold wallet vs hot wallet: what are the differences?

	Hot wallet	Cold wallet
Where the key lives	In an app on an online phone, computer or browser	Offline, typically on a separate physical device
How you approve a payment	Usually in the wallet app	Depends on the setup; hardware wallets with their own screen let you review details on the device
Examples of risks	Malware, phishing and malicious apps on the same device	Phishing, an exposed backup, a counterfeit device, physical loss, damage or theft
Upfront cost	May be free to install	Typically the price of a device
Signing workflow	Usually completed in the app	May mean connecting, unlocking and confirming on a separate device
If the device is lost	Restore from the backup, usually a recovery phrase	Restore from the backup, usually a recovery phrase

Where the key sits, and what else runs there

A hot wallet’s key typically shares a phone or laptop with a browser, email, messaging apps and whatever else you install. A hardware wallet with a trusted display adds a separate screen for checking transaction details. Trezor’s guide explains its implementation: Trezor’s guide to its trusted display says malware on a computer or phone can change what those screens show, but not what the device shows. The check only helps if you read the device screen before confirming.

Cost

The SEC bulletin notes that cold wallet devices typically cost money while hot wallets may initially be free, and that making transactions typically involves fees with both. As a snapshot, on 14 October 2026 the Trezor Safe 3 was listed at $59 on Trezor’s site (in US dollars), the Ledger Nano S Plus at $69 on Ledger’s US shop, a two-card Tangem Wallet set at $54.90 on Tangem’s pricing page, and the Ledger Stax at $399 on Ledger’s US shop.

Convenience

A hot wallet payment is usually a tap in the app. A hardware wallet payment adds a separate signing step. Depending on the model, that means connecting or tapping the device (USB-C, Bluetooth, an NFC tap or a QR scan), unlocking it and, where the device has a screen, reviewing the details there. That extra step is the point: it adds a separate checkpoint outside the phone or computer, though it does not stop you approving a malicious transaction yourself.

Is a hot wallet safe?

It depends on how much it holds and what else runs on the device. The SEC bulletin says hot wallets expose assets to cyberthreats. Bitcoin.org’s security page advises a split: keep only small amounts on your computer or mobile device for everyday use, and the rest somewhere safer.

Two risks that Ledger and Trezor document are about what you approve rather than where the key is stored. Ledger describes blind signing as authorizing a transaction whose details you cannot see, and warns that you might sign an approval that lets a smart contract take your coins or tokens whenever it likes. Phishing works on both kinds of wallet: a March 2026 Trezor post, This is the way most crypto is stolen, describes theft that ends with the victim sharing their wallet backup.

Can you use a hot wallet and a cold wallet together?

Yes. You can keep a separate hot wallet for spending alongside cold storage for savings, the split Bitcoin.org suggests above.

A hardware wallet’s companion app is a different arrangement. The app on your phone or computer is online but holds no signing keys: it shows balances and builds unsigned transactions, much like the watching wallet Bitcoin.org describes for offline transaction signing. The hardware device holds the key and signs. Ledger devices pair with Ledger Wallet and Trezor devices with Trezor Suite. Keystone lists MetaMask among the wallets the Keystone 3 Pro works with, and Blockstream lists Sparrow Wallet, Electrum and HWI for the Jade Plus.

In this setup the app never holds the key, but it can still be compromised and show you something false. That is why the device screen, where there is one, is the place to check the address and amount, not the app.

Is a hardware wallet always a cold wallet?

Not automatically. A hardware wallet is designed to keep its signing keys isolated from the online app, but whether those keys have always stayed offline also depends on how they were created or imported. How the device talks to the online app varies by model:

• USB-C: Ledger Nano S Plus, Trezor Safe 3, Trezor Safe 5.
• USB-C plus Bluetooth: Ledger Nano X, Ledger Flex, Ledger Stax, Ledger Nano Gen5, Trezor Safe 7.
• NFC tap to a phone: Tangem Wallet.
• USB-C and an air-gapped mode (transfer details not verified in our data): Keystone 3 Pro, and the COLDCARD Q, which also has microSD slots and NFC.

Devices that avoid a live data link are covered in air-gapped hardware wallets.

If a hardware wallet’s recovery phrase is typed into a phone or computer, for example into a hot wallet app “to check it”, the keys it controls can no longer be treated as offline. Trezor’s advice in the post above is never to type your wallet backup into a phone or computer.

What do hot and cold wallets have in common?

Many wallets of both kinds are backed up the same way: a recovery phrase (the SEC calls it a seed phrase), often following the BIP39 standard, that rebuilds the wallet on another device. For a single-signature wallet without a BIP39 passphrase, anyone who has the phrase controls the funds, whichever kind of wallet created it. The SEC’s advice is to store it in a secure place and share it with no one. Our seed phrase guide covers formats and storage.

Both can also be self-custody, when you control the signing keys yourself. Neither protects you from approving a transaction you did not mean to approve.

Which should you use?

That depends on your situation rather than on a rule. These questions decide it:

• How much would you lose if your phone or laptop were compromised tomorrow?
• How often do you transact? Daily payments favor a hot wallet; long-term holdings tolerate the extra step.
• Can you keep a backup safe offline, in a place you will still find in ten years?
• Which coins do you hold? Some hardware wallets are sold as Bitcoin-only, including the COLDCARD Q and Jade Plus (Blockstream adds Liquid Network support for the Jade Plus).

One approach is to use both: a hot wallet for small, frequent payments and cold storage for the rest. To compare devices, start with the wallet database, the Ledger vs Trezor and Ledger Nano X vs Nano S Plus comparisons, and choosing a hardware wallet.