What is a cold wallet?

A cold wallet keeps the private keys for your crypto on something that is not connected to the internet, typically a dedicated device such as a hardware wallet. A hardware wallet or an offline computer can also sign transactions without exposing those keys to an online machine; a key on paper cannot sign at all. The SEC’s December 2025 investor bulletin on crypto custody sums up the trade: cold wallets are less convenient than hot wallets and generally more secure from cyberthreats, but the device can be lost, damaged or stolen.

What is a cold wallet in crypto?

A crypto wallet does not hold coins. The coins are entries on a blockchain; what you hold is the private key that authorizes moving them. Ethereum’s developer documentation puts it directly: you hold private keys, and the funds are always on the ledger. The SEC bulletin adds that a private key cannot be changed or replaced once created, and that losing it means losing access permanently.

“Cold” describes where that key lives. The SEC’s examples of cold wallets include a physical device, a USB drive, an external hard drive and even a piece of paper. A hot wallet keeps the key in a desktop, mobile or web app on an internet-connected device. The side-by-side version is in cold wallet vs hot wallet.

How does a cold wallet work?

With a signing device (a hardware wallet or an offline computer), a transaction has three steps, and only one of them needs the key.

1. Prepare online. An app on your phone or computer (Ledger Wallet, Trezor Suite, Sparrow, Electrum and others) knows your addresses and balances. It builds an unsigned transaction: recipient, amount, fee.
2. Sign offline. The unsigned transaction goes to the cold device. On a hardware wallet with its own trusted screen, you review the details the device can display, confirm with a button or a tap, and the device signs with the private key. A device without a screen of its own leaves you relying on the app to show what you are signing.
3. Broadcast online. The signed transaction goes back to the app, which sends it to the network.

Bitcoin.org calls this offline transaction signing. For Bitcoin, the BIP 174 (PSBT) format was written so that offline signers, including air-gapped and hardware wallets, can sign without needing direct access to the set of unspent coins.

Step 2 is where the protection comes from. Trezor’s guide to its trusted display says malware on a computer or phone can change what those screens show, but not what the device shows. Ledger makes the same argument for clear signing on its devices’ screens. That protection only works if you read the device screen before you confirm.

What is cold storage in crypto?

Cold storage is the practice; a cold wallet is the tool. According to the SEC bulletin, third-party custodians may keep customer keys in cold wallets, hot wallets or a combination, so an exchange saying your coins are “in cold storage” still means the exchange controls the keys, not you. That difference is the subject of our self-custody guide.

Is a hardware wallet cold storage?

Usually, yes: a cold storage hardware wallet keeps the keys on the device and signs there. It does connect to an online phone or computer, by USB, Bluetooth or NFC, but to receive unsigned transactions and return signatures.

Some people reserve “cold” for devices with no cable or radio link at all. The distinction is about attack surface: every data channel is code that can have bugs. In December 2025 Blockstream disclosed a flaw in the Jade firmware’s command interface, reachable over USB or Bluetooth on an unlocked device and fixed in version 1.0.37. QR mode was not vulnerable, Blockstream wrote, because it exposes no such interface. Details are on the Jade Plus datasheet.

Are Ledger, Trezor and Tangem cold wallets?

All three make hardware wallets that keep keys on the device, but they connect differently.

• Ledger. The Nano S Plus connects by USB-C only and has no battery. The Nano X, Flex, Stax and Nano Gen5 add Bluetooth. Ledger lists the ST33K1M5 secure element chip on all of them except the Nano X, which uses the ST33J2M0.
• Trezor. The Safe 3 and Safe 5 connect by USB-C; the Safe 7 adds Bluetooth. Trezor names the secure element in all three as the OPTIGA Trust M (V3), certified to Common Criteria EAL6+, and the Safe 7 adds a second chip, TROPIC01.
• Tangem. The Tangem Wallet is a set of NFC cards you tap against a phone, sold in two-card and three-card sets. Tangem says its seedless setup leaves no copies of the key outside the cards.

For how they differ in practice, see Ledger vs Trezor and Tangem vs Ledger.

What kinds of cold wallets are there?

Connected hardware wallets (above) exchange transaction data with a phone or computer over USB, Bluetooth or NFC.

Air-gapped hardware wallets move transactions by QR code or memory card instead of a live link. Keystone describes the Keystone 3 Pro as an air-gapped QR signer. The COLDCARD Q has a QR scanner, dual microSD slots, NFC and USB-C, and Coinkite says there is no COLDCARD account or required companion app: you choose compatible wallet software. The Jade Plus pairs a QR camera with USB-C and Bluetooth. More in air-gapped hardware wallets.

Paper wallets record individual private keys on paper. A recovery phrase written on paper is something else: a backup of a wallet, restored by a different process (see seed phrases). Paper cannot sign, so to spend from a paper wallet you load the key into software. Electrum documents a sweep, which sends everything a key controls to an address in your software wallet. If you sweep the key into a wallet running on an online computer, that key has been exposed to the online machine.

An offline computer can also sign: Electrum documents a cold storage setup pairing an offline signing wallet with an online watching-only one.

What does a cold wallet not protect against?

A cold wallet keeps the key away from the computer it connects to. It does not stop you giving the key away, using a bad key, trusting a fake device, or approving the wrong transaction.

Phishing. A March 2026 Trezor post, This is the way most crypto is stolen, describes theft that ends with the victim sharing their wallet backup, and says no one legitimate will ever ask for it. Attackers have used real customer data: Ledger customer contact and order details were accessed in 2020, and on 5 January 2026 Global-e, which handled some Ledger.com orders, notified affected customers that names, contact details and order details had been accessed in its systems. Ledger’s FAQ on the Global-e incident warns that scammers draw on many data sources for phishing campaigns targeting Ledger. In January 2024, unauthorized access to Trezor’s support portal was used to send seed-phishing messages (listed on the Trezor Safe 3 datasheet). See is Ledger safe?

A leaked or weak recovery phrase. The recovery phrase, often a BIP39 mnemonic, lets a wallet that supports the same derivation paths rebuild your keys without your hardware, together with the exact passphrase if you set one (BIP39 says only the correct passphrase opens your wallet). Whoever holds them does not need your device. On 31 December 2024 Tangem disclosed that its app had logged private keys when a wallet was activated with a seed phrase and the owner contacted support in the app within seven days; Tangem said no funds were lost. In July 2026 Coinkite published a seed-generation advisory for affected COLDCARD firmware, including the Q: updating firmware does not repair a seed already generated. More in seed phrases.

Fake or tampered devices. In June 2021 Kraken Security Labs rebuilt a reported phishing attack in which an unsolicited, modified Ledger Nano X arrived in what appeared to be official Ledger shrink wrapping. A tiny USB stick implanted in the device carried a fake Ledger Live app built to trick victims into entering their seed phrase; Kraken said there were no flaws in the Ledger wallet or its firmware. Trezor’s Safe models run a device authentication check using a certificate stored in the secure element, and Trezor recommends buying from its official store or resellers.

Approving the wrong transaction. A device signs what you confirm. Ledger describes blind signing as authorizing a transaction whose details you cannot see. On 21 February 2025 the exchange Bybit lost almost $1.5 billion from one of its Ethereum multisig cold wallets during a routine transfer. Its forensic review found that a Safe developer’s credentials had been compromised, which let attackers deceive the signers into approving a malicious transaction. The FBI attributed the theft to North Korea. Bybit said its own infrastructure was not compromised: the signers approved the attacker’s transaction.

Loss. A backup can restore access after a device is lost or broken. If you lose every usable copy of the keys and every recovery route, you lose access to the funds; the SEC bulletin warns that a lost, damaged or stolen cold wallet may mean permanent loss.

How do you move crypto to a cold wallet?

1. Buy the device from the maker or an authorized reseller and run the maker’s genuineness check.
2. Follow the maker’s current firmware and setup instructions before you create or import keys; Coinkite, for example, says not to generate or import a seed on the COLDCARD Q until its firmware update is complete. If the wallet uses a recovery phrase, create it through that documented setup and write it on paper or metal; never photograph it or type it into a phone or computer.
3. Request a receive address in the companion app or compatible wallet software. If the device has its own screen, confirm the address matches there; otherwise follow the maker’s documented check.
4. Send a small amount from the exchange first. Coinkite’s migration instructions include a small test transaction before moving the remaining funds.
5. Once it arrives, send the rest.

How do you choose a cold wallet?

Decide which trade-offs you accept, then compare devices on these points:

• Backup format. BIP39 phrases restore on many wallets. Trezor, Keystone and OneKey also offer SLIP-39 shares, which the standard itself says are for the most part not compatible with BIP39.
• Code openness. Trezor states its firmware is open source; Ledger says its code is 95% open source and/or available; Tangem’s firmware is closed; COLDCARD’s is published under MIT plus Commons Clause.
• Coins. Coinkite sells the COLDCARD Q as Bitcoin-only. Blockstream describes the Jade Plus as Bitcoin-only with Liquid Network support; we have not verified its Liquid asset handling. Ledger lists 500+ coins in Ledger Wallet.
• Screen. Where a device has one, you verify on it, so size matters: a 1.1-inch OLED on the Nano S Plus, a 4-inch touchscreen on the Keystone 3 Pro.
• Price. On 14 October 2026 the Trezor Safe 3 was listed at $59 on Trezor’s site (in US dollars) and the Ledger Stax at $399 on Ledger’s US shop.

Every device is in the wallet database, checked as described in our methodology. For a shortlist by criteria, see choosing a hardware wallet and COLDCARD vs Trezor.

What we could not verify

• The Keystone pages we checked do not state whether the 3 Pro supports transfer methods other than QR codes in air-gapped mode.
• Tangem’s FAQ gives conflicting answers on whether its app generates 12-word or 24-word phrases.