Cold wallet or hot wallet: crypto asset security

The terms hot wallet and cold wallet describe a single thing: how exposed the private key is to the internet. The private key is the secret that authorizes moving the funds, and whoever obtains it can take everything.

This article compares the two models on what matters for security: which attacks each one blocks, which remain possible and which risks appear precisely when you switch from one to the other. If it is still unclear who holds the key in your wallet, you or a company, start with custodial and non-custodial wallets.

The official definitions

Brazilian regulation provides objective definitions. BCB Resolution No. 520 of the Central Bank of Brazil, dated November 10, 2025, and in force since February 2, 2026, defines in Article 2:

• Cold wallet: a wallet that “is not constantly connected to the worldwide computer network (internet).”
• Hot wallet: a wallet “kept constantly connected” to the internet.
• Warm wallet: an intermediate category between the two.

The rule is aimed at companies that provide virtual asset services, but the definitions work as vocabulary for anyone. Note that the criterion is not the device’s form factor, but the connection.

Why the connection matters

Every transaction must be signed with the private key. The security question is: where does that signing happen?

Bitcoin’s developer guide describes full-service wallets, which do everything in a single program, and points out their main drawback: they store the private keys on a device connected to the internet. The guide adds that encrypting the wallet file helps, but does not protect against an attack designed to capture the encryption password (Developer Guide: Wallets).

NIST’s blockchain report explains why this is serious: if the key is stolen, the attacker has full access to the assets, and the transfer they make generally cannot be undone (NISTIR 8202, section 3.4.1).

Hot wallet: convenience with exposure

Hot wallets include mobile apps, desktop programs, browser extensions and web wallets, the types listed on Ethereum’s own wallets page (ethereum.org, Ethereum wallets).

What they offer:

• Immediate use. Paying, receiving and interacting with decentralized applications takes seconds.
• Zero or low cost. Most are free.
• Simple setup. Just install and write down the recovery phrase.

What exposes them:

• Malware. A malicious program on the same device may try to read the key or capture what you type. Bitcoin.org notes that the wallet password does not protect against keyloggers (Securing your wallet).
• Phishing. A fake site may ask for the recovery phrase or trick you into signing. CISA, the US cybersecurity agency, defines phishing as attacks that use malicious email or websites to obtain information by posing as a trustworthy organization (CISA). The most common techniques against wallets are covered in crypto wallet phishing.
• Cloud backup. A photo or file of the phrase synced to the cloud takes the key off the device. Ethereum’s security guide advises against screenshots of the phrase for precisely this reason (ethereum.org, Ethereum security).

Bitcoin.org compares a wallet on a phone or computer to cash in your pocket: it should hold only a small amount for everyday use (Securing your wallet).

Cold wallet: the key away from the network

In a cold wallet, the key is generated and used in an environment without a connection. There are two main forms.

Offline computer. Bitcoin.org describes offline signing: a disconnected computer holds the wallet and signs transactions; a connected computer only builds unsigned transactions and broadcasts the ones that come back signed (Securing your wallet). Data moves between them on removable media. It works, but it requires discipline and some technical knowledge.

Hardware wallet. This is a device dedicated to a single task: holding the key and signing. The Bitcoin guide describes it as a device that runs a “signing-only” wallet and talks to the computer or phone to exchange transaction data (Developer Guide: Wallets). The key never leaves the device; the connected computer only receives the already-signed transaction. Bitcoin.org considers this type of wallet to offer the best balance between very high security and ease of use (Securing your wallet).

The gain is concrete: malware on your computer cannot read a key that isn’t there. So is the cost: the device must be paid for, each operation takes longer and you now have a physical object to safeguard.

What a cold wallet does not solve

Here is the most common misinterpretation. A cold wallet protects the key against remote reading. It does not protect against everything.

You still sign what you approve. If a malicious site builds a transaction that sends your funds to the scammer, or an unlimited spending approval, and you confirm it on the device, the signature is valid. Ethereum’s security guide recommends reading the transaction before signing, checking the address and not granting unlimited spending allowances to contracts (ethereum.org, Ethereum security). Check on the device’s own screen, not just the computer’s.

The recovery phrase is still the key. The device holds the key, but the 12-to-24-word phrase defined in BIP 39 recreates everything on any other device. If it is photographed, typed into a website or stored in a file, the wallet is, in practice, no longer cold. See how to protect your seed phrase.

Loss and inheritance. An offline key is harder to steal and, for the same reason, easier to lose. Bitcoin.org notes that, without a backup and without a plan for your family, the funds may be lost forever (Securing your wallet).

Supply chain attacks

A supply chain attack compromises the product before it reaches you. In the case of hardware wallets, it means receiving a tampered device.

In May 2023, the security company Kaspersky published its investigation of such a case. The victim had bought a hardware wallet that arrived already infected; the device looked identical to the original. Inside, the firmware (the internal program) had been modified to, among other things, replace the randomly generated phrase with one of 20 predefined phrases known to the criminals. A total of 1.33 BTC, about US$ 29,600 at the time, was diverted, according to the company (Kaspersky, May 10, 2023).

The case shows that a cold wallet’s security depends on trusting the device. The measures recommended in the investigation are:

• buy only from official sources, that is, the manufacturer or authorized resellers;
• inspect the device for signs of tampering;
• check that the firmware is legitimate and up to date;
• write down the phrase during setup and store it securely.

In our newsroom’s assessment, there is an additional warning sign that follows from the logic of the attack: a device that arrives with a recovery phrase already printed or already configured should not be used, because someone else may know it.

Extra layers: passphrase and multisignature

Two techniques reduce dependence on a single point of failure.

Passphrase on the seed phrase. BIP 39 allows protecting the phrase with an optional passphrase. Each passphrase generates a different seed, and only the correct one opens the intended wallet (BIP 39). Someone who finds only the words cannot take the funds. In exchange, if you forget the passphrase, the phrase alone recovers nothing.

Multisignature. The wallet requires several independent approvals before spending, for example 3 of 5 signatures. Bitcoin.org points out that this helps prevent theft from a single compromised device or location (Securing your wallet). The price is complexity: more keys to safeguard and more steps to recover.

A technical caution for anyone using watch-only wallets, which show balances without holding private keys: BIP 32 warns that the extended public key, combined with a single unprotected (non-“hardened”) child private key, allows the parent private key to be reconstructed. Treat the extended public key as sensitive information.

How companies use both

Exchanges and custodians face the same dilemma on a larger scale: they need a balance in hot wallets to pay withdrawals and want to keep most of it offline.

BCB Resolution No. 520 requires the custody agreement to explain how client assets are distributed across hot, warm and cold wallets and what method is used to store the keys (Art. 73), and that multiple or segmented keys be kept in different locations (Art. 49) (BCB Resolution No. 520). In the text consulted, the rule does not set a minimum percentage in cold wallets.

A historical record illustrates the logic. In March 2014, already in bankruptcy proceedings, the exchange Mt. Gox reported having found about 200,000 bitcoins in an old wallet and, “for security reasons,” having moved them to offline wallets (MtGox, March 20, 2014).

Side-by-side comparison

Criterion	Hot wallet	Cold wallet
Where the key is used	Internet-connected device	Offline environment or dedicated device
Malware and remote intrusion	Exposes the key	Greatly reduces exposure
Phishing and malicious signing	Vulnerable	Still vulnerable, if you approve
Tampering at purchase	Fake app	Tampered device
Physical loss and inheritance	Depends on backup	Depends on backup, with more objects to safeguard
Cost and convenience	Free and immediate	Paid and slower

How to combine the two models

You don’t have to pick just one. The logic described by Bitcoin.org is to split by purpose: little value in the hot wallet, for everyday use, and the reserve offline. It is similar reasoning to what Brazilian rules require custodians to spell out when distributing assets across hot, warm and cold wallets.

In our newsroom’s assessment, the choice should also take into account your ability to operate the model without error. A badly configured cold wallet, with the phrase photographed or bought from a dubious source, can be less secure than a well-kept hot wallet. And neither model protects against price swings: crypto assets can lose much, or all, of their value. For the broader context, see what Bitcoin is and how the Bitcoin blockchain works.

Key takeaways

• The difference between a hot and a cold wallet is where the private key is used: on a connected device or offline. That determines whether malware can reach it.
• A cold wallet does not stop you from approving a malicious transaction, exposing the recovery phrase, buying a tampered device or losing access. These risks require their own precautions.
• Splitting by purpose, with little value in the hot wallet and the reserve offline, is the logic described by Bitcoin.org. Custodians in Brazil must document this distribution, under BCB Resolution No. 520.