Hot vs cold crypto wallets: which one do you need?

“Not your keys, not your coins” is one of crypto’s most repeated sayings. It’s also one of the most misunderstood. To know where your crypto is safest, you first need to know what a wallet actually does, and then weigh convenience against risk.

What a wallet really is

Your crypto doesn’t sit inside your wallet. It’s recorded on the blockchain. What a wallet holds is the private key: the secret that proves you own an address and lets you sign transactions that move what’s in it.

The Ethereum documentation describes wallets as a window onto your assets: they let you read your balance, sign in to applications, send transactions and verify your identity. It also points out that wallet providers don’t have custody of your funds. With a self-custody wallet, the software is just a tool; the keys are yours.

That leads to the key distinction.

Custodial vs self-custody

	Exchange account (custodial)	Self-custody wallet
Who holds the keys	The company	You
Forgot your password?	Reset it with the company	You need your recovery phrase
Company fails or freezes withdrawals	Your access depends on the company	Not affected
You make a mistake (wrong address, scam)	Support may help in some cases	Usually irreversible
Insurance	Generally none for crypto	None

Neither option is risk-free. The risk just moves: with an exchange, you trust a company; with self-custody, you trust yourself. As the Ethereum documentation notes, an exchange links your wallet to a username and password you can recover in the usual way, but you’re trusting that exchange with custody of your funds. And the FDIC is clear that deposit insurance does not protect against the failure of crypto exchanges, custodians or wallet providers.

Hot wallets

A hot wallet is any wallet whose keys live on an internet-connected device:

• Mobile apps on your phone.
• Browser extensions, used to connect to websites and decentralized apps.
• Desktop apps on your computer.

Pros: free, quick to set up, convenient for frequent transactions and for using decentralized apps.

Cons: the keys sit on a device that’s online, exposed to malware, malicious browser extensions, phishing sites and fake apps. If the phone or computer is compromised, the wallet may be too.

Cold wallets

A cold wallet keeps the keys offline. The most common type is a hardware wallet: a small device that stores the keys and signs transactions inside the device, so the keys never touch your computer or phone.

Pros: much harder for remote attackers to reach; you confirm each transaction on the device’s own screen.

Cons: costs money; less convenient; you must protect the device and its recovery phrase; and it’s only as safe as your habits. A hardware wallet won’t stop you from approving a malicious transaction if you don’t read what you’re signing.

Buy hardware wallets only from the manufacturer or an authorized seller, never second-hand, and never use a device that arrives with a recovery phrase already written down. A genuine device generates a new phrase for you.

The recovery phrase is the real wallet

When you create a self-custody wallet, you get a recovery phrase, also called a seed phrase: usually 12 or 24 words. Anyone with those words can rebuild your wallet on any device and take everything in it.

The Ethereum documentation puts it simply: the seed phrase is often the only way you’ll be able to recover your wallet, and you should write it down and keep it safe. Our guide on seed phrase security explains how to store it, and the mistakes that lose people money.

How to split your crypto

A practical setup many people use:

1. Exchange account: only what you’re actively buying or selling. See how to choose an exchange.
2. Hot wallet: a small “spending” amount for transactions and apps, an amount you could afford to lose.
3. Cold wallet: long-term savings, moved rarely.

The right split depends on how much you hold and how often you use it. The more you hold, the stronger the case for cold storage.

Moving crypto between wallets

• Test with a small amount first, then send the rest.
• Check the address character by character, at least the start and the end. Some malware swaps copied addresses for the attacker’s.
• Check the network. The same token can exist on several blockchains; sending it on the wrong network can mean losing it.
• Expect a network fee for each transfer. See exchange fees.

For US taxpayers, the IRS says moving crypto between your own wallets isn’t a taxable event, except for any crypto used to pay transaction fees.

Security habits for any wallet

• Lock down your phone number and email. The FBI warns that criminals use SIM swapping to take over phone numbers and reset account passwords. See SIM swaps and 2FA.
• Use an authenticator app or a security key for exchange accounts, not SMS.
• Bookmark the sites you use, so you don’t land on look-alike phishing pages through search ads.
• Never share your recovery phrase with anyone, including “support” staff. No genuine company will ask for it.
• Read what you sign. If a site asks you to approve unlimited spending of a token, stop and check.

The Ethereum documentation’s warning applies to every kind of wallet: transactions can’t be reversed and wallets can’t be easily recovered. Take your time.