The difference between a hot wallet and a cold wallet is where the private key lives. A hot wallet stores the key on an internet-connected device, such as a mobile app, browser extension or desktop application. A cold wallet generates and stores the key offline, so it is never exposed to the internet, per Trezor. Hot wallets trade some security for speed and convenience. Cold wallets trade convenience for protection against remote attacks.
​

Neither one holds coins. The assets stay on the blockchain, and the wallet holds the keys that authorize moving them. This page covers how each type works, the threats each one faces, how recovery works, and a decision guide for splitting funds between them. Background: what a blockchain wallet is and what self-custody means.
​

A hot wallet keeps its private key on a device that connects to the internet, which makes sending funds fast but leaves the key reachable by malware and phishing. A cold wallet keeps its private key on hardware or paper that never touches a network, which blocks remote theft but adds steps every time funds move.
​

Both are tools for the same account. An Ethereum account is a pair of keys: one creates the address you share, and the other stays secret because it signs transactions, per Ethereum's wallet guide. A wallet is software or hardware that uses those keys to show balances and send transactions. The hot or cold label describes only where the signing key sits.
​

The terms are shorthand, and the boundary is not always clean. Ledger draws a distinction between a hardware wallet and a cold wallet: both keep private keys offline, but Ledger defines a cold wallet as one that never interacts with smart contracts and only sends and receives assets, per Ledger. A hardware wallet used daily to sign DeFi approvals is offline at the key level but exposed at the transaction level.
​

A hot wallet is an app that generates or imports a private key, stores it on the device, and signs transactions there when you approve them. Because the device is online, the wallet can read balances, connect to apps and broadcast a signed transaction in one step. The same connection is the attack surface.
​

Ethereum's wallet guide lists the common forms: mobile applications, browser wallets that run as web apps, browser extension wallets, and desktop applications for macOS, Windows or Linux, per Ethereum's wallet guide. Trezor's definition groups these as hot wallets when they run without a hardware device, and notes that because the key sits on an internet-connected device they are more exposed to hacking, per Trezor.
​

Trezor's guidance on use is narrow: hot wallets are best suited for small amounts that need frequent access, per Trezor. Bitcoin.org makes the same point with a cash analogy. If you would not carry a thousand dollars in your pocket, keep only small amounts on a computer or phone for everyday use and hold the rest somewhere safer, per Bitcoin's wallet security guide.
​

Encryption helps but has limits. Setting a password on a wallet or phone protects against thieves, but it cannot protect against keylogging hardware or software, per Bitcoin's wallet security guide. Newer hot-wallet designs change the key model itself, as covered in MPC wallets and passkey wallets.
​

A cold wallet keeps the private key on hardware that never connects to the internet. When you send funds, an online device prepares the unsigned transaction, the offline device signs it internally, and the online device broadcasts the signed result. The key never leaves the offline device, so a compromised laptop cannot steal it.
​

Hardware wallets are the most common form. Trezor describes the flow: transaction details go to the device, it signs inside using the private key, and the signed transaction returns to the connected computer for broadcast, so the key is never exposed even during a transaction, per Trezor. SatoshiLabs, founded in Prague in 2014, created the Trezor Model One, which Trezor calls the world's first hardware wallet, per Trezor.
​

The older method uses two computers. One computer is never connected to a network and holds the full wallet; a second, online computer holds a watching wallet that can only create unsigned transactions. You move the unsigned transaction over on removable storage, sign it offline, and carry it back to broadcast, per Bitcoin's wallet security guide. If the online machine is compromised, it still cannot withdraw funds.
​

Device-level protections add a layer against physical theft. Trezor devices accept a PIN up to 50 digits long, double the waiting time after each wrong attempt, and wipe themselves after 16 failed attempts, per Trezor. For a fuller look at the device category, see what a hardware wallet is.
​

A cold wallet is safer against remote attacks, because malware on an online computer cannot reach a key that never touches the internet. It is not safer against every risk: it can still sign a malicious transaction, and losing its backup loses the funds. Security depends on how the wallet is used as much as where the key sits.
​

Ledger states the limit directly: hardware wallets are secure from online hacks, but they cannot stop a user from signing a malicious smart contract or falling for social engineering, and not all contract details can be fully displayed on a hardware wallet screen, per Ledger. Its recommended pattern is to segregate assets: keep one account only for sending and receiving, and use separate accounts on the same device to sign app approvals.
​

Trezor's FAQ makes a similar point about where attacks come from. To compromise a hardware wallet an attacker typically needs physical access, and the bigger risk is phishing or social engineering aimed at the wallet backup. Trezor says it will never ask a user to enter the backup digitally, per Trezor.
​

Custodial accounts on exchanges are a separate category from both. When a third party controls the keys, the user relies entirely on that party's security and honesty, and exchanges and online wallets have been hacked, failed or frozen withdrawals, per Bitcoin's wallet security guide. That trade-off is covered in custodial vs non-custodial wallets.
​

Losing the device does not lose the funds if the recovery phrase is safe, because the phrase regenerates the same keys on new hardware or software. Losing the recovery phrase and the device together usually means the funds are gone for good. Anyone who finds the phrase can take the funds without the device.
​

Trezor puts it plainly: the backup gives the same access to coins as the device, so a lost or damaged Trezor can be restored from it, but anyone who gains access to the backup can access the wallet without the Trezor, per Trezor. Ethereum's wallet guide says the seed phrase is often the only way to recover a wallet and should be written down, not stored on a computer, per Ethereum's wallet guide.
​

Bitcoin.org adds practical backup rules: encrypt any backup stored online, keep copies in more than one physical place on durable media, and check whether your wallet is deterministic so that one backup of the recovery phrase restores every past and future address, per Bitcoin's wallet security guide. More on how phrases work: what a recovery phrase is.
​

Most holders use both: a hot wallet for spending and app activity, and a cold wallet for savings. The split follows one question, how much would a single compromised phone or browser cost you. Balances you would not carry as cash belong in cold storage, and the hot wallet holds only what you plan to use soon.
​

Trezor suggests considering a hardware wallet once holdings are large enough that an exchange or hot-wallet hack would seriously affect you, per Trezor. A simple decision tree based on the guidance above:

Bitcoin supports multi-signature spending that requires several independent approvals, for example a withdrawal that needs 3 of 5 members to sign, per Bitcoin's wallet security guide. Organizations comparing those options can read multi-sig vs MPC vs HSM for treasuries.
​

Each model has failure modes that a label does not fix. Hot wallets fail when the device or browser is compromised. Cold wallets fail when the backup is lost, stolen or phished, or when the owner signs something harmful. Both rely on the owner, since self-custody has no help desk to reverse a mistake.

Related reading in this series: proof of stake vs proof of work and web2 vs web3.
​

Not exactly. Both keep private keys offline, but Ledger defines a cold wallet as one that never interacts with smart contracts, while a hardware wallet can also sign app transactions, per Ledger.
​

Yes. Used on its own, a browser extension wallet keeps its key on an internet-connected computer, which fits the hot wallet definition from Trezor. Pairing it with a hardware wallet moves signing offline.
​

No. The assets stay on the blockchain, and the device stores the private keys that control them, per Trezor.
​

Yes, if you still have the wallet backup. The backup restores access on a new device, per Trezor.
​

Only what you need for near-term spending. Bitcoin.org suggests treating a hot wallet like cash in a pocket and keeping the rest in a safer environment, per Bitcoin's wallet security guide.
​

Definitions and security guidance come from wallet vendors' own documentation (Trezor, Ledger) and from the Ethereum and Bitcoin project sites. Device features such as PIN length and wipe behavior are Trezor's published specifications and may differ for other vendors. No wallet is rated or recommended here. All pages were read on October 13, 2026.