Hot vs cold wallets
A hot wallet keeps its keys on an internet-connected phone or computer, which is convenient for daily use but exposed to malware and phishing. A cold wallet, usually a hardware device, keeps keys offline and signs inside the device. Use hot for spending money and cold for savings.
The difference in one table
| Hot wallet | Cold wallet | |
|---|---|---|
| Where keys live | On your phone or computer, encrypted | On a separate offline device (or paper) |
| Examples | MetaMask, Trust Wallet, Phantom, Exodus, Rabby | Ledger, Trezor, Tangem, SafePal hardware |
| Cost | Free | You buy the device |
| Convenience | Instant | Need the device for every transaction |
| Main risks | Malware, malicious extensions, phishing, fake apps | Seed phrase theft, fake or tampered devices, physical theft, signing something malicious |
| Best for | Daily spending, DeFi, small balances | Savings, long-term holdings |
How hot wallets work
A hot wallet stores your encrypted key on the device and decrypts it when you unlock the app. That makes it fast, but anything that compromises the device or the app can reach the key. In December 2025 a malicious Trust Wallet Chrome extension version (2.68) that had not gone through Trust Wallet's own release process exfiltrated wallet secrets; Trust Wallet said about $7M was taken from 2,596 wallets and shipped version 2.69 with a claims process (BleepingComputer, Dec 2025). Earlier, in August 2022, the Slope mobile wallet was found to have sent seed phrases to a logging server, with losses estimated at $4M–$5M+ (The Block, Aug 2022).
How cold wallets work
A hardware wallet generates and keeps the key inside the device. Your computer or phone prepares a transaction, the device shows the details on its own screen, and you approve with a button or touch. The key never leaves. Malware on your computer cannot simply copy it.
Cold storage is not magic, though:
- The seed phrase is still the weak point. Scam letters on fake Ledger and Trezor letterhead asked owners to scan QR codes and enter their phrases (The Block, Apr 2025; BleepingComputer, Feb 2026).
- Buy from the source. In October 2026 Ledger confirmed that devices sold through a grey-market reseller carried a hidden implant that leaked the seed phrase (Crypto Briefing, Oct 2026).
- Randomness matters. A build error in Coldcard firmware 4.0.1 made some devices create guessable seeds; thefts began on 30 July 2026, estimated at about $116M (TRM Labs, Aug 2026).
- You can still sign a bad transaction. A hardware wallet approves what you tell it to. Drainers target hardware users too; read the device screen. In February 2025, Bybit's signers approved a disguised transaction after attackers tampered with the Safe web interface, and about $1.5B was stolen (SlowMist, Feb 2025).
The common setup: both
- Keep savings on a hardware wallet whose seed phrase has never been typed into a phone or computer.
- Use a hot wallet with a different seed phrase for daily use, airdrops and new apps.
- Top up the hot wallet from the cold one as needed, like moving cash from a bank to your pocket.
Many hot wallets can also act as the interface for a hardware wallet. MetaMask, Rabby, Exodus, Phantom and Solflare work with common hardware devices, so you keep a familiar app while the keys stay offline. Check each review for the exact models supported.
Which should you choose?
- Small amounts, learning, daily use: a reputable hot wallet. See best mobile wallets.
- Anything you can't afford to lose: a cold wallet. See best hardware wallets and Ledger vs Trezor.
- Shared or very large funds: consider a multisig smart account such as Safe with hardware signers.
Frequently asked questions
Is a cold wallet completely safe?
No. It removes most remote attacks, but you can still lose funds to a stolen seed phrase, a tampered device bought from an unofficial seller, or a malicious transaction you approve on the device.
Is a paper wallet a cold wallet?
Technically yes, but paper wallets are clumsy and easy to misuse. A hardware wallet with an offline seed phrase backup is safer and much easier to use.
Can I use MetaMask with a hardware wallet?
Yes. MetaMask supports hardware wallets including Ledger and Trezor, so the app is your interface while the device holds the keys and signs.
How much should I keep in a hot wallet?
Only what you would be willing to lose if your phone or computer were compromised. Many people treat it like the cash in their pocket.
Is a Tangem card a cold wallet?
Yes. Tangem's keys are created and kept on the card's chip, which has no battery or internet connection. It signs when you tap it to your phone over NFC.