What Is a Hot Wallet? Hot vs Cold Storage

A hot wallet is a cryptocurrency wallet whose private keys are stored on an internet-connected device, such as a smartphone app, a browser extension, or a desktop program. That constant connectivity makes it quick and convenient to send, receive, and interact with applications, but it also leaves the keys more exposed to online threats than an offline alternative.

Understanding the term first requires a small correction to a common misconception: a wallet does not actually hold coins. Cryptocurrency balances live on the blockchain. What a wallet stores is the set of cryptographic keys that prove ownership and authorize transactions. Whether a wallet is “hot” or “cold” simply describes where those keys sit and whether they can be reached over the internet.

What is a hot wallet?

A hot wallet is any wallet that keeps its private keys on a device with an active internet connection. Popular examples include mobile wallet apps, browser-based wallets used to connect to decentralized applications, and desktop software wallets.

Hot wallets can be either non-custodial, where the user alone controls the keys and recovery phrase, or custodial, where a company such as an exchange holds the keys on the user’s behalf. The defining feature in both cases is that the keys are online and available for near-instant use.

How does a hot wallet work?

When a hot wallet is created, it generates a private key (often represented as a 12- or 24-word recovery phrase, also called a seed phrase) and a matching public address. The public address is shared to receive funds; the private key is kept secret and is used to sign outgoing transactions.

To send crypto, the wallet uses the private key to produce a digital signature, then broadcasts the signed transaction to the network. Because the key is already loaded on a connected device, this signing happens instantly and requires no extra hardware. The convenience is the whole point of a hot wallet, and it is also the source of its main weakness.

The recovery phrase deserves special attention because it is a human-readable backup of the private key. Anyone who reads that phrase can recreate the wallet on their own device and take the funds, and equally, anyone who loses it may lose access forever. For that reason, the phrase is usually meant to be written down and stored offline, never typed into a website or saved in a connected app.

What are the main types of hot wallet?

Hot wallets come in several forms, each with a slightly different balance of convenience and exposure. Mobile wallets are apps on a phone, useful for payments and scanning codes on the go. Desktop wallets are programs installed on a computer, offering more screen space but inheriting that machine’s security. Web or browser-extension wallets live in the browser and are widely used to connect to decentralized applications, which makes them convenient but also a frequent target of fake sites.

Custodial wallets provided by exchanges are a separate category. Here the provider holds the keys, so the experience resembles a normal online account with password recovery, but the user relies entirely on the provider’s security and solvency. Each type is still “hot” because the keys can be reached over the internet.

What is a cold wallet, or cold storage?

A cold wallet keeps private keys completely offline, isolating them from internet-based attacks. The most common form is a hardware wallet, a small dedicated device that stores keys and signs transactions internally, so the secret key never leaves the device. Paper wallets and air-gapped computers are other examples.

With cold storage, a transaction is typically prepared on a connected device but must be physically confirmed on the offline hardware before it is signed. This extra step is deliberately less convenient, and that friction is exactly what raises the security bar.

Hot wallet vs cold storage: what is the difference?

The core trade-off is convenience versus exposure. The table below summarizes the practical differences.

Why does the distinction matter?

The distinction matters because in most non-custodial setups, whoever controls the private keys controls the funds, and there is rarely a customer-service line to reverse a theft. An attacker who obtains the keys from an online device can move the assets, and blockchain transactions are generally irreversible.

This is why the phrase “not your keys, not your coins” circulates widely. It captures the idea that leaving keys with a third party, or on an insecure connected device, shifts control away from the owner. Choosing between hot and cold storage is therefore a decision about how much exposure is acceptable for a given amount of value.

What are the risks and limitations of a hot wallet?

The main risk is that an internet-connected device can be compromised. Malware, malicious browser extensions, fake websites, and phishing messages can all be used to capture a recovery phrase or trick a user into signing a harmful transaction. Because the keys are already online, an attacker often does not need physical access.

A frequent and avoidable mistake is storing the recovery phrase digitally, for example in a screenshot, a cloud note, or an email. Anything that puts the phrase on a connected system effectively turns even careful storage into a hot target. Approving a malicious smart-contract interaction is another common way funds are lost, since the signature comes from the wallet itself.

Hot wallets are not inherently unsafe, but their safety depends heavily on device hygiene and user behavior. Keeping software updated, downloading wallets only from official sources, and never sharing the recovery phrase all reduce, but do not eliminate, the exposure that comes with being online.

The bottom line

A hot wallet trades some security for speed and convenience by keeping private keys on an internet-connected device, while a cold wallet does the opposite by keeping them offline. Neither is universally “better”; they serve different purposes. A widely used pattern is to keep only small, active amounts in a hot wallet and to move long-term holdings into cold storage, so that a single compromised device cannot drain everything. Whichever approach is used, the recovery phrase is the ultimate key, and protecting it offline is the single most important habit for keeping self-custodied crypto secure.