A hot wallet is connected to the internet, so you can spend from it quickly, but it is exposed to online attacks. A cold wallet keeps your keys offline. That protects it from remote attacks, but the device or paper can be lost, damaged or stolen. The SEC's investor bulletin on crypto custody, published in December 2025, puts the trade-off in those terms. Bitcoin.org's security guide recommends keeping "only small amounts" on a computer or phone "for everyday use" and keeping savings offline. Which wallet you use depends on how often you move the coins and how well you can protect a physical backup.
What the two terms mean
The SEC's Investor.gov bulletin, Crypto Asset Custody Basics for Retail Investors (December 2025), says the two primary types of crypto wallets are hot wallets and cold wallets:
- Hot wallet: a wallet connected to the internet, such as a desktop, mobile or web app. The bulletin says hot wallets give convenient access for transactions "but they also expose your crypto assets to cyberthreats."
- Cold wallet: typically an offline device, such as a USB drive, external hard drive or paper. Because cold wallets are not connected to the internet, the bulletin calls them "generally more secure from cyberthreats than hot wallets." It warns that the physical devices "can be lost, damaged, or stolen, which may result in a permanent loss of your crypto assets."
Bitcoin.org describes an offline wallet, "also known as cold storage," as storing a wallet "in a secured place that is not connected to the network," and says it "provides the highest level of security for savings."
Neither source says a cold wallet cannot be hacked. Offline storage removes remote network attacks from the picture. It leaves physical loss, theft and mistakes with the backup.
The real asset: your private key and seed phrase
A wallet does not hold coins. It holds the private key that authorises spending them. The SEC bulletin says that if you lose your private key, you permanently lose access to the crypto assets in that wallet. It also tells investors to store the seed phrase in a secure place and not share it with anyone.
Most modern wallets show that backup as a list of words defined by BIP-39, the Bitcoin Improvement Proposal for mnemonic codes:
- A valid phrase has 12, 15, 18, 21 or 24 words, matching 128 to 256 bits of entropy.
- Each word encodes 11 bits, used as an index into a list of 2,048 words. The last word includes a checksum, taken from the first ENT/32 bits of a SHA-256 hash of the entropy, so typos can be detected.
- An optional passphrase can be added. The seed is derived with PBKDF2 using HMAC-SHA512 and 2,048 iterations, with the passphrase as part of the salt. A different passphrase gives a different wallet, so forgetting it means losing access just as surely as losing the words.
The phrase recovers both hot and cold wallets, so whoever holds it controls the funds, whatever device type you use.
Hot wallet, cold wallet, or both?
Answer a few questions about how you use your coins to see which setup the article's guidance points to.
How often do you move these coins?
- Often, for everyday spending → next question
- Rarely, they are long-term savings → next question
Is the amount small, like cash you would be comfortable carrying in your pocket?
- Yes, a small everyday amount → A hot wallet fits this use
- No, it is a larger sum → Split it: small hot wallet, the rest offline
Who holds the private keys?
- I do (self-custody) → next question
- A third-party custodian → Ask your custodian the SEC's questions
Can you keep a written seed phrase backup safe in more than one physical place?
- Yes → next question
- Not yet → Sort out the backup before going cold
Will you add an optional BIP-39 passphrase to the seed phrase?
A hot wallet gives quick access for spending, but the SEC bulletin says it exposes your assets to cyberthreats. Bitcoin.org suggests keeping only small amounts on a computer or phone for everyday use. Keep the software updated and never type the seed phrase into a website.
Bitcoin.org compares a hot wallet to cash in your pocket. Keep only what you spend in the hot wallet and move the larger part offline, for example to a hardware wallet bought directly from its manufacturer.
Under third-party custody you take on counterparty risk: the SEC bulletin says a custodian may be hacked, shut down or go bankrupt. Before using one, ask whether it practises rehypothecation (using deposits as collateral) or commingling (pooling customer assets).
A cold wallet removes remote attacks, but the device or paper can be lost, damaged or stolen, and the SEC bulletin says that can mean permanent loss. Write the seed phrase down offline and plan copies in more than one place on durable media before relying on cold storage.
Bitcoin.org says offline storage gives the highest level of security for savings. Keep the seed phrase copies in separate secure places and confirm every outgoing transaction on the hardware device's own screen. For larger holdings, multisignature can require several independent approvals.
Store the coins offline and back up the passphrase apart from the words. Under BIP-39 a different passphrase gives a different wallet, so without it the words alone will not restore your funds. Confirm every outgoing transaction on the device's screen.
This sorts general security practices from the SEC bulletin and bitcoin.org; it does not compare specific wallet products, test any device, or cover tax or inheritance planning.
Where each type is exposed
Hot wallets
The risk is the device the wallet runs on. A desktop wallet sits alongside everything else installed on that computer. Phones add some separation between apps. Android "assigns a unique user ID (UID) to each Android app and runs it in its own process," which by default keeps apps out of each other's data. Apple's platform security guide says iOS sandboxing "is designed to prevent apps from gathering or modifying information stored by other apps." This separation lowers the chance that another app reads wallet data. It is no protection against phishing, fake wallet apps, or a seed phrase typed into a malicious website.
Cold wallets
The risk shifts to the physical world: losing the device, fire or water damage to a paper backup, theft, or a backup nobody else in the household can find. Bitcoin.org suggests keeping copies "in more than one physical place, using durable storage media," and says "encrypting any backup that is exposed to the network is a good security practice."
Hardware wallets
A hardware wallet is the usual way to keep keys offline while still spending from them. One manufacturer, Trezor, says its devices sign the transaction "inside the device using your private key," that the key "never leaves the hardware wallet," and that "each transaction requires physical confirmation on your device." That last step is the main protection: check the amount and receiving address on the device's own screen, not just on the computer. These are the manufacturer's statements about its own products and were not independently tested here.
Self-custody vs a third-party custodian
Hot and cold describe connectivity. Custody describes who holds the keys. The SEC bulletin says either wallet type can be used under self-custody or third-party custody:
- Self-custody means you have "sole responsibility for the security" of your private keys.
- Third-party custody adds counterparty risk. The bulletin says a custodian may be hacked, shut down or go bankrupt, and you may lose access. It also flags rehypothecation, where a custodian uses deposited crypto assets as collateral for lending or other purposes, and commingling, where customer assets are pooled rather than held individually. It suggests asking a custodian about both before using it.
A practical setup
These steps come from the guidance above. They are security practices, not a recommendation of any product.
- Size the hot wallet like a cash wallet. Bitcoin.org: "If you wouldn't keep a thousand dollars in your pocket, you might want to have the same consideration for your Bitcoin wallet."
- Keep long-term holdings offline, for example on a hardware wallet bought directly from its manufacturer.
- Write down the seed phrase offline, store copies in more than one secure place, and never enter it on a website or share it.
- If you use a BIP-39 passphrase, back it up separately. Without it the words alone will not restore the wallet.
- Confirm every outgoing transaction on the hardware device's screen.
- Keep wallet software updated. Bitcoin.org says the latest version brings "important stability and security fixes."
- For larger holdings, consider multisignature. Bitcoin.org says it lets a transaction "require multiple independent approvals to be spent."
- If someone else holds your keys, ask about rehypothecation and commingling, as the SEC bulletin suggests.
Limitations: this guide rests mainly on two sources, the SEC investor bulletin and bitcoin.org, and its hardware-wallet details come from one manufacturer's own page.
