Cold storage in one paragraph
Every crypto wallet is really a pair of numbers: a public address (safe to share) and a private key (a signature you must never reveal). "Cold" refers to where that private key lives. In a cold wallet it lives on a dedicated offline device — usually a small USB-shaped hardware wallet with a Secure Element chip. When you want to send crypto, the unsigned transaction is passed to the device, you approve it on the device's own screen, and only the signed transaction (never the key) comes back out.
Hot wallet vs cold wallet
| Hot wallet | Cold wallet | |
|---|---|---|
| Where the key lives | Phone, browser, exchange server | Offline chip / air-gapped device |
| Examples | MetaMask, Phantom, Coinbase, Binance | Ledger, Trezor, BitBox02, Coldcard |
| Remote hack risk | High | Very low |
| Convenience | Instant | Extra confirmation step |
| Best for | Spending money, small balances | Long-term savings, large balances |
Types of cold wallets
- Hardware wallets. Purpose-built devices (Ledger, Trezor, BitBox02, Coldcard, Keystone) with a Secure Element or MCU that signs transactions offline. This is what most people mean by "cold wallet" in 2026.
- Air-gapped wallets. Devices with no USB, Bluetooth or Wi-Fi at all — communication happens over QR codes or microSD cards (Keystone 3 Pro, Coldcard Q, NGRAVE ZERO). Highest assurance, slightly more friction.
- Paper wallets. A printed private key or seed phrase. Truly offline, but easy to lose, damage or photograph accidentally. Considered legacy — hardware wallets replaced them for good reason.
- Metal seed backups. Not a wallet by themselves, but the standard way to back up a cold wallet's 12- or 24-word seed phrase against fire, flood and time.
How a cold wallet actually signs a transaction
- You build the transaction in a companion app (Ledger Live, Trezor Suite, Sparrow, Rabby).
- The unsigned transaction is sent to the hardware wallet over USB, Bluetooth or QR.
- The device shows the destination address and amount on its own screen.
- You physically press a button to approve. The key signs inside the Secure Element.
- Only the signed transaction leaves the device. The private key never does.
This is why remote malware can't drain a properly used cold wallet: even if your laptop is fully compromised, the attacker can only propose a transaction. Approval requires physical access to the device and a check of the on-device screen.
When you should use a cold wallet
A rough rule from the security community: if you'd be upset to lose it, cold-store it. More concretely, move funds to a cold wallet when your on-exchange or hot-wallet balance exceeds what you can afford to lose to a single phishing click, browser exploit or exchange insolvency. For most people that threshold is somewhere between $500 and $2,000.
Picking a cold wallet
The five things that actually matter: (1) does it use a certified Secure Element, (2) is it open-source, (3) does it support passphrases and multi-sig, (4) is the supply chain tamper-evident, and (5) does the companion app support the coins you actually hold? We rank every current device on exactly these axes.
See the full 2026 hardware wallet comparison
Ledger, Trezor, BitBox02, Coldcard, Keystone, OneKey, Tangem and NGRAVE — scored on Secure Element, open-source, air-gap, price and passphrase support.
Compare cold wallets →FAQ
Is a cold wallet the same as a hardware wallet?
Almost. Every hardware wallet is a cold wallet, but "cold storage" also includes paper wallets and air-gapped computers. For most users in 2026, cold wallet = hardware wallet.
Can a cold wallet be hacked?
Remotely? Almost never — the key isn't online. The realistic risks are supply-chain tampering (buy direct from the manufacturer), malicious firmware, blind-signing sketchy contracts, and physical coercion (see our wrench attack archive).
What happens if my cold wallet is lost or destroyed?
Nothing, if you kept the seed phrase safe. Any BIP-39 compatible wallet can restore your funds from the same 12- or 24-word backup. The device is replaceable — the seed phrase is not.
Do I need a cold wallet for small amounts?
Not really. A cold wallet makes sense once the amount at stake is larger than what a phishing click would cost you to replace. Under $500, the friction usually isn't worth it.