What Is a Cold Wallet? Hot vs Cold Wallets for Beginners

A cold wallet keeps the private keys that control your crypto offline, usually on a small hardware device, while a hot wallet keeps them on an internet-connected phone or computer. Hot wallets are quick and convenient for small, frequent payments. Cold wallets are slower to use but much harder to attack remotely, so they suit money you plan to hold.

This guide covers the basics in plain English: what a wallet really holds, how hot and cold wallets differ, how a hardware wallet works, how to buy one without inheriting someone else’s problem, and a setup checklist for your first device. It doesn’t recommend any brand.

What does a crypto wallet actually hold?

A crypto wallet holds keys, not coins. Your coins are recorded on the blockchain itself. The wallet stores the private key, a secret number that proves you control an address and lets you sign transactions that move funds from it.

That is why the question that matters is where the key lives. If the key sits on a device connected to the internet, anyone who breaks into that device can try to use it. If the key never leaves an offline device, a remote attacker has nothing to steal.

Your recovery phrase (also called a seed phrase) is a human-readable backup of those keys. Bullrunners covers it in detail in What is a seed phrase?.

What is the difference between a hot wallet and a cold wallet?

A hot wallet keeps its keys on an internet-connected device; a cold wallet keeps them offline. Ledger, a hardware wallet maker, describes cold wallets as suited to protecting high-value crypto long term, because the keys stay offline. Hot wallets trade some of that protection for speed and convenience.

There is also a third option most beginners start with: an exchange account. It isn’t a wallet you control at all.

	Exchange account	Hot wallet	Cold wallet
Who holds the keys	The exchange	You, on a phone or computer	You, on an offline device
Typical form	Coinbase, Kraken and similar apps	Phone app or browser extension	Hardware wallet
Cost	Free to open	Usually free	You buy the device
Speed	Fast	Fast	Slower; needs the device in hand
Main risk	Freezes, hacks or failure at the exchange	Malware, phishing, a compromised phone	Losing the recovery phrase, buying a tampered device
Good for	Buying and selling	Small, everyday amounts	Money you plan to hold

With an exchange, your balance is the company’s record of what it owes you. Bullrunners has covered what that means in practice in what happens when an exchange freezes your account.

Many holders use more than one. A common pattern is a small hot wallet for day-to-day use and a cold wallet for the bulk of their holdings.

How does a hardware wallet keep keys offline?

A hardware wallet signs transactions inside the device, so the private key never leaves it. According to Ledger’s description of how hardware wallets work, the device signs transactions offline and then passes the signed transaction to an internet-connected device, and its keys are protected by a dedicated chip called a Secure Element. The phone or computer it connects to only broadcasts a transaction that is already signed.

That means malware on your laptop can’t simply copy the key. It also means you confirm each transaction by pressing buttons on the device itself, after reading the details on its own screen.

Two other points are worth knowing:

• The device is replaceable. Ledger notes that even if you lose the physical device, you can regain access by importing your recovery phrase into a new hardware wallet. Lose the device, keep the phrase, and your crypto is fine.
• “Cold” depends on how you use it. Ledger says that once you connect an account to a smart contract or decentralized app, that specific account is no longer a cold wallet. A simple habit follows: keep one account on the device for storage only and use a separate one for apps.

What does a cold wallet not protect you from?

A cold wallet protects your keys, not your judgment. It will sign whatever you approve.

• Wrong addresses. If you paste a lookalike address, the device will display it accurately and sign it. Bullrunners explains this scam in address poisoning.
• Malicious approvals. Signing a request from a scam website can give it permission to move your funds. Bullrunners explains how in its guide to crypto wallet drainers.
• A leaked recovery phrase. Anyone with the phrase can rebuild your wallet on their own device. Typing it into a phone, computer or website breaks the whole point of keeping keys offline.
• A tampered device. If someone had the device before you, the keys may have been compromised from day one.

How do you buy a hardware wallet safely?

Buy it directly from the manufacturer’s own website. Manufacturers also publish lists of authorized resellers, but buying direct gives you the shortest, easiest-to-prove route from factory to you.

The reason became concrete in October 2026. Ledger confirmed that devices sold through CryptoBilis, a reseller in Southeast Asia, contained a hidden hardware implant that captured recovery phrases during setup, and linked confirmed thefts to those devices. Loss estimates in news reports vary, and Ledger said it was still reviewing other reports. Bullrunners covered it in Ledger hidden chip attack: 4 checks. Reports on the case also noted that Ledger’s in-app genuine check passed on the implanted devices, because it checks the chip, not the device’s physical history.

What to look for on arrival:

• No pre-set PIN or phrase. A new, genuine device should never arrive with a recovery phrase or PIN already set, or with a pre-filled recovery card. If one does, don’t use it.
• Intact packaging. Trezor’s support pages tell buyers to check that the holographic seal is not torn or missing. If any package looks opened or altered, stop and contact the maker’s support.
• No firmware surprises. Trezor says its devices ship without firmware, and that if firmware is already installed the device should not be used.
• No second-hand devices. You can’t prove where a used device has been.

First-time setup checklist

Menus differ by device and labels may differ in the current version, so follow your maker’s official setup guide alongside these steps.

1. Check the box for intact seals and anything unexpected, such as a pre-filled recovery card.
2. Download the companion app only from the manufacturer’s site or your phone’s official app store.
3. Choose “set up as new device” and let it generate a fresh recovery phrase on its own screen.
4. Write the phrase on paper, in order. Never photograph it, type it or store it in the cloud.
5. Set a PIN that isn’t your birthday or phone code.
6. Receive a small test amount first (for a new XRP account, at least 1 XRP), and confirm the receiving address on the device’s screen.
7. Practice a small send back to yourself before moving anything meaningful.
8. Keep the device and the phrase in different places, so one theft or fire doesn’t take both.

What to check next

If you already own a hardware wallet, find the receipt and confirm it came from the manufacturer directly. Ask yourself whether your recovery phrase has ever been typed, photographed or stored online. If it has, it is no longer cold. And if you hold XRP, learn how XRP Ledger accounts and reserves work before your first transfer to a new wallet.

Sources

• Ledger Academy: What is a cold wallet?
• Trezor Support: Is my device safe to use?
• BleepingComputer: Ledger confirms spy chip implant behind wallet crypto thefts (Oct 2026)
• SEC Investor.gov: Crypto Asset Custody Basics for Retail Investors
• XRP Ledger docs: Reserves