Does buying a hardware wallet mean you have a cold wallet?
A hardware wallet plugged into a computer over USB and set up through the companion software: is that still a cold wallet?
It is, but with conditions, and the conditions have to do with how you use it and not with the device. Equating cold with hardware and hot with software is easy to remember, yet it misses the situations where mistakes happen. The sections below first pin down the definition, then go through five cases the definition settles, and finally cover how to split money into tiers and move it between them.
Defining cold and hot: is the device holding the private key online when it signs?
The definition is one sentence: at the moment of signing, is the device that holds the private key connected to the internet? If it is, the wallet is hot. If it is not, the wallet is cold.
With a wallet app on a phone or an extension wallet in a browser, the private key is stored on that online device and signing happens there too, so it is hot. A hardware wallet keeps the private key inside the device, and the device itself does not go online: the transaction to be signed comes in from outside, is signed internally, and only the signature goes out. It is cold, and it stays cold when used plugged into an online computer, because what is online is the computer and not the device that stores the private key.
One more rule follows from the definition: once a private key or seed phrase has appeared on an online device, treat it as hot. Typing it on a phone, photographing it, or copying and pasting it all count. You have no way of confirming that the device kept no copy, and putting the key into even the best hardware wallet afterwards does not change that.
To judge whether a wallet you hold is cold or hot, ask two things. First, when it signs now, is the private key on an online device? Second, has this private key or its seed phrase ever appeared on an online device in the past? Only if both answers are no is it cold.
Five cases the definition settles
Is a hardware wallet always a cold wallet?
In normal use, yes: the seed phrase is generated on the device, signing is done inside the device, and the private key never leaves it.
There are two cases where it is not. One is when you did not generate the seed phrase on this device with your own hands: someone set it up for you, say, or a ready-made seed phrase came in the box. Someone else has that key too, so it cannot be called cold, and a device like that should not be used. The other is when you have typed this device's seed phrase into a phone, a computer or any web page. By the rule above, it is already hot.
Can a computer with the network turned off serve as a cold wallet?
Turning off Wi-Fi is not enough. The computer has been online before, and you do not really know what has been installed on it or left behind. Bluetooth and any USB stick you plug in are data channels as well. To use a computer as a cold device properly, it has to be a dedicated machine with a clean system installed that never goes online again. That is far more trouble than buying a hardware wallet, and easier to get wrong.
Does a cold wallet mean you cannot lose coins?
No. A cold wallet protects the online side: malware cannot read the private key. It does not protect the physical side: the seed phrase backup being burned, lost or found by someone, or you handing it over under duress. Nor does it protect you from confirming the wrong transaction on the device. With a cold wallet, the thing to worry about shifts from whether the computer is clean to whether the backup is stored securely; see how to store your seed phrase.
How much money can a hot wallet hold?
First be clear which kind you mean. Using a browser extension as the interface while a hardware wallet does the signing keeps the private key in the hardware wallet. That is cold use, and this limit does not apply to it.
A true hot wallet is one where the private key is stored directly on the phone or in the browser. It should hold only an amount whose loss would not affect your life. The reason is not purely technical: a hot wallet is so convenient that you confirm things and sign approvals without a second thought, which leaves more room for mistakes.
Can you transfer directly between a cold wallet and a hot wallet?
Yes, and it is no different from any other transfer: enter the address, sign, broadcast. When a cold wallet sends, the signing is done on the cold device, the private key stays inside it, and afterwards it is still cold. There is only one thing to watch: is the recipient address really the address of your own other wallet? When a transfer between tiers goes wrong, this is usually where, and the next section deals with it.
How to split funds between cold and hot, and how to move between them
Keep everything in a cold wallet and you have to dig the device out every time money moves. Keep everything in a hot wallet and one incident takes it all. The middle course is to split by purpose, with a different wallet for each tier.
What goes in each of the three tiers
Everyday tier (hot). Money you will use soon, for fees and small on-chain actions. The ceiling is an amount whose loss would not affect your life. Use a mobile wallet or an extension wallet.
Working tier (semi-cold). The private key is in a hardware wallet, but the device is connected to an extension wallet on a computer and used to interact with on-chain applications. This holds money that will not move in the near term but occasionally takes part in things like staking.
Long-term tier (cold). Money you intend to leave for years. A separate hardware wallet that only receives coins and occasionally sends a transfer, connects to no on-chain application and signs no contract approvals. The seed phrase gets a metal backup, kept in two places.
Semi-cold
is not a separate definition. By the definition above, the working tier and the long-term tier are both cold, with the private key in an offline device in each case. They differ in use: the working tier signs requests handed to it by all sorts of applications, so its chance of being tricked into signing a malicious approval is far higher than the long-term tier's. Keeping the two uses on two devices and two seed phrases means a problem in the working tier does not drag the long-term tier down with it.
Steps for moving money between tiers
From hot to cold (adding to the long-term tier): display the receiving address on the cold wallet, enter it in the hot wallet, then check the full address character by character against the cold wallet's screen. Send a small amount first and confirm on the cold wallet side that it arrived. Then send the rest.
From cold to hot (taking money out to use): decide how much you need first and take out only that. On the cold wallet's screen, check the full recipient address and the amount character by character before pressing confirm.
Once the tiers are set up, let money flow towards the cold side as far as possible. Never import the seed phrases of two tiers into the same device, even at different times; the tiers should deal with each other only through on-chain transfers.
The step people most want to skip when moving between tiers is the small first transfer, on the grounds that it is my own address, it cannot be wrong
. But the address was copied by hand or copied and pasted, and one wrong character, or a different address pasted in, is entirely possible. Money sent to the wrong address is almost never recovered.
I suggest making it a rule: the first transfer between tiers is always small, and the large one follows only after the other side confirms receipt and the full address has been checked character by character. Think of the extra fee as an insurance premium.
Cold, semi-cold and hot use compared
Here are the three ways of using a wallet side by side. By definition the first two columns are both cold wallets; they are listed separately because the use differs and so does the risk exposed.
| Item | Cold: receiving and sending only | Semi-cold: hardware wallet connected to on-chain apps | Hot: private key on the phone or in the browser |
|---|---|---|---|
| Where the private key is | Inside the hardware wallet | Inside the hardware wallet | On an online phone or computer |
| Is the device holding the key online when signing? | No | No | Yes |
| Can malware on an online device read the private key? | No | No | Yes |
| Can you be tricked into signing a malicious approval? | With no apps connected and no approvals signed, very unlikely | Yes, and this is its main risk | Yes |
| If the device is lost or broken | Restore from the seed phrase backup | Restore from the seed phrase backup | Restore from the seed phrase backup; with no backup, it is gone |
| In use | The device has to come out every time | The device has to come out, but all kinds of on-chain apps are usable | A few taps on the phone |
| Money it suits | The bulk that stays put long term | The part that is not moving soon but needs occasional action | Small amounts for use soon |
| What it costs | One hardware wallet; for list prices see the hardware wallet comparison table | Same as the column to the left | Nothing extra |
| Where things usually go wrong | The seed phrase backup is lost, miscopied or found by someone | Signing a malicious contract approval | Phishing sites, malware, typing the seed phrase somewhere it should never go |
If the private key is in a hardware wallet and you routinely connect to on-chain applications through wallet software on a computer, the middle column is the one you are using. It blocks the private key being read. It does not block being tricked into signing a bad approval. For how to check and revoke approvals, see how to check and revoke token approvals.
If you want the signing device never to touch even a data cable, there are hardware wallets that pass data only by QR code or memory card. For example, the official Keystone 3 Pro product page describes transferring data offline through QR codes and a microSD card, and the Coldcard site says its microSD, NFC and USB channels are all off by default when the device ships. This further reduces the channels between the signing device and online devices, but the transaction to be signed still comes from the online side, and the address and amount on the screen still have to be checked by you.
First work out which one you are using now
Go through the table above and see which column each part of your money currently sits in, then ask whether it belongs there. If the bulk that never moves is still in a hot wallet, or the device for the long-term tier is in fact connecting to applications every day, shift things around along the lines of the tiers described above.