What Is a Cold Wallet and How Does It Differ from a Hot Wallet?

A crypto wallet is a device or software used to reach crypto assets. According to investor.gov, a wallet does not hold the asset itself but a "private key", a password. Creating a wallet produces two keys. The private key authorizes transactions. The public key lets others send assets to you and is likened to an email address. A private key cannot be changed later; if it is lost, access to the assets in the wallet is permanently lost.

The hot and cold distinction depends on whether these keys are kept in an environment connected to the internet.

A hot wallet is a crypto wallet connected to the internet; it can be a desktop, mobile or web application. investor.gov says these wallets give easy access for transactions but expose the assets to cyber threats. bitcoin.org notes that desktop wallets are vulnerable to malware, and that on mobile wallets, damage to or loss of the device can lead to loss of assets.

A cold wallet is a mostly physical tool that is not connected to the internet. investor.gov gives a USB drive, an external disk and a sheet of paper as examples. bitcoin.org calls a wallet kept off the network an offline wallet, also known as cold storage.

• Hardware wallet: bitcoin.org describes these as small devices designed only for wallets, on which no other software can be installed. ethereum.org says the private key never touches the internet and stays on the device.
• Offline computer: the full wallet that signs transactions sits on a computer that is not connected to a network. A connected computer holds only a watch-only wallet that prepares unsigned transactions (bitcoin.org).
• Other media, such as paper: investor.gov also counts a sheet of paper as an example of cold storage.

Each type faces different risks. investor.gov says cold wallets are generally safer against cyber threats, but the physical device can be lost, damaged or stolen, which can cause permanent loss. bitcoin.org says a backup is the way to restore funds when a device is lost; without one, that route is gone.

Keeping a key offline does not check the content of the transaction being signed. ethereum.org says to confirm that the address is exactly right before sending, to read the transaction message before signing when working with a smart contract, and not to grant unlimited spending permission. These checks belong to the person signing, whatever the wallet type. Storing the recovery phrase (seed phrase), which rebuilds a wallet if the device fails, is a separate matter covered in the seed phrase guide.

The question depends less on whether the wallet is hot or cold than on who holds the keys. investor.gov distinguishes two models. In self-custody, you manage the private keys and are solely responsible for their security. In third-party custody, the exchange or custodian manages access to the keys. The institution may hold assets in cold wallets, hot wallets or a mix of both; if it is attacked, closes or goes bankrupt, access to the assets can be lost.

bitcoin.org puts the same point this way: when a third party controls your keys, you depend completely on its security and honesty. Exchanges and online wallets have been seen to be attacked, to collapse or to freeze access.

Law No. 7518 (adopted 26 June 2024; published in the Official Gazette on 2 July 2024, issue 32590) defines crypto asset service providers as platforms and entities that offer custody services. A custody service means storing or managing platform customers' crypto assets, or the private keys that give the right to transfer assets from a wallet. Providers must obtain permission from the competent authority before they are established and begin operating; operating without permission carries 3 to 5 years in prison and a judicial fine.

The law also sets 8 to 14 years in prison for members of a service provider who misappropriate crypto assets that the provider was obliged to hold in custody. It also states that a permit to operate does not mean the transactions are under public assurance, and that crypto assets are not subject to investor compensation provisions. The law's custody definition covers the custody a provider offers to platform customers. This section is not a legal opinion; check the current legislation and secondary regulations for later changes.

investor.gov lists four questions for people considering self-custody. They do not point to an answer; they are a checklist for weighing your own situation:

• Can you set it up and maintain it? Setting up and running a wallet alone may require technical knowledge.
• Do you want full responsibility? Keys and recovery phrases are entirely in your hands; if they are lost or stolen, access can be lost.
• Which wallet type? Convenience and security needs are weighed together.
• What does it cost? Physical cold wallet devices usually have a price, while hot wallets may be free to start with; transactions carry fees.