Both hold the same thing, a private key, and both can lose it. What changes is how exposed that key is, how much friction sits between you and a payment, and what happens when you restore from a backup.
The European Central Bank reported that 9.7% of euro area consumers said someone in their household owned crypto-assets in late 2024, and that 54% of owners held under EUR 1,000. For most readers, this is a practical storage decision, not a vault-design project.
Hot and cold describe where the key lives
A hot wallet keeps your private keys on a device connected to the internet, usually a phone or a browser.
Any online crypto wallet, including every exchange balance and every hot wallet app on your home screen, falls into this group. The keys are reachable by software, which is what makes signing a payment take three seconds.
A cold wallet keeps the keys on something that never connects. A hardware device that signs over USB or via QR codes and words written on metal in a drawer are both offline crypto wallet designs. The appeal of a cold storage crypto setup is that malware on your laptop cannot read a key that was never on your laptop.
Think of the cash in your pocket against the cash in a safe at home. The pocket money is exposed because it moves; the safe is slower because it is meant to be. Neither helps if you open the safe for the wrong person.
horizontal scroll
| Hot wallet | Cold wallet | |
|---|---|---|
| Where the keys sit | On an internet-connected phone, browser or server | On a device or medium that never connects |
| Typical form | Mobile or browser app, exchange balance | Hardware device, metal or paper backup |
| Who holds the keys | You, or a provider if the wallet is custodial | Almost always you |
| Time to make a payment | Seconds | Minutes, with the device in hand |
| Main way funds are lost | Malware, phishing, and malicious transactions you approve | A recovery backup that is lost, damaged or copied |
| EU custody duties | MiCA Article 70 applies where a provider holds the keys | None, because no provider is involved |
| Suits | Everyday spending and incoming payments | Balances you do not expect to move |
How hot and cold wallets compare on the points that decide everyday use.
Source: custody row from ESMA Interactive Single Rulebook, MiCA Article 70, 2023; other rows describe standard wallet designs.
Internet exposure and custody are two different questions
Hot and cold describe exposure. Custodial and self-custodial describe who holds the keys. The two get mixed together constantly, and the mix-up costs money.
A reader in Valencia who buys EUR 300 of bitcoin on a licensed European platform has not chosen a hot wallet at all. They have chosen a custodial arrangement in which the provider holds the keys and the balance is recorded in that provider's records. That makes the hot wallet vs custodial wallet comparison a separate one, with different risks: a self-custodial hot wallet can be drained by malware on the phone, while a custodial balance depends on the provider staying solvent.
EU rules put a floor under the custodial side. Under Article 70 of the Markets in Crypto-Assets Regulation, an authorised crypto-asset service provider must protect clients' crypto-assets and their means of access, keep client funds separate from its own, and not use client assets for its own account, with insolvency specifically in mind. It works like a left-luggage office where the attendant must, by law, keep your bag apart from the shop's stock. Useful, and still not the same as holding the key yourself.
A hardware wallet narrows the risk, but it does not remove it
The common question, ‘Is a hardware wallet always cold?’, has a short answer: no. A device is cold while the key stays on it, and the signing happens on its own screen.
Plug it into a compromised computer, approve what that screen shows without reading it, and the attacker has a valid signature from a perfectly cold device. The hot wallet vs cold wallet security gap is narrower than it looks, because crypto wallet security is really about approvals.
ENISA's Threat Landscape 2025 found phishing to be the leading route into EU systems, at around 60% of observed intrusions between July 2024 and June 2025. A fake support page or a routine-looking signature request does not care which kind of wallet you hold.
The second gap is the backup. Does a cold wallet need a recovery backup? Everyone does, and that phrase is the only way back in when a device is lost, broken or locked behind a forgotten PIN.
Anyone who reads it has the funds. Someone in Dublin who photographs the twelve words, or types them into a notes app that syncs to the cloud, has turned a cold wallet into an online one. Trezor's guidance on keeping a wallet backup safe is worth reading before you set anything up.
Its core points:
- Write it once, by hand, and never photograph or store it digitally.
- Use a durable material, because paper does not survive fire or flooding.
- Keep it somewhere only you can reach.
- For larger holdings, split them into separate holdings.
Matching the wallet to how the money moves
Which wallet suits everyday crypto use depends on how often the balance moves. Money that moves weekly belongs somewhere you can reach in seconds; money that is going nowhere for a year does not.
Take a freelance motion designer in Tallinn, invoicing around 1,200 USDC a month to EU clients.
Keeping all of it on a hardware device means fetching that device whenever an invoice lands; keeping all of it on a phone means that a stolen or infected handset can take the year's income.
So, can I use hot and cold wallets together? That is the normal arrangement, and it comes down to three decisions:
- The hot side holds incoming payments and anything due to be spent soon.
- The surplus moves to cold storage and stays there.
- A ceiling on the hot side: an amount you could absorb losing, set once rather than judged every time.
Frequently asked questions
What is the difference between a hot wallet and a cold wallet?
A hot wallet stores private keys on an internet-connected device, so payments take seconds and the keys are reachable by software. A cold wallet keeps them on hardware or paper that never connects, adding friction and removing the remote-access route.
How do internet exposure and custody differ?
Exposure is about whether the keys touch the internet; custody is about who holds them. A balance at an exchange is someone else's key under EU safekeeping rules, while a self-custodial hot wallet is your key on your phone.
Does a hardware wallet eliminate every security risk?
No. It protects the key from software on your computer, but it signs whatever you approve on its screen. Phishing can target hardware wallets, and a readable backup can defeat the device.
Which wallet setup is more convenient for everyday transactions?
A hot wallet. Fetching a hardware device and confirming on a small screen is fine once a month and tiresome several times a week.
Can you use a hot wallet and cold storage together?
Yes, and it is the usual arrangement. Keep a working balance hot for incoming payments, move the rest to cold storage, and cap the hot side at what you could absorb losing.
What recovery risks should you consider before choosing a wallet?
Three main ones: losing the backup, someone reading it, and storing it digitally, where it can be copied. Test a restore before the balance grows.
What should you verify before moving crypto between wallets?
The receiving address is checked on the device screen rather than the computer screen, on the network you are sending over, and with a small test transfer. A confirmed transfer cannot be reversed.
