Hot vs Cold Wallets

Hot Wallet Feature: Online Spend

A hot wallet is any app or service that stores private keys on an internet-connected device, like a phone, laptop, or browser extension, and it is directly exposed to the risks of that device. If an attacker can get a hot wallet user to sign a transaction at the wrong place, the funds are already vulnerable.

Phishing tricks the user into visiting a fake website or app, clipboard malware can change the receiving address on copy-and-paste.

Cold Wallets Are for Holding, but Not Foolproof

A cold wallet keeps your keys offline, storing the private key on a hardware device that is never connected to the internet . This protects against keyloggers, screen scrapers, and other attacker-powered risks that see, copy or alter.

Once a user signs the transaction at their device, open on the screen or not, that signature is enough to finalize. If an attacker routes that offline signature through a compromised hot wallet, it can sign instantly.

Real Attacks on Cold Wallets

• SMS-based 2FA doesn't adequately protect.
• Fake wallet Apps can still steal funds signed via a hardware wallet – if a user enters the seed into a fake recovery page or app. Cold storage doesn't stop this risk!

Cold signers are still only good as the approval check that the user can make. No hardware wallet prevents all risks.

Storing Your Balance

Keep holdings compatible with the usual attack defenses. Approving a transaction like that, you can be sure not only that your keys are offline, but that you're only moving them to the right recipient. That's the final check, if you use both kinds of wallet effectively.