Cold wallet vs hot wallet: which one you really need and how not to lose your crypto

When you buy bitcoin, nothing travels to your phone. The coin stays recorded on the blockchain, and the only thing that changes is who can sign the next transaction. That signature comes from a private key. A wallet is basically a key ring: it creates those keys, stores them and signs with them when you tell it to.

That gives you the first big split. If you leave your crypto on an exchange, the platform holds the keys and you hold an account with a balance written next to your name: that's third-party custody. If you move it to a wallet of your own, you hold the keys: that's self-custody. Neither is bad by definition, but you should know what you're choosing and which risk comes with it.

The risk of someone else's custody isn't theoretical. In November 2022, FTX stopped processing withdrawals and filed for bankruptcy on the 11th; its customers lost access to what they had deposited. And on September 24, 2026, Bitget, an exchange with no MiCA license, had about $388 million stolen from its hot and warm wallets, which it says its user protection fund covers. In Spain, MiCA's transitional period ended on June 30, 2026: since July 1, only authorized platforms can operate, and they must legally separate their customers' crypto from their own assets. That's real progress, but it isn't a guarantee fund: I go through it in the guide to the MiCA rules.

Self-custody is the mirror image. Nobody can freeze your account or ask for paperwork before you move your money, and nobody will give it back if you lose your seed or sign something you shouldn't have. You are the bank, with everything good and bad that comes with it.

Wallet vs Exchange: dónde guardar tus criptos DE VERDAD (y no perderlas)12:15

A hot wallet creates and uses its keys on an internet-connected device: your phone, your browser or your computer. A cold wallet creates and stores them on a device that never exposes them to the network, usually a hardware wallet. The key word is expose: a hardware wallet plugs into your computer over USB or connects over Bluetooth, but the private key never leaves it.

In practice the decision comes down to the two questions I raise in the video: how much money you have and how you use it. There's no single best wallet for everyone; there's a best one for your situation, and quite often the answer is to use both.

Wallet FRÍA vs Wallet CALIENTE: cuál necesitas de verdad (guía 2026)11:07

Watch out for a false sense of security. A cold wallet is only as cold as your backup: if you photograph the seed and your phone uploads the picture to the cloud, you've just turned it into a hot wallet. And the device itself can fail where you least expect it, as Coldcard showed in July 2026, or reach you already tampered with, like the Ledger devices an Asian reseller was selling in October. Further down I explain what happened and what to learn from it.

Hot wallets

• Mobile apps. Handy for everyday use and payments. Their weak spot is the phone itself: if it gets infected, or someone sees your screen while you write down the seed, it's over.
• Browser extensions, such as MetaMask. They're the gateway to DeFi and to Ethereum-compatible networks. Their enemies are cloned websites, fake extensions and the signatures you don't read.
• Desktop software. Useful for managing several accounts or for connecting a hardware wallet. It inherits every problem of the computer it runs on.
• Your exchange account. Technically it isn't your wallet: it's third-party custody, even if the app calls it a “wallet”.

Cold wallets

• Hardware wallets (Ledger, Trezor, Coldcard, BitBox, Tangem and the rest): dedicated devices that create the seed and sign internally. Each brand has its own approach, its own screen and its own history of controversies.
• Air-gapped devices: they never connect to a computer, by cable or by radio. They exchange transactions through QR codes or microSD cards, usually in PSBT format (BIP-174, the partially signed bitcoin transaction).
• Paper wallets: a printed key. They were popular years ago and today cause more problems than they solve: they're printed from a computer that may be compromised, they degrade, and spending from them correctly isn't trivial.

I'm not going to give you a ranking here: I have them on video and in two guides, best cold wallets and best hot wallets, with prices, real drawbacks and who each one is for. What I will tell you is that any serious brand does the job if you buy it the right way, set it up yourself and protect the seed. The rest of this guide is about exactly that.

My 2026 top picks: hot wallets and cold wallets

8:50

Las 5 MEJORES wallets calientes para tus criptos en 2026 (cuál elegir sin liarte)

Jul 15, 2026 · 2,929 views

9:10

Las 5 MEJORES wallets frías para proteger tus criptos en 2026 (máxima seguridad)

Jul 19, 2026 · 718 views

Almost every modern wallet follows the BIP-39 standard. When you create a wallet it generates between 128 and 256 bits of randomness, adds a small checksum and cuts the result into 11-bit chunks. Each chunk is a number from 0 to 2047, and each number maps to a word on a list of 2,048 words. 128 bits give you 12 words; 256 bits give you 24. The standard also allows 15, 18 and 21-word phrases.

All your keys and addresses are derived from that phrase, which is what BIP-32 deterministic wallets do. That's why a single backup restores every account in any compatible wallet, even if the original device ends up at the bottom of a river. And that's why anyone who reads it has exactly the same power you do.

Two details few people mention. First: on the English list the first four letters are enough to identify every word, so write them down with real care. Second: there are official lists in other languages, Spanish included, but BIP-39 itself strongly discourages anything other than the English list, because most wallets only support that one.

Then there's the passphrase, sometimes called the “25th word”. It's optional and gets combined with the seed (through PBKDF2 with 2,048 iterations, if you're curious) to open a different wallet. Any passphrase produces a valid wallet, so if you mistype it you won't see an error: you'll see an empty wallet. Used well, it protects you from whoever finds your backup; stored badly, it locks you out.

Private key

The secret number that signs transactions for an address. Whoever has it can move the funds.

Seed phrase

The 12 or 24 words (BIP-39) all your keys come from. It's the master backup.

Passphrase

An optional password that, added to the seed, opens a different wallet. Forget it and nobody can recover it.

Address

What you share to get paid. You can show it safely; the seed, never. More terms in the glossary.

Protecting the seed doesn't take an engineer; it takes discipline and zero shortcuts. Here's a sensible process from minute one, whether you use a hardware wallet or a hot wallet:

1. 01

   Generate it yourself, in private

   Create the seed on the device itself, with no cameras pointed at you and nobody watching. If the box comes with words already written down, or someone “gives” you a seed, don't use it: it's a trap.

2. 02

   Write it by hand, numbered

   Use the maker's recovery card or plain paper. Number the words and check the spelling letter by letter before moving on.

3. 03

   Verify the backup

   Use the device's own backup check if it has one. Before you put in a serious amount, do a small round-trip transaction.

4. 04

   Move it to metal

   A steel plate, engraved or stamped, survives fire and water far better than paper. Keep it somewhere out of sight.

5. 05

   Never digital

   No photos, no cloud, no email, no phone notes, no password managers. MetaMask says it plainly: storing it online isn't safe.

6. 06

   Keep the passphrase apart

   If you use a passphrase, store it somewhere other than the seed. Together they're the full key; separately, neither one is enough.

7. 07

   Decide who knows

   More copies and more people make it easier to recover and easier to steal. Find the balance and write it into your inheritance plan.

8. 08

   Review it once a year

   Check that the backup is still legible, that you know where it is and that the device runs up-to-date firmware downloaded from the official site.

My MetaMask tutorial has a whole chapter on this, “Cómo guardar tu frase semilla SIN liarla” (how to store your seed phrase without messing it up), starting at 6:49. If this is your first wallet, watch it before you move a single euro.

Cómo Crear tu Wallet MetaMask y Pasar Dinero del Exchange sin Perderlo20:30

The whole point of a cold wallet is splitting the work. The app on your computer or phone does the “dirty” jobs: it checks balances, builds the transaction and broadcasts it to the network. The device does one thing only: it signs. The flow looks like this:

1. The app builds the unsigned transaction: destination address, amount and fee.
2. The device receives it and shows it on its own screen.
3. You check the details and confirm with the physical buttons.
4. The device signs internally and sends back only the signature.
5. The app broadcasts the signed transaction to the network.

On air-gapped models, steps 2 and 4 travel inside a QR code or on a microSD card holding a PSBT file. The result is the same: the private key never touches an internet-connected device.

And one limit to keep very clear: a hardware wallet protects the key, not your judgment. If you approve a malicious contract that asks for permission to move your tokens, the device will sign it just as obediently. And if the seed was badly generated from day one, no chip can fix that afterwards.

Coldcard: the flaw was in the randomness

In August I published a video with an uncomfortable question in its title: “¿Qué ha pasado con Coldcard? ¿Tú dinero está en peligro?” (What happened with Coldcard? Is your money in danger?). The short answer: it wasn't the chip, it was the seed.

According to the official advisory from Coinkite, the manufacturer, published on July 30, 2026 and updated afterwards, the devices were not hacked or taken over remotely. When the firmware was migrated in March 2021 (version 4.0.1), a build error meant seeds were generated with a software random number generator instead of the device's hardware one. The result: about 40 bits of entropy on the Mk2 and Mk3 and about 72 on the Mk4, Mk5 and Q, instead of the intended 128. With that little randomness, attackers could recompute those seeds on their own, without touching the devices.

The first drain came that same July 30: 1,196 addresses in 41 minutes. There were four waves and, according to Galaxy Research's tally as reported by TRM Labs, roughly 1,816 BTC, close to $116 million, left more than 5,200 addresses (other estimates range from $89 million to $130 million). It was spotted by the security team at Block, the company behind the Bitkey wallet, and Coinkite believes the attacker used artificial intelligence to find the bug. Bitcoin's cryptography was never broken.

¿Qué ha pasado con Coldcard? ¿Tú dinero está en peligro?7:15

The lessons apply to any brand. What matters is which firmware you used to generate the seed, not the one you run today: updating doesn't fix a weak seed. The fixed releases are 4.2.0 on the Mk2 and Mk3, 5.6.0 on the Mk4 and Mk5 and 1.5.0Q on the Q; since 5.6.1 and 1.5.1Q, the device also makes you add your own entropy. Coinkite doesn't consider seeds created with at least 50 private dice rolls to be at risk. If that's not you, it's time to migrate: a new seed on fixed firmware, a test transaction, then the rest. Follow Coinkite's official advisory, not the first thread you come across on social media. As of October 17 it hadn't announced any compensation; it says it is supporting affected users directly.

Ledger: devices tampered with before reaching the buyer

On October 9, 2026, Ledger began investigating thefts from customers who had bought its devices from CryptoBilis, an official reseller in Southeast Asia. A few days later it confirmed what was inside: an implant hidden in the casing that read the 24 words off the screen while the buyer set the device up and sent them out over the mobile network using an eSIM. It didn't touch the secure chip or alter transactions, and Ledger's authenticity check (Genuine Check) doesn't catch it, because the original chip is still intact.

On-chain estimates of the losses range from $72 million to $93 million across more than 300 wallets, figures Ledger hasn't verified. The company says every confirmed loss comes from CryptoBilis devices, and that reseller stopped selling; Ledger also asked resellers in seven Asian markets to suspend sales. In Europe, MediaMarktSaturn pulled Ledger devices from sale on October 13 as a precaution, in coordination with Ledger, after a customer report in Germany; sources disagree on whether the move covers all its countries, and no losses have been linked to those stores. Trezor, with no evidence its own devices are affected, will cut back its reseller network, whose authorizations end on January 1, 2027. As of October 17 the story is still developing; the technical breakdown is on BleepingComputer.

If you bought from CryptoBilis, Ledger asks you not to set the device up and, if you already did, to move your funds to another device with a new seed. For everyone else, the lesson is the same as with Coldcard: the weak spot isn't always the chip. It can be how the seed was generated, or whose hands the device passed through before it reached yours.

Ledger's and Trezor's customer data leaks

Both brands I link to in my videos have suffered customer data leaks, and it's the first thing I cover in my comparison of the two. None of them exposed seed phrases or keys, but all of them handed scammers what they need for convincing phishing: your name, your email and sometimes your home address.

There are more drawbacks worth knowing before you buy. In 2023 Ledger launched Ledger Recover, an optional paid service that encrypts your seed and splits it among three companies, with an ID check; the controversy was that it made clear the firmware can extract the seed from the secure chip. And in March 2025 Trezor disclosed that Ledger's security team had bypassed some of the Safe 3's anti-tampering protections with a physical attack (the Safe 5 isn't affected), another reminder that it matters who has had the device before you. The full head-to-head, with the good and the bad of each, is in Ledger vs Trezor.

As you've just seen, the first attack on a cold wallet can happen before you open the box. A second-hand device, or one from an unknown seller, can arrive tampered with, carrying modified firmware or a seed generated by someone else. I repeat it in my video descriptions:

“

IMPORTANT: buy your cold wallet ONLY from the manufacturer's official website (Ledger, Trezor, Tangem...). Never second-hand or from third parties.

Manufacturers say the same thing. Trezor, for example, explains on its support page that its devices ship without firmware installed, that the seed is generated during setup and that you should never buy from an unauthorized third party, because you can't know who has had the device in their hands.

Signs you should send it back, no questions asked

• It comes with a card that already has words on it, or it asks you to use a “factory” seed.
• It already has a PIN set up, or firmware you didn't install yourself.
• The seal or the packaging is damaged, or doesn't look like what the manufacturer shows.
• It asks you to type the seed into a computer, a website or an app to “activate” it.
• A “replacement” device you never ordered shows up, with a very convincing letter.
• It's sold far below the official price: the tampered Ledger devices of 2026 were offered at close to half price.
• “The brand” contacts you by email, text or phone asking you to “verify” the device or your phrase: after every data leak, that's the most common phishing.

The same goes for software. Download the maker's app only from its official website and be wary even of app stores: in April 2026 a fake copy of Ledger Live slipped into Apple's Mac App Store asking for the recovery phrase, and it has been linked to about $9.5 million stolen from roughly 50 people before Apple pulled it.

The one I recommend and where to buy it

The hardware wallet I recommend is Ledger, as I say in my videos; if open source matters more to you, the alternative is Trezor. Whichever you choose, buy it from the official store: the official Ledger store or the official Trezor store. These are affiliate links: if you buy through them I earn a commission at no extra cost to you, and that doesn't change a thing I've just told you about their data leaks. Entry-level models cost €59 in both stores (Ledger Nano S Plus and Trezor Safe 3, prices checked on October 17, 2026).

If you want to see every model and brand with prices, I compare them in best cold wallets. And if you're only torn between these two, this is my latest video on them (in Spanish):

Ledger vs Trezor en 2027: ¿Cuál es Mejor? (Comparativa Honesta)9:25

MetaMask is the hot wallet many people start with, and it's a good example of how to start right. Download it only from metamask.io (or from the official store link shown there), never from an ad. When you create the wallet it gives you a 12-word phrase; the password you choose only unlocks the app on that device and can't recover anything. If you lose the phrase, MetaMask can't restore your access.

To move funds from an exchange to your wallet, or the other way round, this order avoids almost every scare:

1. Copy the address from the wallet itself, never from your transaction history. Address poisoning means slipping into your history an address that looks almost identical to one you've used before.
2. Compare the beginning, the end and several characters in the middle. Scammers generate addresses that match at both ends.
3. Pick the same network on both sides. On Ethereum, Arbitrum, BNB Chain or Polygon an address looks exactly the same, so the mistake isn't obvious. If you send over a network the destination doesn't support and it's your own MetaMask, adding that network usually does the trick; if it's an exchange, you're at the mercy of its support team.
4. Check whether a memo or tag is needed. Some coins, such as XRP or Stellar, require one when you deposit to an exchange. Without it, the money reaches the platform but not your account.
5. Send a small amount first and confirm on the block explorer that it arrived. The fee on that test is the cheapest insurance you'll ever buy.
6. Save the address in your wallet's contacts so you don't have to copy it again.

If you move more than €1,000 between a European exchange and a wallet of your own, don't be surprised if the platform asks you to prove the address is yours: the EU transfer rules, Regulation (EU) 2023/1113, require it to assess that. I explain it in the guide to exchanges and MiCA.

Once the amount gets serious, a single seed is a single point of failure. Multisig spreads the risk: in a “2-of-3” wallet there are three keys, each on a different device in a different place, and any two are needed to move funds. Lose one and nothing happens; if a thief steals one, it's useless on its own.

The price is complexity. Besides the seeds, you have to back up the wallet configuration (the public keys of every signer, or the “descriptor”): with two seeds but without the third public key you can't rebuild the addresses. It's a classic mistake, and it tends to surface exactly when it can no longer be fixed.

Inheritance is the other gap. If something happened to you tomorrow, would anyone know you own crypto, where it is and how to recover it without getting scammed along the way? A few sensible rules:

• Write a letter of instructions saying what you own, in which wallets and where the backups are, without writing the seed in it.
• Don't put the seed in your will: it's a document several people end up reading.
• Keep seed and passphrase apart, and make it clear who should bring each piece together and in what order.
• Talk to a notary or a lawyer about how to fit this into your situation, and remember the tax office has a say too: see the guide to crypto taxes in Spain.

So which one should you keep? In the cold vs hot video I answer that based on how much money you have and how you use it. As a sensible rule of thumb: hot for what you move often and for small amounts; cold for savings you don't plan to touch for years. Plenty of people end up using both, the same way they carry a wallet in their pocket and keep the important stuff in a safe.

If you're starting from zero, read how to start in crypto first; you'll find more guides and all my videos on custody in the security section. None of this is financial advice: it's basic security so you don't lose what you already have. Before investing, also read the risk warning.