Crypto Wallet Security: Hot vs Cold Wallets

Custodial vs self-custody

When coins sit on an exchange, the exchange holds the private keys. That is custodial: convenient for trading, but you depend on the exchange staying solvent and secure. With self-custody you hold the keys yourself in a wallet. Hence the saying "not your keys, not your coins." Many traders keep active trading funds on a reputable exchange and long-term holdings in self-custody.

Hot wallets vs cold wallets

	Hot wallet	Cold wallet
What it is	App or browser extension connected to the internet	Hardware device or offline setup that keeps keys offline
Best for	Small balances, DeFi, frequent use	Long-term savings and larger balances
Main risk	Malware, phishing, malicious approvals	Loss of the device and backup, supply-chain tampering

Seed phrase rules

Write your 12 or 24-word recovery phrase on paper or metal, never in a screenshot, cloud note, email or password manager synced online.
Store it in a secure place, ideally with a second copy in a separate location.
Nobody legitimate will ever ask for your seed phrase: not support staff, not a wallet app, not an exchange.
Buy hardware wallets only directly from the manufacturer.

Exchange account security

Use an authenticator app or security key for 2FA. Avoid SMS where possible because of SIM-swap attacks.
Use a unique password from a password manager.
Turn on withdrawal address whitelisting and anti-phishing codes.
Use a separate email address just for crypto accounts.

Common crypto scams

Phishing and fake sites

Look-alike domains, fake ads in search results and fake support accounts. Bookmark the real site and only use the bookmark.

Address poisoning

Scammers send tiny transactions from an address that looks like one you use, hoping you copy it from your history. Always verify the full address.

Malicious approvals

Signing an approval can allow a contract to drain tokens. Read what you sign and revoke old approvals regularly.

Investment and "pig butchering" scams

Someone builds trust online, then steers you to a fake trading platform that shows fake profits but never lets you withdraw. Guaranteed returns are always a red flag.

Giveaway and impersonation scams

"Send 1 ETH, get 2 back" is always a scam, no matter whose name or face is attached.

If you have been scammed, report it to your exchange and local authorities (e.g. Action Fraud in the UK, the FBI's IC3 in the US). Beware "recovery services" that promise to get your crypto back: these are frequently scams too.

Frequently asked questions

Is it safe to keep crypto on an exchange?

It is convenient but carries counterparty risk. Use reputable, regulated exchanges with strong security, and keep only what you actively trade there.

What happens if I lose my seed phrase?

If you also lose access to the wallet, the funds are usually unrecoverable. That is why secure backups are essential.

Do I need a hardware wallet?

If you hold an amount you would be upset to lose, a hardware wallet from a reputable manufacturer is a sensible step.

Keep learning

Guide

Crypto wallet security: protect your coins