Cold wallet vs hot wallet: which one you really need and how not to lose your crypto

When you buy bitcoin, nothing travels to your phone. The coin stays recorded on the blockchain, and the only thing that changes is who can sign the next transaction. That signature comes from a private key. A wallet is basically a key ring: it creates those keys, stores them and signs with them when you tell it to.

That gives you the first big split. If you leave your crypto on an exchange, the platform holds the keys and you hold an account with a balance written next to your name: that's third-party custody. If you move it to a wallet of your own, you hold the keys: that's self-custody. Neither is bad by definition, but you should know what you're choosing and which risk comes with it.

The risk of someone else's custody isn't theoretical. In November 2022, FTX stopped processing withdrawals and filed for bankruptcy on the 11th; its customers lost access to what they had deposited. Since July 1, 2026, only platforms authorized under MiCA can operate in Spain, and they must legally separate their customers' crypto from their own assets. That's real progress, but it isn't a guarantee fund: I go through it in the guide to exchanges and the MiCA rules.

Self-custody is the mirror image. Nobody can freeze your account or ask for paperwork before you move your money, and nobody will give it back if you lose your seed or sign something you shouldn't have. You are the bank, with everything good and bad that comes with it.

Wallet vs Exchange: dónde guardar tus criptos DE VERDAD (y no perderlas)12:15

A hot wallet creates and uses its keys on an internet-connected device: your phone, your browser or your computer. A cold wallet creates and stores them on a device that never exposes them to the network, usually a hardware wallet. The key word is expose: a hardware wallet plugs into your computer over USB or connects over Bluetooth, but the private key never leaves it.

In practice the decision comes down to the two questions I raise in the video: how much money you have and how you use it. There's no single best wallet for everyone; there's a best one for your situation, and quite often the answer is to use both.

Wallet FRÍA vs Wallet CALIENTE: cuál necesitas de verdad (guía 2026)11:07

Watch out for a false sense of security. A cold wallet is only as cold as your backup: if you photograph the seed and your phone uploads the picture to the cloud, you've just turned it into a hot wallet. And the device itself can fail where you least expect it, as Coldcard showed in July 2026. Further down I explain what happened and what to learn from it.

Hot wallets

• Mobile apps. Handy for everyday use and payments. Their weak spot is the phone itself: if it gets infected, or someone sees your screen while you write down the seed, it's over.
• Browser extensions, such as MetaMask. They're the gateway to DeFi and to Ethereum-compatible networks. Their enemies are cloned websites, fake extensions and the signatures you don't read.
• Desktop software. Useful for managing several accounts or for connecting a hardware wallet. It inherits every problem of the computer it runs on.
• Your exchange account. Technically it isn't your wallet: it's third-party custody, even if the app calls it a “wallet”.

Cold wallets

• Hardware wallets (Ledger, Trezor, Coldcard, BitBox, Tangem and the rest): dedicated devices that create the seed and sign internally. Each brand has its own approach, its own screen and its own history of controversies.
• Air-gapped devices: they never connect to a computer, by cable or by radio. They exchange transactions through QR codes or microSD cards, usually in PSBT format (BIP-174, the partially signed bitcoin transaction).
• Paper wallets: a printed key. They were popular years ago and today cause more problems than they solve: they're printed from a computer that may be compromised, they degrade, and spending from them correctly isn't trivial.

I'm not going to give you a ranking here: I already have them on video, with prices, real drawbacks and who each one is for. What I will tell you is that any serious brand does the job if you buy it the right way, set it up yourself and protect the seed. The rest of this guide is about exactly that.

My 2026 top picks: hot wallets and cold wallets

8:50

Las 5 MEJORES wallets calientes para tus criptos en 2026 (cuál elegir sin liarte)

Jul 15, 2026 · 2,929 views

9:10

Las 5 MEJORES wallets frías para proteger tus criptos en 2026 (máxima seguridad)

Jul 19, 2026 · 718 views

Almost every modern wallet follows the BIP-39 standard. When you create a wallet it generates between 128 and 256 bits of randomness, adds a small checksum and cuts the result into 11-bit chunks. Each chunk is a number from 0 to 2047, and each number maps to a word on a list of 2,048 words. 128 bits give you 12 words; 256 bits give you 24. The standard also allows 15, 18 and 21-word phrases.

All your keys and addresses are derived from that phrase, which is what BIP-32 deterministic wallets do. That's why a single backup restores every account in any compatible wallet, even if the original device ends up at the bottom of a river. And that's why anyone who reads it has exactly the same power you do.

Two details few people mention. First: on the English list the first four letters are enough to identify every word, so write them down with real care. Second: there are official lists in other languages, Spanish included, but BIP-39 itself strongly discourages anything other than the English list, because most wallets only support that one.

Then there's the passphrase, sometimes called the “25th word”. It's optional and gets combined with the seed (through PBKDF2 with 2,048 iterations, if you're curious) to open a different wallet. Any passphrase produces a valid wallet, so if you mistype it you won't see an error: you'll see an empty wallet. Used well, it protects you from whoever finds your backup; stored badly, it locks you out.

Private key

The secret number that signs transactions for an address. Whoever has it can move the funds.

Seed phrase

The 12 or 24 words (BIP-39) all your keys come from. It's the master backup.

Passphrase

An optional password that, added to the seed, opens a different wallet. Forget it and nobody can recover it.

Address

What you share to get paid. You can show it safely; the seed, never. More terms in the glossary.

Protecting the seed doesn't take an engineer; it takes discipline and zero shortcuts. Here's a sensible process from minute one, whether you use a hardware wallet or a hot wallet:

1. 01

   Generate it yourself, in private

   Create the seed on the device itself, with no cameras pointed at you and nobody watching. If the box comes with words already written down, or someone “gives” you a seed, don't use it: it's a trap.

2. 02

   Write it by hand, numbered

   Use the maker's recovery card or plain paper. Number the words and check the spelling letter by letter before moving on.

3. 03

   Verify the backup

   Use the device's own backup check if it has one. Before you put in a serious amount, do a small round-trip transaction.

4. 04

   Move it to metal

   A steel plate, engraved or stamped, survives fire and water far better than paper. Keep it somewhere out of sight.

5. 05

   Never digital

   No photos, no cloud, no email, no phone notes, no password managers. MetaMask says it plainly: storing it online isn't safe.

6. 06

   Keep the passphrase apart

   If you use a passphrase, store it somewhere other than the seed. Together they're the full key; separately, neither one is enough.

7. 07

   Decide who knows

   More copies and more people make it easier to recover and easier to steal. Find the balance and write it into your inheritance plan.

8. 08

   Review it once a year

   Check that the backup is still legible, that you know where it is and that the device runs up-to-date firmware downloaded from the official site.

My MetaMask tutorial has a whole chapter on this, “Cómo guardar tu frase semilla SIN liarla” (how to store your seed phrase without messing it up), starting at 6:49. If this is your first wallet, watch it before you move a single euro.

Cómo Crear tu Wallet MetaMask y Pasar Dinero del Exchange sin Perderlo20:30

The whole point of a cold wallet is splitting the work. The app on your computer or phone does the “dirty” jobs: it checks balances, builds the transaction and broadcasts it to the network. The device does one thing only: it signs. The flow looks like this:

1. The app builds the unsigned transaction: destination address, amount and fee.
2. The device receives it and shows it on its own screen.
3. You check the details and confirm with the physical buttons.
4. The device signs internally and sends back only the signature.
5. The app broadcasts the signed transaction to the network.

On air-gapped models, steps 2 and 4 travel inside a QR code or on a microSD card holding a PSBT file. The result is the same: the private key never touches an internet-connected device.

And one limit to keep very clear: a hardware wallet protects the key, not your judgment. If you approve a malicious contract that asks for permission to move your tokens, the device will sign it just as obediently. And if the seed was badly generated from day one, no chip can fix that afterwards.

The first attack on a cold wallet can happen before you open the box. A second-hand device, or one from an unknown seller, can arrive tampered with, carrying modified firmware or a seed generated by someone else. I repeat it in my video descriptions:

“

IMPORTANT: buy your cold wallet ONLY from the manufacturer's official website (Ledger, Trezor, Tangem...). Never second-hand or from third parties.

Manufacturers say the same thing. Trezor, for example, explains on its support page that its devices ship without firmware installed, that the seed is generated during setup and that you should never buy from an unauthorized third party, because you can't know who has had the device in their hands.

Signs you should send it back, no questions asked

• It comes with a card that already has words on it, or it asks you to use a “factory” seed.
• It already has a PIN set up, or firmware you didn't install yourself.
• The seal or the packaging is damaged, or doesn't look like what the manufacturer shows.
• It asks you to type the seed into a computer, a website or an app to “activate” it.
• A “replacement” device you never ordered shows up, with a very convincing letter.

The same goes for software. Download the maker's app only from its official website and be wary even of app stores: in one of my shorts I warned that a fake Ledger app had made it onto the App Store.

Una app falsa de Ledger llegó a la App Store. Descubre cómo evitar esta estafa. #Shorts #cripto

MetaMask is the hot wallet many people start with, and it's a good example of how to start right. Download it only from metamask.io (or from the official store link shown there), never from an ad. When you create the wallet it gives you a 12-word phrase; the password you choose only unlocks the app on that device and can't recover anything. If you lose the phrase, MetaMask can't restore your access.

To move funds from an exchange to your wallet, or the other way round, this order avoids almost every scare:

1. Copy the address from the wallet itself, never from your transaction history. Address poisoning means slipping into your history an address that looks almost identical to one you've used before.
2. Compare the beginning, the end and several characters in the middle. Scammers generate addresses that match at both ends.
3. Pick the same network on both sides. On Ethereum, Arbitrum, BNB Chain or Polygon an address looks exactly the same, so the mistake isn't obvious. If you send over a network the destination doesn't support and it's your own MetaMask, adding that network usually does the trick; if it's an exchange, you're at the mercy of its support team.
4. Check whether a memo or tag is needed. Some coins, such as XRP or Stellar, require one when you deposit to an exchange. Without it, the money reaches the platform but not your account.
5. Send a small amount first and confirm on the block explorer that it arrived. The fee on that test is the cheapest insurance you'll ever buy.
6. Save the address in your wallet's contacts so you don't have to copy it again.

If you move more than €1,000 between a European exchange and a wallet of your own, don't be surprised if the platform asks you to prove the address is yours: the EU transfer rules, Regulation (EU) 2023/1113, require it to assess that. I explain it in the guide to exchanges and MiCA.

In August I published a video with an uncomfortable question in its title: “¿Qué ha pasado con Coldcard? ¿Tú dinero está en peligro?” (What happened with Coldcard? Is your money in danger?). A few days earlier came a short with the key idea: it wasn't the chip, it was the seed.

Here's what the official advisory from Coinkite, the manufacturer, says. It was published on July 30, 2026 and updated afterwards: the devices were not hacked or taken over remotely. A bug in certain firmware versions meant seeds were generated with far less randomness than they should have had, and attackers recomputed them on their own to drain the funds. On the Mk2 and Mk3 it affects versions 4.0.1 (from March 2021) through 4.1.9; on the Mk4, Mk5 and Q, every version before the fixed releases, with about 72 bits of entropy instead of 128.

Blockchain analytics firm TRM Labs estimated that roughly 1,816 BTC, around $116 million, was drained from more than 5,200 addresses in several waves starting on July 30. Bitcoin's cryptography was never broken: what failed was the randomness used to create those seeds.

¿Qué ha pasado con Coldcard? ¿Tú dinero está en peligro?7:15

The lessons apply to any brand. What matters is which firmware you used to generate the seed, not the one you run today: updating doesn't fix a weak seed. Coinkite doesn't consider seeds created with at least 50 private dice rolls to be at risk from this bug. A strong passphrase adds an extra barrier, but even then it recommends migrating: a new seed on fixed firmware, a test transaction, then the rest. If you own a Coldcard, follow Coinkite's official advisory, not the first thread you come across on social media.

Exploit de Coldcard: no fue el chip, fue la semilla (cómo comprobar la tuya) #cripto #shorts

Once the amount gets serious, a single seed is a single point of failure. Multisig spreads the risk: in a “2-of-3” wallet there are three keys, each on a different device in a different place, and any two are needed to move funds. Lose one and nothing happens; if a thief steals one, it's useless on its own.

The price is complexity. Besides the seeds, you have to back up the wallet configuration (the public keys of every signer, or the “descriptor”): with two seeds but without the third public key you can't rebuild the addresses. It's a classic mistake, and it tends to surface exactly when it can no longer be fixed.

Inheritance is the other gap. If something happened to you tomorrow, would anyone know you own crypto, where it is and how to recover it without getting scammed along the way? A few sensible rules:

• Write a letter of instructions saying what you own, in which wallets and where the backups are, without writing the seed in it.
• Don't put the seed in your will: it's a document several people end up reading.
• Keep seed and passphrase apart, and make it clear who should bring each piece together and in what order.
• Talk to a notary or a lawyer about how to fit this into your situation, and remember the tax office has a say too: see the guide to crypto taxes in Spain.

So which one should you keep? In the cold vs hot video I answer that based on how much money you have and how you use it. As a sensible rule of thumb: hot for what you move often and for small amounts; cold for savings you don't plan to touch for years. Plenty of people end up using both, the same way they carry a wallet in their pocket and keep the important stuff in a safe.

If you're starting from zero, read how to start in crypto first, and you'll find all my videos on the topic under wallets, exchanges and security. None of this is financial advice: it's basic security so you don't lose what you already have. Before investing, also read the risk warning.