What Hot and Cold Actually Mean
"Hot" and "cold" describe one thing: whether the wallet's private keys are connected to the internet.
A hot wallet is internet-connected. Your Coinbase account, the MetaMask extension in your browser, the Trust Wallet app on your phone — these are all hot wallets. They're convenient. You can send and receive crypto quickly. But because they connect to the internet, they're more exposed to hacks, malware, and phishing attacks.
A cold wallet (also called a hardware wallet or cold storage) keeps your private keys on a physical device that is never connected to the internet while not in active use. A Ledger Nano or Trezor Model T is a cold wallet. Your keys live on the device. To authorize a transaction, you physically approve it on the device. Even if your computer has malware, it can't sign transactions without you pressing the button on the hardware device.
When You Actually Need a Cold Wallet
A common threshold: if you have more than $1,000 in crypto you plan to hold for a year or more, a hardware wallet is worth considering. If you have $50 on an exchange you're figuring out, a hardware wallet is overkill.
The reasoning: hardware wallets cost $60–$150. If your crypto is worth less than that, the security overhead isn't proportional. If your crypto is worth $5,000 and you plan to hold it for years, the $80 cost of a hardware wallet is a reasonable security investment.
Long-term holding ("HODLing") is where cold wallets shine. If you're not touching your crypto regularly, removing it from internet-connected environments significantly reduces your attack surface.
Under $1,000 or actively trading: a reputable exchange like Coinbase, Kraken, or Gemini is fine. Over $1,000 in long-term holdings: look at a Ledger Nano S Plus or Trezor Safe 3. These are entry-level hardware wallets under $100.
Your Exchange Account Is a Hot Wallet — Sort Of
When you buy crypto on Coinbase or Kraken and leave it there, you don't technically control the crypto's private keys. The exchange does. This is called custodial storage. The exchange holds the keys on your behalf.
"Not your keys, not your coins" is a saying in crypto for a reason. If the exchange is hacked (Mt. Gox in 2014, FTX in 2022), gets frozen by regulators, or goes bankrupt, your access to your crypto is at risk. The exchange's hot wallets are a major target for hackers.
For beginners keeping small amounts while learning, exchange custodial storage is acceptable. For larger or long-term holdings, self-custody (a wallet where you control the keys) is safer.
Software Wallets: The Middle Ground
MetaMask, Trust Wallet, and Exodus are self-custody software wallets. You control your keys (via seed phrase), but the wallet is still internet-connected — making them hot wallets. They offer a step up from exchange custody without requiring hardware.
These are appropriate for active users who want self-custody without the complexity of hardware wallets. The risk: if your device is compromised, your wallet can be drained. Keeping your seed phrase offline remains critical.
The Hardware Wallets US Buyers Actually Use
Ledger Nano S Plus (~$79): The most popular entry-level hardware wallet. Stores thousands of cryptocurrencies. Connects via USB. Companion app is Ledger Live.
Trezor Safe 3 (~$79): The other leading option. Open-source firmware, which some users prefer for transparency. Older Trezor One is even cheaper but has less memory.
Buy directly from the manufacturer's website — Ledger.com or Trezor.io. Never buy hardware wallets from Amazon third-party sellers, eBay, or unverified sites. Tampered devices have been used to steal crypto.
Only buy directly from the manufacturer. A pre-configured or "discounted" hardware wallet from a third-party seller is a known attack vector — the device may be compromised before you receive it.
Frequently Asked Questions
Can my crypto be stolen from a hardware wallet?
The most realistic attack is social engineering — someone tricks you into approving a malicious transaction on your device, or steals your seed phrase. The device itself is highly secure against remote attacks. Physical theft of the device alone doesn't help the thief — they'd also need your PIN and potentially your seed phrase.
What happens to my crypto if my hardware wallet breaks or is lost?
Nothing — as long as you have your seed phrase. Get a new hardware wallet, initialize it with your seed phrase, and your entire wallet reappears. The device is just a key-signing machine; the crypto itself lives on the blockchain. This is why the seed phrase backup is more important than the device.
Is leaving crypto on Coinbase safe?
Coinbase is a US-regulated exchange (publicly traded), maintains insurance on USD balances, and has a strong security track record compared to unregulated exchanges. For small amounts while you're learning, it's a reasonable choice. The risk is counterparty risk — Coinbase's business, not a blockchain hack. For large long-term holdings, self-custody removes that risk.