// learn · season 02 · episode 06
Hot & cold wallets
In episode 5 you put the words on steel. But a key that has to sign things can't just sit in a safe — it has to meet the internet somewhere. Where that meeting happens is the single biggest security decision you'll make. Everything below runs in your browser.
01 · the spectrum
One dial, two consequences
“Hot” and “cold” aren't two boxes — they're the ends of a slider between convenience and exposure. Drag it and watch who joins the list of people who could take your money.
convenience
phone · browser · hot
who can take it
- — malware on your device, including clipboard swaps that replace the address you pasted
- — malicious dApp approvals you sign in a hurry
- — phishing sites wearing a familiar logo
- — anyone who can unlock your phone
what it's for
Daily spending. Keep the amount at 'lost wallet on the bus' size — annoying, not ruinous.
Notice there's only one dial. Every step toward convenience hands a key to someone else — a company, a phone, a browser tab. And notice no tier reads “no risk”: you're not removing risk, you're choosing which risk you'd rather manage.
02 · how hot wallets actually die
Nobody steals your key. You hand it a job.
Most drained wallets weren't hacked in the movie sense. The owner clicked approve. Here's the request — react the way you normally would, then find out what you agreed to.
your hot wallet · a website is requesting a signature
🎁 Mint your free NFT
cost: 0 ETHbored-apes-airdrop.xyz wants you to confirm this transaction. Network fee only.
03 · the air gap
Signing without ever going online
Here's the trick that makes cold storage usable: you don't bring the key to the internet — you bring the paperwork to the key. Drive all five steps yourself. The signature produced below is a real one, and the last step really verifies it.
online machine
internet ✓knows: your address only
…
idle — nothing to send yet
offline signer
internet ✗holds: the private key
…
waiting — this machine has never been online
this ceremony — private key seconds online
0
a hot wallet — private key seconds online
always
04 · in practice
Your mix
Nobody serious picks one tier. They split, the same way you don't carry your life savings in your back pocket.
pocket · hot
What you spend and experiment with. Sized so that losing all of it ruins a day, not a decade.
savings · cold
The bulk, behind the ceremony you just performed. Touched rarely, deliberately, and never in a hurry.
the catch
Storage only you can reach is a single point of failure wearing a safety costume. A fire, a hospital bed, a forgotten location — and it's gone for everyone who comes after you.
Notice where that leaves us. Cold storage fixed theft and made loss worse: one device, one backup, one human. The professional answer isn't a better hiding place — it's refusing to let any single key matter at all. That's episode 7.
next up
Episode 07 — Multisig: many keys, one vault play now →Bitcoin multisig and Gnosis Safe: build a 2-of-3 vault, lose a key on purpose, and watch the money stay exactly where it is.