Cold storage
Keeping a wallet's private keys on something that never connects to the internet, such as a hardware wallet, an offline computer or paper, so no one can copy them remotely. It protects the keys from hackers, not from being misused when they're brought out to sign.
Cold storage is the opposite of a hot wallet. The key is created and kept offline: on a hardware wallet, on a computer that’s never connected, or written down as a seed phrase on paper or metal. To spend, a transaction is prepared online, taken to the offline key to be signed, and brought back.
Many exchanges keep most of what their customers hold this way, and only what they need for daily withdrawals online. Some countries require it: in Japan, the law says exchanges must keep their customers’ crypto in cold wallets, or under equally secure methods, and may hold at most 5% of it any other way.
Cold storage closes one door: no one can copy a key over the internet if it’s never there. It leaves others open.
- The signing. Money in cold storage has to move sometime, and that’s when it’s exposed. In February 2025, the exchange Bybit lost more than 1.4 billion dollars from what its chief executive called its Ethereum multisig cold wallet, during a transfer to a warm wallet: the signers’ screens showed the right address, but what they signed changed the wallet’s code and handed control to the attacker. The FBI attributed the theft to North Korea.
- The backup. A seed phrase on paper is cold too, and whoever finds it has the money.
- The person. Cold storage doesn’t stop someone forcing you to bring the key out and sign, as the guide on wrench attacks explains.
For savings, a cold key can be one of several kept in different places, in a multisig wallet, so that no single one is enough. The guide on hardware wallets, multisig and collaborative custody compares the options.