Hot Wallet vs Cold Wallet: Keep Your Crypto Safe (2026)

Last reviewed: September 29, 2026

This guide brings together three questions people usually ask separately. Which wallet is safer, hot or cold? How does wallet security actually work, and what do people miss? And how do you protect crypto over the long run, when you travel, when a platform fails, and when you are gone? We use guidance from US and UK regulators, the FBI, NIST and CISA, the bitcoin.org and ethereum.org projects, the BIP39 technical standard, and the official pages of hardware wallet makers. We do not recommend a brand. Where we name devices, it is only to explain features using their makers' own published guidance.

This article is general information, not financial advice.

Hot wallets, cold wallets and exchange custody explained

The word "wallet" is a little misleading. A crypto wallet does not hold coins the way a leather wallet holds cash. The coins are recorded on a public blockchain. What a wallet holds is the secret that lets you move them: the private key. Whoever controls the private key controls the coins. That idea sits under every section of this guide.

The SEC's investor education office published a bulletin on crypto custody in December 2025. It describes custody as how and where you store and access your crypto assets. It explains that you usually access them through a device or program called a crypto wallet. FINRA, the US broker-dealer regulator, gives a similar plain explanation in its guide to storing crypto assets. Both describe three broad ways to hold crypto.

Hot wallets

A hot wallet is software that keeps your keys on a device connected to the internet. Examples include mobile wallet apps, desktop wallet programs and browser extension wallets. FINRA describes hot wallets as convenient and often free, and good for trading and quick transactions. It also warns that they are more exposed to hackers and cyberattacks, and that phone or computer wallets can be lost or stolen along with the device.

The key point is this: the key lives on a general-purpose device. Your phone or laptop also runs a web browser, email, messaging apps, games and many other programs. Any of those can become a route for malware or a phishing trick. A hot wallet is only as safe as the device it runs on and the habits of the person using it.

Cold wallets

A cold wallet keeps the key offline. Today that usually means a hardware wallet: a small, dedicated device built to create and store keys and to sign transactions internally. The SEC bulletin says cold wallets are typically physical devices not connected to the internet, and that this is why they are generally more secure from cyber threats than hot wallets. FINRA says cold wallets tend to be better for long-term storage and harder for attackers to reach.

The bitcoin.org guide to securing a wallet describes hardware wallets as the best balance between very high security and ease of use. It also describes an older method: signing transactions on a computer that is never connected to a network, then broadcasting them from a second, online machine. That method works, but it is more complex for most users.

A cold wallet does not remove all risk. The device can break, be lost or be stolen. FINRA notes these physical risks directly. That is why the seed phrase backup, covered below, matters just as much as the device.

Exchange (custodial) wallets

When you buy crypto on an exchange or app and leave it there, the company usually holds the keys. You see a balance in your account, but that balance is a record in the company's system. In legal terms, you have a claim against the company. The SEC bulletin calls this third-party custody. It contrasts it with self-custody, where you are in complete control and have sole responsibility for your private keys and seed phrase.

Custodial accounts are easy to use. You can reset a forgotten password. There is customer support. But you depend on the company staying honest, solvent and secure. FINRA points out that the FDIC does not insure assets issued by non-bank entities such as crypto exchanges. In the UK, the FCA warns that crypto is largely unregulated and that you are highly unlikely to be covered by the Financial Services Compensation Scheme. The FCA also tells consumers to be prepared to lose all their money, including through the failure of a firm or poor segregation of client funds.

You may have heard the phrase "not your keys, not your coins." It is a slogan, but the idea behind it is sound. If someone else holds the keys, you rely on their promises. If you hold the keys, you rely on your own care. Neither is automatically safer. They carry different risks.

How crypto wallet security really works

Most security failures come from misunderstanding what needs protecting. Here are the pieces, in plain terms.

Private keys and public addresses

A private key is a very large secret number. From it, the wallet derives public addresses you can share so others can send you funds. Sharing an address is safe. Sharing the private key is not. FINRA describes the private key as essentially a password and says crypto hacks and thefts usually happen when a bad actor gains access to it, often through imposter ploys or phishing designed to find seed phrases or keys stored on a computer.

The seed phrase

Modern wallets do not ask you to back up each key one by one. Instead they generate a seed phrase, also called a recovery phrase, mnemonic phrase or wallet backup. It is a list of ordinary words. From this list, the wallet can recreate all your keys, on any compatible device.

The most common standard for this is BIP39, a Bitcoin Improvement Proposal. According to the BIP39 specification:

• A seed phrase can be 12, 15, 18, 21 or 24 words long.
• The words come from a fixed list of 2,048 words.
• The last word includes a checksum, which helps catch some typing mistakes. The specification notes this check is modest and will miss some errors.
• An optional extra passphrase can be added. It changes the resulting wallet completely.
• The specification strongly discourages non-English wordlists for generating phrases, and notes that translating a phrase into another wordlist produces a completely different seed.

Some hardware wallet makers also support other backup formats. Trezor's official backup guide, for example, says its backups are 12, 20 or 24 words depending on whether the BIP39 or SLIP39 standard is used.

The practical meaning is stark. Your seed phrase is not a password to one account. It is a master copy of everything in the wallet. Ledger's educational page makes the point directly: anyone who has the words can recreate your wallet and take your funds, and if you lose the words, no one can recover them for you. Trezor's guide says the same: if someone steals your wallet backup, they can access your coins with a different device.

The PIN and the device

A hardware wallet usually has a PIN that unlocks the device. The PIN protects against someone who picks up the device. It does not protect the seed phrase. If a thief finds your written seed words, the PIN on your device is irrelevant. They can load the words into any compatible wallet.

Signing on a trusted screen

The core security idea of a hardware wallet is that the key never leaves the device. When you send funds, your computer or phone prepares the transaction. The hardware wallet shows the details on its own screen. You check the address and amount there, and approve with a button or touch. Only the signed transaction goes back to the computer. The ethereum.org security page describes this as the private key never touching the internet and staying local on the device.

That is why "check the address on the device screen" is not a small tip. It is the whole point. If malware on your computer changes the destination address, the hardware wallet screen should show the real destination. If you do not look, the protection is wasted.

What people often miss

• The seed phrase is the real target. Many scams never touch your device. They trick you into typing your seed phrase into a fake website, app or form.
• Approvals can be as dangerous as payments. On smart contract networks, you can sign a permission that lets a contract move your tokens later. ethereum.org warns that an unlimited spend approval could let a contract drain your wallet.
• Transactions are final. The FTC says crypto payments do not come with the legal protections that cards have and usually cannot be reversed. The FBI's IC3 says crypto transactions are irrevocable.
• Your phone number is a weak point. If your exchange account uses text-message codes, a SIM swap can hand those codes to a criminal.
• Your privacy is limited. The FTC notes that some information about your transactions will likely be public on the blockchain. Anyone who links an address to you can watch its balance.
• Backups fail quietly. A seed phrase with one word misspelled or out of order may not restore. People discover this only when they need it.

Hot vs cold vs exchange: side-by-side comparison

The table below summarises the trade-offs. It is a general comparison, not a rating of any specific product.

No option is risk-free. A hot wallet trades security for convenience. A cold wallet moves most of the risk onto your own backup habits. An exchange moves the risk onto a company. The safest setups usually combine them on purpose, rather than by accident.

Which setup fits you

There is no single right answer. It depends on how much you hold, how often you move it and how comfortable you are managing backups. These patterns are common starting points.

You hold a small amount and are still learning

If you are just starting, the amount at stake may be small. A reputable exchange account with strong login security may be enough while you learn. Do not rush into self-custody with money you cannot afford to lose to a mistake. If you are new, our guide on how to invest in Bitcoin safely as a beginner covers the buying side first.

Even at this stage, practise. Set up a free hot wallet, write down its seed phrase, send a tiny amount to it, delete the app and restore it from the phrase. You learn how recovery works while the stakes are low.

You hold an amount that would hurt to lose

This is where a hardware wallet usually makes sense. The purchase price is small compared with the value protected. Keep a small hot wallet or exchange balance for spending or trading. Move savings to the hardware wallet. Keep the seed phrase offline in a secure place.

You hold a large amount or manage crypto for others

At higher values, a single point of failure becomes a real concern. One lost or stolen seed phrase would be catastrophic. Options include splitting funds across more than one wallet, adding a passphrase, or using multisignature (multisig) setups that need more than one key to approve a transaction. bitcoin.org notes that multisig requires several independent approvals, which helps prevent single-point-of-failure theft. These tools add complexity, and complexity creates its own risk. Many people at this level also take professional legal advice about estate planning.

You trade often

Active traders often keep funds on an exchange for speed. If that is you, treat the exchange balance as working capital, not savings. Withdraw profits you do not need to a wallet you control. Price swings are a separate risk from custody risk; our guide to cryptocurrency volatility and risk management covers that side.

A simple rule of thumb

Think of it like cash. You carry a little cash in your pocket. You keep more in a bank. Crypto has no bank-style guarantee, so the "bank" part becomes your cold wallet plus a well-protected backup. Keep the pocket small.

How to set up a hardware wallet safely, step by step

Hardware wallets differ in design, but the safe setup process follows the same principles. Always follow your device maker's official instructions as well. The steps below reflect guidance published by makers such as Ledger and Trezor and by bitcoin.org and ethereum.org.

Step 1: Buy from the maker or an authorised reseller

Tampered devices are a real threat. Ledger's buying guide recommends buying directly from Ledger or from authorised resellers and says purchasing from unlisted, unauthorised sellers adds security risks. Trezor's support page says never to buy a Trezor from an unauthorised third party. Avoid second-hand devices, marketplace listings and "discounted" offers from unknown sellers. If you use a large online marketplace, check that the seller is the official brand storefront for your region.

Step 2: Inspect the package

Look for signs of tampering. Trezor describes tamper-evident seals and packaging that varies by model. Ledger says that if a package appears opened, altered or compromised, you should not use the device and should contact its support through official channels. Check the contents against the maker's official list of what should be in the box.

Step 3: Reject any device that comes with a seed phrase

This is one of the most important checks. Ledger's buying guide states that a legitimate Ledger device never comes with a recovery phrase or PIN code pre-configured. Any device that arrives with pre-written recovery words, a scratch card with words, or a note telling you to use a specific phrase should not be used. Whoever wrote those words can empty the wallet. The same principle applies to any brand: you must generate the seed phrase yourself, on the device.

Step 4: Download the companion software from the official source

Most hardware wallets use a companion app on a computer or phone. Type the maker's web address yourself, or use a bookmark you created. Do not click links from ads, search results you are unsure of, emails or social media messages. Fake wallet apps and fake download pages are a common trick. Ledger advises downloading its app only from Ledger or official app stores and warns that counterfeit devices may come with fake apps that falsely report the device as genuine.

Step 5: Run the authenticity check

Many devices include a way to verify they are genuine. Ledger describes a Genuine Check that uses a cryptographic proof from the device's secure element. Trezor says its devices ship without firmware installed; during setup the software checks this, and if firmware is already present the device should not be used. Trezor also says the bootloader checks the firmware signature each time you connect. Follow whatever authenticity steps your maker provides. Do not skip them.

Step 6: Set a PIN

Choose a PIN that is not your birthday, phone code or bank PIN. Hardware wallets usually limit how many wrong guesses are allowed before the device wipes itself. That protects you if the device is stolen, but it also means you need a PIN you will remember. The wipe does not destroy your funds, because you can restore from the seed phrase.

Step 7: Create and write down the seed phrase

The device will generate your seed phrase and show it on its own screen. Write each word clearly, in order, on the card or sheet provided. Use the exact spelling. Trezor's guide stresses making sure all words are spelled correctly and in the right order. Do not photograph the screen. Do not type the words into your phone or computer. Do not say them aloud near smart speakers or video calls.

Step 8: Confirm the backup

Most devices ask you to confirm some or all of the words. Do this carefully. Some wallets also offer a separate backup check feature later. Use it.

Step 9: Test recovery with a small amount

Before moving your savings, do a test. Send a small amount to the new wallet. Then, following your maker's official instructions, test that your written seed phrase actually restores the wallet. Some people do this by resetting the device and restoring from the phrase. Others use a built-in backup check. The goal is to prove the backup works while little is at stake.

Step 10: Receive funds by checking the address on the device

When you generate a receive address, confirm it on the hardware wallet's screen, not only on the computer. Compare the full address, not just the first and last few characters.

Step 11: Move the rest in stages

Once the test works, move your savings. Many people send a small first transfer, confirm it arrives, and then send the rest. The small network fee for an extra transaction is cheap insurance against a mistake.

Step 12: Keep firmware and apps updated, carefully

bitcoin.org recommends keeping wallet software up to date. Update only through the official app, and only when you started the update yourself. A message, email or pop-up urging an "urgent security update" is a classic phishing lure. A real update will never ask you to type your seed phrase into a computer.

Seed phrase safety: storage that actually works

Almost every serious crypto loss comes back to one of two failures. Either someone else got the seed phrase, or the owner lost it. Good storage has to guard against both at once. That is harder than it sounds, because the two goals pull in opposite directions. More copies protect against loss but increase the chance of theft. Fewer copies protect against theft but increase the chance of loss.

The absolute rules

• Never share it. ethereum.org puts it bluntly: never, for any reason, share your recovery phrase or private keys. Ledger says it will never ask for your 24 words. Trezor says it will never ask for your wallet backup, even if you are talking with its customer support.
• Never store it digitally. Trezor's guide says never to make a digital copy, including Dropbox, email, encrypted folders or photos. Ledger's academy page warns not to save it on your computer or screenshot it with your phone, because those are the first places an attacker will look. FINRA also advises against storing it in cloud services.
• Never type it into a website or app. The only place you should ever enter your seed phrase is the hardware wallet itself during a restore, following the maker's instructions. Trezor says never to enter the backup anywhere unless prompted by your Trezor device.

Where to keep it

FINRA suggests keeping a seed phrase in a physical safe or a bank safe deposit box. bitcoin.org suggests storing backups in multiple secure physical locations using durable media. Beyond that, the right choice depends on your situation.

• A home safe. Protects against casual theft and some fire risk. Choose a model with a fire rating if fire is your concern. A safe is also the first place a burglar looks, so some people keep only one part of a split backup there.
• A bank safe deposit box. Good physical protection. The trade-offs are limited access hours and the chance that access is restricted during a bank dispute or after death until legal steps are complete.
• A trusted second location. A second copy with a family member or at another property protects against fire, flood or theft at home. The risk is that more people know it exists.

Paper or metal?

Paper is fine if stored carefully, but it can burn, fade, get wet or be thrown away. Metal backup plates or capsules are built to survive fire and water better. Several wallet makers sell them; Trezor, for example, mentions its own metal storage product in its backup guide. Any sturdy metal backup you engrave or stamp yourself can do the same job. What matters is that the words are legible years later and stored securely.

Note that FINRA's guide cautions against paper wallets, meaning printouts of private keys or QR codes, because they can be stolen, damaged or lost. A written seed phrase is still a common backup method. The lesson is to treat any paper holding secrets with the same care as cash or jewellery.

Common seed phrase mistakes

• Taking a photo "just for now" and forgetting to delete it from cloud photo backup.
• Saving the words in a notes app, password manager, email draft or document.
• Writing the words in the wrong order or with spelling errors, and never testing the backup.
• Keeping the seed phrase in the same box as the hardware wallet, so a single theft gives everything away.
• Telling many people where it is, or labelling it "crypto seed phrase" in an obvious place.
• Cutting the phrase into two halves stored in different places. This can reduce security, because each half leaks part of the secret and losing either half can lock you out. If you want split backups, use a scheme designed for that purpose, such as multisig or a standard like SLIP39 where your device supports it.
• Inventing your own "clever" encoding that your family will never understand.

Should you make more than one copy?

Usually yes, but carefully. One copy in one place is a single point of failure. Two copies in two secure, separate places protect against a fire or flood. Each extra copy is one more thing to guard. Many people settle on two copies. Whatever you choose, write down for yourself where each copy is, and review it once a year.

Passphrases, multisig and other advanced options

Basic good practice covers most people. The options below add protection against specific risks, but each one adds complexity. Only use them if you understand them and your family could deal with them later.

Optional passphrase (sometimes called the "25th word")

BIP39 allows an optional passphrase on top of the seed words. The same seed words plus a different passphrase produce a completely different wallet. This means someone who finds your written seed words still cannot reach the funds without the passphrase.

The danger is equally clear. If you forget the passphrase, the funds are gone, even if you still have the seed words. There is no reset. If you use one, back it up separately from the seed words, and make sure your estate plan covers it.

Multisignature wallets

A multisig wallet needs more than one key to approve a transaction, for example two keys out of three. Each key can sit on a different device in a different place. Losing one key does not lose the funds, and stealing one key is not enough to take them. bitcoin.org highlights multisig as protection against single-point-of-failure theft.

The cost is complexity. You must back up each key and, depending on the setup, extra wallet configuration details. Recovery is harder for heirs who are not technical. Multisig is often used by people with larger holdings, businesses and families who want shared control.

A dedicated device for crypto

Some people keep an old phone or laptop used only for their wallet app, with no email, games or social media. This reduces the attack surface for a hot wallet. It is not a substitute for a hardware wallet for large sums, but it is better than a phone full of other apps.

A decoy or "spending" wallet

Keeping a small separate wallet for daily use means that if you are ever tricked or coerced, the exposure is limited. Your main savings stay in a wallet you rarely open.

Protecting exchange accounts, phones and email

Even if your savings are in cold storage, you probably still use an exchange to buy and sell. Your email account and phone number are often the keys to that exchange account. Criminals know this.

Passwords

NIST's Digital Identity Guidelines (SP 800-63B, revision 4) set the US government's technical baseline for passwords. They say services should allow passwords of at least 64 characters, should not force composition rules such as mixing symbols and numbers, and should check new passwords against lists of breached and common passwords. They set a minimum of 15 characters when a password is the only factor, and 8 characters when it is used with another factor. They also say services should allow password managers and pasting, because these encourage stronger passwords.

For you, that translates into a few habits:

• Use a long, unique password for every exchange and for your email.
• Use a reputable password manager to generate and store them.
• Never reuse your email password anywhere else.
• Do not store your seed phrase in the password manager. Passwords protect accounts. Seed phrases are the money itself.

Two-factor authentication: not all methods are equal

Two-factor authentication (2FA or MFA) adds a second step at login. But some kinds are much stronger than others.

• Text message (SMS) codes are better than nothing but are the weakest common option. NIST treats phone-network codes as a restricted method and tells services to watch for signs like a SIM change or number porting before relying on them.
• Authenticator app codes are stronger than SMS because they do not depend on your phone number. They can still be phished if you type the code into a fake site.
• Security keys and passkeys (FIDO/WebAuthn) are phishing-resistant. CISA's fact sheet says FIDO/WebAuthn authentication is the only widely available phishing-resistant authentication. The key checks which website it is talking to, so a look-alike site cannot trick it.

If your exchange supports security keys or passkeys, use them. The FTC's advice on SIM swap scams recommends an authentication app or security key instead of text message verification for sensitive accounts.

Your phone number

In a SIM swap, a criminal convinces your mobile carrier to move your number to a SIM card they control. The FTC explains that the scammer then gets your calls and text messages, including login codes. To reduce the risk:

• Ask your carrier to add a PIN or password to your account, and any available lock on number transfers.
• Remove your phone number as a recovery or 2FA method wherever a stronger option exists.
• Limit how much personal information you post online, since criminals use it to impersonate you to the carrier.
• If your phone suddenly loses service for no clear reason, contact your carrier immediately.

Your email account

Your email is usually the reset route for everything else. Protect it with a long unique password and the strongest 2FA it supports, ideally a security key or passkey. Some people use a separate email address only for financial and crypto accounts, which they never share publicly.

Withdrawal protections on exchanges

Many exchanges offer extra controls such as address allowlists (withdrawals only to pre-approved addresses), withdrawal delays after security changes, and login alerts. Where available, turn them on. They buy you time if someone does get into your account.

Common attacks and how they work

The scale of crypto crime is large. In its 2025 Internet Crime Report, the FBI said Americans reported nearly $21 billion in internet crime losses, and that 181,565 complaints involving cryptocurrency reported more than $11 billion in losses. Many of those losses are investment scams where victims send funds willingly after being deceived. Others involve stolen keys and hijacked accounts. Knowing the patterns is one of the best defences. For a wider list of warning signs, see our guide to how to spot a crypto scam.

Phishing

Phishing tries to get you to hand over login details, 2FA codes or your seed phrase by imitating a trusted brand. It arrives as emails, texts, social media messages, ads, search results or pop-ups. In 2023, the FTC warned about urgent emails that imitated a popular wallet brand and falsely claimed users' wallets were blocked. The pattern is always similar: there is a supposed problem with your account, and you must act now by clicking a link.

How to defend:

• Never click login or "verify" links in messages. Type the address yourself or use a saved bookmark.
• Never type your seed phrase into any site, whatever the reason given.
• Use a security key or passkey on exchange accounts; it will not work on a fake site.
• Be suspicious of sponsored search ads for wallet or exchange names.

Fake support and impersonation

Criminals pose as exchange staff, wallet makers, or even government agencies. In an August 2024 alert, the FBI warned about scammers impersonating cryptocurrency exchange employees. They contact victims unsolicited, claim there is a problem with the account, and pressure them to share login details or click links. The FBI advises not to respond to such messages, even if they look official and urgent, and to contact the exchange through its official number instead.

On social media and chat servers, fake "support agents" often reply to people who post about a problem. ethereum.org notes that genuine staff will never communicate with you through private, unofficial channels. Trezor says no one from its team will ever start a private message with you. The rule is simple: you contact support, through the official website. Support never contacts you first asking for secrets.

Address poisoning

Wallet apps often shorten addresses, showing only the first and last few characters. In an address poisoning attack, a criminal creates an address that matches those visible characters of an address you have used before. They send you a tiny or worthless transaction so the fake address appears in your history. Later, you copy the "familiar" address from your history and send funds to the criminal.

The FBI has warned about a related token impersonation scam. It explained that because wallet software truncates addresses, the first and last characters can match a familiar address while the middle characters differ. Its advice includes checking the entire address before sending and using a public blockchain explorer to check where tokens came from.

How to defend:

• Never copy a destination address from your transaction history.
• Use a saved address book entry you created carefully, or get the address fresh from the recipient.
• Check the full address, including the middle characters, on the hardware wallet screen.
• Ignore unexpected tiny deposits or tokens you did not ask for.

SIM swap

Covered above: a criminal takes over your phone number to intercept text-message codes and reset passwords. The FTC notes that text message verification alone cannot stop this. The fix is to move your important accounts to an authenticator app or, better, a security key, and to lock down your mobile account.

Drainer approvals and malicious signatures

On smart contract networks such as Ethereum, you do not only send payments. You also sign messages and approvals that let apps act for you. A "drainer" is a malicious site or contract designed to get you to sign an approval that lets it move your tokens, often all of them.

These attacks often start with a fake airdrop, a fake mint, or a link promising free tokens. In a June 2025 alert, the FBI described criminals sending airdrops with malicious links to non-custodial wallet users. Victims were sent to fraudulent sites where they gave up login details and seed phrases. The FBI described how the criminal then moves the victim's crypto to a wallet the criminal controls.

How to defend:

• Treat unexpected airdrops and "claim your tokens" links as hostile until proven otherwise.
• Read what you are signing. If the wallet shows an approval for unlimited spending, stop. ethereum.org advises against unlimited spend limits.
• Use a separate low-balance hot wallet to try new apps, not your savings wallet.
• Review and revoke old token approvals from time to time using a reputable tool.
• If you realise you signed something malicious, ethereum.org advises moving remaining funds to a new, secure wallet the scammer cannot access and revoking approvals.

Malware and clipboard hijackers

Some malware watches your clipboard. When you copy a crypto address, it quietly replaces it with the attacker's address. Other malware searches your computer for seed phrases, wallet files and screenshots. FINRA lists malware and ransomware among the threats to private keys. Defences include keeping your system updated, installing software only from official sources, never storing seed phrases on a computer, and always verifying the address on a hardware wallet screen.

Investment and romance scams

Not every loss involves a hacked wallet. In many cases, the victim is persuaded to send crypto to a fake investment platform. The CFTC describes relationship investment scams, often called "pig butchering", where a scammer builds a friendly or romantic relationship before steering the victim into a fake trading opportunity. The FTC says that if someone you meet on a dating site or app wants to show you how to invest in crypto, that is a scam. The CFTC also warns that fake platforms often demand extra "fees" or "taxes" before letting you withdraw.

A cold wallet does not protect you here, because you are the one sending the money. The defence is refusing to send crypto to anyone you have only met online, and checking any platform with regulators before using it.

Crypto ATM and kiosk scams

Criminals often tell victims to deposit cash into a crypto kiosk and send it to a QR code the criminal provides. In a May 2026 alert, the FBI said IC3 received over 13,400 complaints involving cryptocurrency kiosks in 2025, with losses over $388 million. It warns never to scan QR codes or use kiosks on a stranger's instructions, and notes that legitimate authorities never demand crypto payments. The FTC says the same: only scammers demand payment in crypto.

Recovery scams

After a loss, victims are often targeted again by people claiming they can recover the funds for a fee. The FBI warns to be wary of anyone claiming they can recover your funds, as this may be another scam, and IC3 specifically warns about recovery services charging an up-front fee. The CFTC also warns customers to watch for these follow-on frauds.

Physical threats

People who are known to hold crypto can become targets for theft or coercion. Do not talk publicly about how much you hold. Do not post screenshots of balances. Be careful at meetups and on social media. This is another reason a small everyday wallet, separate from savings, makes sense.

Threat-to-defence table

This table maps the main threats to the defences that actually address them.

When the platform fails: lessons from FTX and Celsius

Custody risk is not theoretical. Two large collapses in 2022 showed what can happen when you leave assets with a company that fails. The facts below come from US Department of Justice announcements and official court-process communications.

Celsius

Celsius was a crypto lending platform that offered high rewards on deposits. According to the US Attorney's Office for the Southern District of New York, Celsius halted customer withdrawals on June 12, 2022. At that point, hundreds of thousands of customers had $4.7 billion in inaccessible assets on the platform. Its founder and former CEO, Alexander Mashinsky, pleaded guilty and was sentenced in May 2025 to 12 years in prison for commodities fraud and securities fraud. Prosecutors said he misrepresented, among other things, the safety of Celsius's yield-generating activities and the risks of depositing assets there.

The UK FCA uses Celsius as an example in its consumer guidance on crypto risks, noting that users lost access to funds when it failed.

FTX

FTX was one of the largest crypto exchanges. According to the US Department of Justice, its founder, Samuel Bankman-Fried, misappropriated billions of dollars of customer funds deposited with FTX. On March 28, 2024, he was sentenced to 25 years in prison and ordered to pay $11 billion in forfeiture. The US Attorney's Office described the case as one of the largest financial frauds in history, involving the theft of over $8 billion of customers' money.

FTX then went through Chapter 11 bankruptcy. Its reorganization plan, announced in May 2024, projected that 98% of creditors by number, those with claims of $50,000 or less, would receive about 118% of their allowed claims. The claims were valued as of the November 2022 bankruptcy petition date. In March 2026, the FTX Recovery Trust announced a fourth distribution of about $2.2 billion to eligible creditors.

What these cases teach

• Withdrawals can stop overnight. Celsius customers could not move their assets once withdrawals were halted.
• Recovery takes years. The FTX bankruptcy began in November 2022, and distributions were still being made in 2026.
• Claims are usually fixed in money terms. In the FTX case, claims were valued at the petition date. Even when creditors receive a high percentage of their claim, they may not get back the same coins or the value those coins later reached.
• High yield often means high risk. Promises of generous rewards on deposits deserve hard questions about where the yield comes from.
• Regulated status matters, but it is not a guarantee. Check whether a platform is registered or authorised where you live, and understand what protections, if any, apply to your crypto.

Questions to ask any custodian

The SEC's custody bulletin encourages investors to understand how a third-party custodian holds assets before using it. Useful questions include:

• Are customer assets held separately from the company's own assets, or pooled?
• Does the company lend out, stake or otherwise use customer assets?
• What happens to my assets if the company goes bankrupt?
• Is the company registered or licensed where I live, and with whom?
• What security controls and insurance does it disclose, and what does that insurance actually cover?

If the answers are vague or hard to find, treat that as information in itself.

Inheritance and estate planning for crypto

Self-custody has a hard edge. If you die or become unable to act and nobody else can reach your keys, the crypto may be lost for good. There is no bank to call and no password reset. bitcoin.org warns that without a succession plan, funds can become permanently unrecoverable, and recommends documenting wallet locations and passwords for family members.

Planning means balancing two risks: making sure your heirs can get access, and making sure nobody can get access too early. This section is general information. Inheritance law differs by country and state, so speak to a qualified estate lawyer where you live.

Step 1: Make an inventory

List what you hold and where. Include exchanges and apps (by name, not with passwords), hardware wallets, hot wallets and roughly what each contains. Update it at least once a year and after big changes. Many people are surprised how many small accounts they have forgotten.

Step 2: Write clear instructions

Your heirs may not know what a seed phrase is. Write a plain-language letter that explains:

• What crypto you hold and which wallets or exchanges hold it.
• Where the hardware wallets and seed phrase backups are kept.
• What a seed phrase is, and that they must never type it into a website or share it with anyone offering "help".
• How to contact each exchange's official support to report a death.
• Which trusted people, such as your lawyer or a technically capable relative, can help.

Do not put the seed phrase itself in your will. A will may become a public document after death in some places, and many people see it before then.

Step 3: Decide how access will pass

Common approaches include:

• Sealed instructions with a lawyer or executor, with the seed phrase stored separately in a place the executor can reach, such as a safe deposit box.
• Split knowledge, where the location is known to one person and the means of access to another. This requires trust in both.
• Multisig with trusted key holders, where for example two of three keys are needed. One key might sit with you, one with a family member and one with a lawyer. This avoids giving anyone full control on their own.
• Custodial accounts, which usually have a process for handling a customer's death through documents such as a death certificate and proof of authority. Check each platform's process in advance.

Step 4: Cover passphrases and PINs

If you use an optional passphrase, your heirs need it too, or the seed words alone will show an empty wallet. If your plan depends on a hardware wallet PIN, remember the seed phrase can restore the wallet on a new device, so the PIN is less critical than the seed phrase and passphrase.

Step 5: Test the plan with someone you trust

Walk your executor or a trusted relative through the instructions without revealing secrets. Can they understand them? Do they know where to find things? Would they recognise a scammer offering to help? Update anything confusing.

Step 6: Think about incapacity, not only death

An accident or illness can leave you unable to manage your affairs for a time. A power of attorney that covers digital assets, where local law allows, can help someone act for you. Discuss this with a lawyer.

A word on tax records

Heirs and executors often need records of what was bought, when and at what cost. Keep exports of exchange transaction histories and a record of wallet addresses you own. Store them with your other financial records, separately from any seed phrase.

Travel and cross-border safety

Crypto moves across borders easily. You do not. Travel adds risks that are easy to forget: lost bags, stolen phones, public networks, curious officials and different laws.

Before you go

• Leave the seed phrase at home. Never travel with your seed phrase backup. If you lose your hardware wallet abroad, you can restore it later from the backup at home.
• Decide if you need the hardware wallet at all. If you do not plan to move savings, leave it locked away. Carry only a small hot wallet balance for any spending.
• Check your phone security. Use a strong device passcode, keep your wallet app locked, and make sure remote wipe is set up.
• Tell your exchange if needed. Some platforms flag logins from new countries. Knowing how your exchange handles this can avoid a lock-out at a bad moment.
• Check local rules. Crypto laws vary widely. Some countries restrict crypto trading, payments or exchanges. Tax residency rules may also change if you stay abroad for long periods. Check official government sources for the countries involved.
• Think about insurance. Standard travel insurance generally will not treat crypto like cash or cover crypto losses. Our guide to what travel insurance covers explains typical exclusions.

While travelling

• Avoid logging into exchanges on public computers or hotel business centre machines.
• Be careful with public Wi-Fi. Use your mobile data or a trusted connection for financial logins.
• Do not discuss your holdings with strangers or show balances in public.
• Be cautious of "helpful" locals offering crypto exchange services or cash-for-crypto deals.
• If your phone is lost or stolen, act fast: lock it remotely, change exchange and email passwords from a safe device, and move funds from any hot wallet on that phone using the seed phrase once you are home or on a trusted device.

At the border

Border officials in many countries have broad powers to inspect goods and, in some cases, electronic devices. In the United States, for example, CBP states that travellers are subject to inspection and that officers may, on rare occasions, search phones, computers and other devices. You may not want wallet apps showing large balances on a phone you carry across borders. A hardware wallet with no seed phrase alongside it reveals little on its own, and the funds remain recoverable from the backup at home.

Moving money across borders

Some people use crypto to send money abroad. It can work, but it adds price volatility, exchange spreads and the risk of sending to the wrong address, with no reversal. Compare it with regulated money transfer options before choosing. Our guide on how to send money internationally for less compares the main routes.

Living abroad or holding accounts in several countries

If you live in one country and use an exchange based in another, you add jurisdiction risk. If that exchange fails, you may have to deal with a foreign bankruptcy process, foreign law and foreign courts. The IC3 notes that US law enforcement may face significant challenges following crypto into other jurisdictions. Where you can, use platforms that are registered or authorised where you live, and keep records of everything.

Setup checklist

Use this checklist when you set up or review your crypto security. Revisit it once a year.

What to do if something goes wrong

Speed matters, but so does calm. Criminals often strike again while you are panicking.

If you think your seed phrase has been exposed

1. Treat the wallet as compromised, even if nothing has moved yet.
2. Set up a new wallet with a brand-new seed phrase, generated on a trusted device.
3. Move all remaining funds to the new wallet as quickly as you safely can.
4. Revoke token approvals on the old wallet where relevant.
5. Destroy old copies of the exposed phrase once funds are moved, and store the new backup securely.

If your exchange account was accessed

1. Contact the exchange through its official website or app, not through links in messages.
2. Change your exchange password and your email password from a clean device.
3. Replace SMS 2FA with an authenticator app or security key.
4. Check your email for forwarding rules or filters you did not create.
5. If you suspect a SIM swap, contact your mobile carrier immediately.

If you sent funds to a scammer

1. Stop all contact and do not send more money, whatever you are told about fees or taxes.
2. Gather transaction details. The FBI says the most important information is transaction details: addresses, transaction IDs (hashes), amounts, dates and the platforms used, plus communications with the scammer.
3. Report to the FBI's IC3 at ic3.gov if you are in the US, and to the FTC at ReportFraud.ftc.gov. The FTC also lists the SEC and CFTC as places to report. Outside the US, report to your national police fraud unit and financial regulator.
4. Contact the exchange you sent from. If the funds went to an address at another exchange, that exchange may be able to act if contacted quickly by law enforcement.
5. Ignore anyone who offers to recover your crypto for a fee. The FBI and CFTC warn these are often follow-on scams.

If part of a scam was paid by card, the rules are different from crypto. Our guide on how to dispute a credit card charge explains when chargebacks may apply.

FAQ

Is a cold wallet always safer than a hot wallet?

For large, long-term holdings, a properly set up cold wallet is generally safer against online attacks, which is what the SEC and FINRA both note. But it is not safer if you store the seed phrase badly, skip the backup test, or approve a malicious transaction without reading it. The device protects the key; you still have to protect the backup and your own decisions.

Can a hardware wallet be hacked?

Hardware wallets are designed to keep keys isolated, but no system is perfect. Most real-world losses come from people revealing their seed phrase, buying tampered devices, or approving harmful transactions, rather than from breaking the device itself. Buy from official sources, keep firmware updated through the official app, and always check details on the device screen.

What happens if my hardware wallet breaks or is lost?

Your funds are not stored in the device. They are on the blockchain. If you have your seed phrase (and passphrase, if used), you can restore the wallet on a new compatible device. That is why the backup matters more than the device.

Is it safe to keep crypto on an exchange?

It depends on the exchange and how much you keep there. You are exposed to the company's security, honesty and solvency. Crypto on exchanges is not covered by FDIC insurance, according to FINRA, and the FCA says UK consumers are highly unlikely to be covered by the FSCS. Many people keep only what they need for trading on exchanges.

Can I store my seed phrase in a password manager?

Makers such as Trezor and Ledger advise never keeping digital copies of your seed phrase. A password manager is a digital store connected to your devices and often to the cloud. Keep the seed phrase offline, on paper or metal.

How many words should my seed phrase have?

BIP39 allows 12, 15, 18, 21 or 24 words. Your wallet will choose the length. Both 12 and 24 words are common. What matters most is recording every word correctly, in order, and keeping it safe.

Someone from "support" asked for my recovery phrase. What should I do?

Stop. It is a scam. Ledger, Trezor and ethereum.org all say legitimate staff will never ask for it. Do not reply, block the contact and, if you already shared anything, move your funds to a new wallet with a new seed phrase right away.

Is SMS two-factor authentication good enough?

It is better than no second factor, but it is vulnerable to SIM swaps. The FTC recommends an authenticator app or security key for sensitive accounts, and CISA describes FIDO/WebAuthn security keys and passkeys as the phishing-resistant option.

Do I need a lawyer for crypto inheritance?

You do not strictly need one to write instructions, but estate law varies by location, and mistakes can be costly or irreversible. For meaningful amounts, a lawyer familiar with digital assets can help structure access so it works legally and practically.

Should I carry my hardware wallet when travelling?

Only if you need it. Never carry the seed phrase backup. If the device is lost or seized, you can restore from the backup at home.

Bottom line

The hot wallet versus cold wallet question has a clear general answer. Hot wallets are for convenience and small amounts. Cold wallets are for savings. Exchanges are for buying, selling and short-term holding, with company risk on top of hacking risk.

But the device you choose is only part of the story. Most crypto losses come from people being tricked, not from clever code breaking. Protect your seed phrase offline and never share it. Check every address on a trusted screen. Refuse unlimited approvals. Replace SMS codes with a security key or passkey. Keep only working balances on platforms, remembering that Celsius and FTX customers learned how quickly withdrawals can stop. Write an inheritance plan your family can actually follow. And when you travel, leave the backup at home.

None of this needs expert skills. It needs a clear plan, set up once with care, and checked once a year.

Sources

All sources accessed September 29, 2026.

• SEC Office of Investor Education and Assistance: Crypto Asset Custody Basics for Retail Investors (Investor Bulletin, December 2025)
• FINRA: Storing Crypto Assets
• FTC: What To Know About Cryptocurrency and Scams
• FTC: Those urgent emails from MetaMask and PayPal are phishing scams (May 9, 2023)
• FTC: SIM Swap Scams: How to Protect Yourself
• FBI: Cryptocurrency and AI Scams Bilk Americans of Billions (2025 Internet Crime Report release)
• FBI Internet Crime Complaint Center: 2025 IC3 Annual Report
• IC3: Cryptocurrency Kiosk Complaint Data (May 15, 2026)
• IC3: FBI Warns of Scammers Impersonating Cryptocurrency Exchanges (August 1, 2024)
• IC3: Cyber Criminals Defraud Non-Custodial Wallet Users Through NFT Airdrops (June 3, 2025)
• IC3: FBI Guidance for Cryptocurrency Scam Victims (August 24, 2023)
• IC3: Cryptocurrency crime information
• FBI Denver: FBI Warns of Cryptocurrency Token Impersonation Scam
• CFTC: Digital Asset Frauds
• CFTC: CFTC Warns Customers to Watch for Follow-on Frauds
• NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management
• CISA: Implementing Phishing-Resistant MFA (fact sheet)
• FCA InvestSmart: Crypto basics
• bitcoin.org: Securing your wallet
• BIP-0039: Mnemonic code for generating deterministic keys
• ethereum.org: Ethereum security and scam prevention
• Trezor: How to use a wallet backup
• Trezor: Is my device safe to use?
• Ledger Academy: Why the twenty-four words phrase?
• Ledger Academy: Best practices to securely buy your Ledger signer
• US Attorney's Office SDNY: Samuel Bankman-Fried Sentenced to 25 Years in Prison
• US Attorney's Office SDNY: Founder of Celsius Sentenced to 12 Years for Fraud and Market Manipulation
• FTX Debtors: FTX Files Consensus-Based Plan of Reorganization (May 7, 2024)
• FTX Recovery Trust: Fourth Distribution Announcement (March 2026)
• US Customs and Border Protection: Border Search of Electronic Devices at Ports of Entry