Crypto Wallets: Hot, Cold and Self-Custody Explained
Course goal: understand what a crypto wallet actually stores, the difference between custodial and self-custody wallets, how hot and cold storage differ, and how to choose a setup that matches your risk and experience.
1. A wallet does not literally hold coins
Your cryptoassets exist on a blockchain ledger. A wallet stores or manages the credentials that let you prove control over those assets and authorize transactions. In most cases, the critical secret is a private key. The wallet software uses that key to create digital signatures.
This distinction matters because losing a phone does not necessarily mean losing the assets if you have a valid backup. Equally, someone who obtains your recovery phrase can often control the assets even if they never touch your device.
2. Public addresses and private keys
A public address is designed to be shared. It is where other users can send assets. A private key must remain secret because it authorizes spending. Modern wallets hide much of the cryptographic complexity and present a familiar interface with balances, send buttons and transaction histories.
A useful mental model is that the blockchain is the vault, your address is a visible deposit box number and the private key is the secret needed to authorize movement from that box. The analogy is imperfect, but it reinforces the key point: possession of the key matters more than possession of the device.
3. Custodial wallets
When crypto is kept on a centralized exchange or custody service, the provider normally controls the underlying keys. The customer logs in with an account and sees a balance. Internally, the provider may pool assets across many wallets and maintain its own accounting ledger.
Custody can be convenient. Password resets, account recovery, customer support and institutional security controls may reduce some user mistakes. However, customers depend on the provider remaining solvent, secure and willing to process withdrawals. The phrase “not your keys, not your coins” captures this counterparty trade-off, but self-custody introduces its own risks too.
4. Self-custody wallets
With self-custody, the user controls the keys directly. No exchange can normally reset a lost recovery phrase. This gives greater control and enables direct use of decentralized applications, but it also transfers responsibility for backups, transaction verification and security to the user.
Self-custody is not automatically safer. A careful user with a well-designed hardware-wallet setup may reduce counterparty risk dramatically. An inexperienced user who stores a seed phrase in email and signs random smart-contract approvals may be less safe than on a regulated custody platform.
5. Hot wallets
A hot wallet is connected to an internet-enabled device. Browser extensions and mobile wallets are common examples. They are convenient for frequent transactions, DeFi, NFTs and decentralized applications because signing is quick.
The trade-off is exposure. Malware, malicious browser extensions, phishing sites and compromised devices can target hot wallets. For that reason, many experienced users treat a hot wallet like cash in a physical wallet: enough for regular activity, but not necessarily the place for long-term savings.
6. Cold wallets and hardware wallets
Cold storage keeps private keys away from general-purpose internet-connected environments. A hardware wallet is a specialized device designed to generate and protect keys while signing transactions without exposing the key directly to the computer.
A hardware wallet does not make a user invincible. If someone tricks you into approving a malicious transaction, the device can faithfully sign it. The security benefit is strongest against key extraction and compromised computers, not against every form of social engineering.
7. Seed phrases
Many wallets derive multiple keys from a recovery phrase, commonly 12 or 24 words. The phrase is a master backup. Anyone who possesses it may be able to regenerate the wallet elsewhere.
Never type a seed phrase into a random website, support chat or cloud form. Do not photograph it or store it in an ordinary note application unless you fully understand the security implications. Physical backups should be protected from theft, fire, water and accidental disposal.
8. Passphrases
Some wallet standards allow an additional passphrase that changes the derived wallet. This can add a layer of security, but it also creates another way to lose access. A forgotten passphrase cannot generally be recovered from the seed phrase alone.
Advanced features are not automatically better. A simple setup you can operate correctly is often safer than a complicated setup that creates new failure points.
9. Multi-signature wallets
Multi-signature, or multisig, arrangements require more than one key to authorize transactions. A 2-of-3 wallet, for example, may require any two of three keys. This reduces dependence on a single device or backup.
Multisig can be valuable for businesses, families, treasuries and large personal holdings. It also increases operational complexity. Users need a plan for where keys are stored, how signers coordinate, what happens if a signer becomes unavailable and how the setup can be reconstructed years later.
10. Smart-contract wallets
Some networks support wallets implemented through smart contracts. These can offer features such as spending limits, social recovery, multiple signers or programmable permissions. The benefit is flexibility; the risk is additional contract complexity and reliance on the wallet’s implementation.
11. Address verification
Crypto transactions are often irreversible. Before sending, check the network, asset and destination address. For large transfers, send a small test transaction first. Hardware wallets should display the destination on the device itself so you can compare it against the intended address rather than trusting only the computer screen.
Be cautious with clipboard malware that replaces copied addresses. Always compare the first and last several characters, and for high-value transfers verify the complete address where practical.
12. Network selection
The same token symbol can exist on multiple networks. USDC, for example, may be available across several chains. An exchange withdrawal page can therefore ask you to choose a network. Sending to a network the recipient does not support can cause loss or require a difficult recovery process.
Network choice also affects fees, confirmation speed and bridge risk. Do not choose the cheapest option unless you know the receiving wallet or platform supports it.
13. Wallet approvals
On smart-contract networks, using a DeFi application may require granting a contract permission to spend a token. Some approvals are unlimited. If the contract is malicious or later compromised, that approval can become a risk.
Review active approvals periodically and revoke permissions you no longer need. When interacting with unfamiliar applications, consider a separate wallet with limited funds rather than exposing your long-term holdings.
14. A tiered wallet model
One practical structure is to separate assets by purpose. A long-term cold wallet can hold assets that rarely move. A second wallet can handle medium-term transfers. A small hot wallet can be used for DeFi or experimental applications. This limits the damage if one environment is compromised.
Institutional custody uses similar ideas through segregation of duties, whitelists and limits. The principle is simple: do not expose everything to the same risk surface.
15. Choosing between custody and self-custody
Ask what you are trying to protect against. If your biggest risk is forgetting passwords and losing backups, a reputable custodian may be appropriate for part of your holdings. If your biggest concern is exchange failure or withdrawal restrictions, self-custody may address that risk.
There is no rule that every user must choose only one model. Some people diversify custody across self-custody and established providers. The important point is to understand the failure modes rather than treating one slogan as a complete security strategy.
16. Security checklist
- Use unique passwords and strong multi-factor authentication for exchange accounts.
- Protect recovery phrases offline.
- Buy hardware wallets from trusted sources and verify setup instructions.
- Bookmark important sites rather than relying on ads or search results.
- Use small test transfers.
- Confirm addresses and networks before sending.
- Keep device software updated.
- Separate long-term holdings from experimental DeFi activity.
- Have an inheritance or emergency-access plan for significant assets.
17. Knowledge check
- What does a wallet actually store or manage?
- What is the main trade-off between custodial and self-custody wallets?
- Why does a hardware wallet not protect against every scam?
- Why can an unlimited token approval be risky?
- What advantage does multisig provide?
Answers: wallets manage keys; custody trades control for convenience and provider risk; hardware wallets can still sign malicious instructions approved by the user; unlimited approvals may let a compromised contract move tokens; multisig reduces dependence on one key.
18. Practical exercise
Draw your own wallet map without recording any secrets. List where you currently hold assets, whether each location is custodial or self-custodial, which networks you use, and the main risk for each location. Then decide which environment should be used for long-term storage, routine transactions and experiments.
19. Key takeaways
Wallet security is about controlling keys and reducing failure points. Hot wallets optimize convenience, cold wallets reduce online key exposure, custodians reduce some user-management burdens, and self-custody reduces dependence on third parties. Good security usually comes from matching the tool to the purpose.
Next lesson: Seed Phrases and Private Keys: How to Protect Your Crypto →
Educational content only.