Crypto can lose all of its value and is not protected by FDIC or SIPC insurance. This is education, not investment advice.
A cold wallet is a crypto wallet that keeps your private keys on a device or medium that never connects to the internet. Because the keys stay offline, someone who hacks your phone, laptop or exchange account still cannot sign a transaction that moves your coins. This guide covers how cold storage works, the main types, what it costs, where it fails, and how US tax rules treat it.
NEW RULERelated consumer alert, Oct 21
OCC final rule keeps issuer yield ban, reviews stablecoin rewards case by caseRun the numbers
Before you move crypto offline
If you lose both the device and your recovery phrase, no company, bank or court can restore your coins. Cold storage also protects only against hacking. It does nothing about price: crypto can lose all of its value.
What a cold wallet actually holds
Your bitcoin or other coins never sit inside a wallet. They exist as entries on a public blockchain. What a wallet holds is the private key, a very large secret number that proves you control those entries and lets you authorize spending them.
That changes how you should think about security. Anyone who gets your private key can move your coins from anywhere in the world. Nobody needs your device, your password or your permission.
The words “hot” and “cold” describe where that key lives:
- Hot wallet: the key sits on a device connected to the internet, such as a phone app, browser extension or exchange account.
- Cold wallet: the key is created and stored somewhere offline, such as a hardware device, a sheet of paper or a computer that never goes online.
So the plain cold wallet meaning is this: a crypto offline wallet whose keys are kept away from networks that attackers can reach. You still use the internet to check balances and broadcast transactions. The key itself stays out of reach.
How a cold wallet keeps crypto offline
Most people use a hardware wallet, a small device built for one job: holding keys and signing transactions. The process below describes how that works. Other cold wallet types follow the same logic with different tools.
1. The key is generated on the device
When you set up a hardware wallet, it creates your keys internally using its own random number generator. The private key is never sent to your computer or phone. Many devices store it in a secure element, a tamper-resistant chip similar to those in bank cards and passports.
2. You write down a recovery phrase
The device then shows you a recovery phrase, also called a seed phrase. It is usually 12 or 24 words drawn from a standard list of 2,048 English words defined in a technical standard called BIP39.
Those words encode the master secret behind every key in your wallet. If the device breaks, gets lost or is stolen, you can type the same words into a new compatible wallet and regain access to everything. That makes the paper (or metal) holding your phrase the real wallet. The device is replaceable. The phrase is not.
3. A PIN protects the device
You set a PIN that unlocks the device. Wrong guesses are limited. Ledger devices erase themselves after three wrong PIN entries, and Trezor devices wipe after 16 failed attempts. A thief with your device but not your PIN has very few tries before it resets, leaving you to restore from your phrase.
4. Transactions are signed offline
Here is the core trick. Sending crypto requires a digital signature made with your private key. A cold wallet splits that job:
- Your computer or phone app builds an unsigned transaction (amount, destination address, fee).
- The unsigned transaction goes to the hardware wallet by USB, Bluetooth, QR code or a memory card.
- The device shows the details on its own screen. You check the address and amount, then press a button to approve.
- The device signs the transaction internally and sends back only the signed transaction.
- Your app broadcasts the signed transaction to the network.
Your private key never leaves the device during any of these steps. Malware on your laptop can see the transaction, but it cannot produce a signature without the physical device, the PIN and your approval.
That on-screen check matters more than most users realize. A common attack swaps the destination address on your computer screen. The device screen is the one you trust, so read it every time.
Types of cold wallets
Not every cold crypto wallet is a gadget. Here are six approaches, from the most common to the most specialized.
| Type | How keys stay offline | Typical cost | Main strength | Main weakness |
|---|---|---|---|---|
| USB or Bluetooth hardware wallet | Secure chip; signs via cable or Bluetooth | About $50 to $400 | Easy to use, wide coin support | Connects to an online device for each transaction |
| Air-gapped hardware wallet | Signs via QR codes or microSD card, no cable | About $100 to $200 | No direct data link to a computer | Slower, steeper learning curve |
| Smart card wallet | Secure chip in a card; signs by NFC tap to a phone | About $50 to $100 | Fits in a wallet, no battery | Depends on the maker’s phone app |
| Paper wallet | Keys printed or written on paper | Near zero | Nothing to hack | Easy to damage; risky to create and spend from |
| Offline computer | Old laptop that never connects to a network | Cost of a spare computer | Full control, no vendor | Technical, easy to slip up |
| Multisignature vault | Several keys on separate devices; e.g. 2 of 3 must sign | Two or three devices | No single point of failure | Complex setup and recovery |
A few notes on each:
USB or Bluetooth hardware wallets are what most people mean by a cold wallet for crypto. They plug into a computer or pair with a phone, and a companion app shows balances. They handle bitcoin, ether and thousands of tokens and NFTs, depending on the model.
Air-gapped hardware wallets never form a data connection at all. You pass transactions back and forth by scanning QR codes or moving a microSD card. Bitcoin users often pair these with a standard format called a partially signed bitcoin transaction (PSBT).
Smart card wallets put the secure chip inside a credit-card-sized card. You tap it against your phone to approve a transaction. They are convenient, but you rely heavily on one company’s app.
Paper wallets were popular in bitcoin’s early years. Today most security researchers discourage them. Generating one on an internet-connected computer can leak the key, and spending part of the balance is error-prone.
An offline computer can act as a cold wallet if it is wiped, loaded with wallet software and kept off every network permanently. It works, but one careless Wi-Fi connection undoes the whole point.
Multisignature setups spread control across several keys. Losing one device or one backup does not lose your funds, and a thief needs more than one key. They suit larger holdings and people planning for inheritance.
Smart contracts, NFTs and cold storage
Cold wallets can hold NFTs and interact with decentralized apps, because the NFT is just another blockchain entry tied to your key. If you are new to that side of crypto, our explainer on NFTs and how they work covers the basics. The catch: approving a smart contract from a cold wallet is still approving it. If the contract is malicious, your hardware wallet will faithfully sign away your assets. More on that in the risks section.
Cold wallet vs hot wallet
Neither is better in every situation. Most active crypto users keep a small “spending” balance hot and a larger “savings” balance cold.
| Feature | Hot wallet | Cold wallet |
|---|---|---|
| Where keys live | Internet-connected phone, browser or exchange | Offline device, paper or computer |
| Cost | Usually free | About $50 to $400 for hardware |
| Speed of use | Instant | Slower; device needed for each send |
| Exposure to remote hacking | Higher | Much lower |
| Exposure to physical loss | Low (exchange) to moderate (app) | Higher; you manage the backup |
| Who controls keys | You (software wallet) or the company (exchange) | You |
| Best for | Small balances, frequent trading | Long-term holdings |
An important distinction sits inside the hot column. A software wallet such as Trust Wallet, MetaMask or Exodus is self-custodial: you hold the keys, but they live on an online device, so it is a hot wallet. An exchange account is custodial: the company holds the keys and you hold a claim against the company. Some software wallets can connect to a hardware device, which turns the app into a viewing and transaction-building screen while the hardware keeps the keys cold.
Why people move crypto into cold storage
Cold storage exists mainly because custodians fail. A few examples show what that looks like.
- Mt. Gox, once the largest bitcoin exchange, collapsed in 2014 after losing about 850,000 bitcoin, roughly 200,000 of which were later recovered. Creditors waited roughly a decade for partial repayment.
- Celsius Network froze withdrawals in June 2022 and filed for bankruptcy. In January 2023, the bankruptcy judge ruled that crypto in customers’ “Earn” accounts belonged to the company’s estate, not to the customers.
- FTX filed for bankruptcy in November 2022. Its founder was later convicted of fraud for misusing customer deposits.
Some high-yield crypto platforms that collapsed were later described by prosecutors and regulators as paying old depositors with new money, the pattern our guide to how a Ponzi scheme works breaks down. With a cold wallet, the company that sold you the device never holds your coins. If it disappears tomorrow, you restore your phrase into another compatible wallet.
That is the full case for cold storage: you remove the middleman. The trade-off is that you also remove the help desk.
What hardware wallets cost
Below are well-known hardware and card wallets with the approximate list prices their makers publish. Prices change often and discounts are common, so treat these as ballpark figures. US Financer takes no money from any wallet maker, and inclusion here is not a recommendation.
| Model | Approx. list price (USD) | Connection | Notable trait | Notable weakness |
|---|---|---|---|---|
| Ledger Nano S Plus | $79 | USB-C | Entry price, wide coin support | Firmware not fully open source |
| Ledger Nano X | $149 | USB-C, Bluetooth | Battery, phone pairing | Bluetooth adds an attack surface |
| Ledger Flex | $249 | USB-C, Bluetooth, NFC | Larger E Ink touchscreen | Higher cost |
| Ledger Stax | $399 | USB-C, Bluetooth, NFC | Largest screen | Highest cost in this list |
| Trezor Safe 3 | $79 | USB-C | Open-source firmware, secure element | Small screen, button navigation |
| Trezor Safe 5 | $169 | USB-C | Color touchscreen | No Bluetooth for phone use |
| Coldcard Mk4 | About $150 | USB-C or microSD air gap | Bitcoin-only, advanced options | Steep learning curve, bitcoin only |
| Keystone 3 Pro | About $150 | QR codes (air-gapped) | No USB data link needed | Fewer integrations than larger brands |
| Arculus card | About $100 | NFC tap to phone | Card form factor | Relies on the maker’s app |
Price is a small part of the real cost. Budget for these too:
- A metal backup plate if you want your phrase to survive fire or flooding. These typically cost tens of dollars.
- Network fees each time you move coins on or off the device. Bitcoin and Ethereum fees rise and fall with demand, so you pay whatever the network charges at that moment.
- Exchange withdrawal fees, which some platforms charge when you move coins to your own wallet.
Brand reputation matters as well. Ledger drew heavy criticism in 2023 when it announced Ledger Recover, an optional paid service that can back up an encrypted, split copy of your phrase with third-party companies. Critics argued it showed the firmware could export key material. Ledger said the feature is opt-in. Separately, Trezor’s older models were shown by Kraken Security Labs in 2020 to be vulnerable to key extraction by someone with physical access and lab equipment, a risk that an added passphrase helps reduce.
Risks of using a cold wallet
A cold wallet blocks remote hacking very well. It does not block every way to lose money.
You can lock yourself out forever
Lose the device and the phrase, and the coins are gone. Chainalysis estimated in 2020 that about 20% of all bitcoin mined to that point appeared lost or stranded, much of it from forgotten keys and discarded drives.
Phishing goes after your recovery phrase
Attackers know they cannot hack the device, so they target you. In 2020, Ledger disclosed that a breach of its marketing and e-commerce database exposed contact details for about 272,000 customers. Customers then received phishing emails, texts and even mailed fake devices asking for their recovery phrases. No legitimate company, support agent or app update will ever ask for your 24 words.
Tampered devices
Buy only from the manufacturer or its authorized sellers. A device that arrives with a recovery phrase already printed inside, or that asks you to enter a phrase instead of generating one, is a scam.
Blind signing and wallet drainers
A cold wallet signs what you approve. Drainer scams trick you into approving a smart contract permission that lets the attacker move your tokens later. In December 2023, a compromised Ledger software library briefly served malicious code to several decentralized apps, and users who approved its prompts lost funds. Read every prompt on the device screen, and refuse ones you do not understand.
Physical theft and coercion
A device in a drawer can be stolen, and a written phrase can be photographed. Keep the phrase somewhere separate from the device. An optional BIP39 passphrase (sometimes called a 25th word) creates a hidden wallet that a thief with only your 24 words cannot open. Forget that passphrase, though, and you lose access too.
Inheritance
If you die or become incapacitated, your family needs to know the wallet exists and how to reach the phrase, without that information being exposed while you are alive. Many people leave sealed instructions with an estate attorney.
Market risk and no insurance
Cold storage changes who holds your keys. It does not change what the coins are worth. Crypto prices can fall sharply and can go to zero. Crypto in any wallet is not covered by FDIC deposit insurance, which protects bank deposits, or by SIPC, which covers certain securities at failed brokerages. Nothing makes you whole if prices collapse or a key is lost.
How to set up a cold wallet safely
Setting up a hardware wallet
- Buy the device directly from the maker or an authorized seller.
- Check the packaging for tampering and confirm no seed phrase came with it.
- Download the companion app only from the maker’s official website.
- Let the device generate a new recovery phrase.
- Write the words by hand on paper or stamp them into metal; never photograph or type them.
- Set a strong PIN and, if you understand it, an optional passphrase.
- Send a small test amount, then practice restoring the wallet before moving larger sums.
Store the phrase in a different place from the device. A fireproof safe at home and a second copy in a separate secure location is a common approach. Bank safe deposit boxes are an option, though contents of those boxes are not FDIC insured either.
Each time you receive crypto, confirm the receive address on the device screen, not just on your computer. Each time you send, compare the first and last several characters of the destination address on the device itself.
US rules and taxes for cold wallets
Holding your own crypto is legal
No federal law requires a license or registration to keep your own crypto in a wallet you control. In December 2020, FinCEN proposed a rule that would have required banks and money services businesses to collect information on certain transfers to self-hosted wallets. That proposal was never finalized, so it is not law.
In July 2025, the GENIUS Act became law and set federal rules for payment stablecoin issuers. A broader crypto market structure bill, the CLARITY Act, passed the House that same month but had not been signed into law at the time of writing. Neither changes your basic right to self-custody, but check the current status of any bill before relying on news coverage of it.
The IRS treats crypto as property
Under IRS Notice 2014-21, digital assets are property for federal tax purposes. You owe tax when you dispose of them, and moving coins into storage is not a disposal.
| Action | Taxable? | Notes |
|---|---|---|
| Moving crypto from an exchange to your cold wallet | No | Same owner before and after |
| Moving crypto between two wallets you own | No | Keep records of the transfer |
| Paying a network fee in crypto to make that transfer | Possibly | The fee itself is a small disposal of crypto |
| Selling crypto from a cold wallet for dollars | Yes | Capital gain or loss |
| Swapping one coin for another | Yes | Treated as selling one property for another |
| Receiving staking rewards | Yes | Ordinary income when you gain control |
On Form 1040, the IRS asks whether you received, sold, exchanged or otherwise disposed of a digital asset during the year. The IRS’s instructions say that simply holding crypto or moving it between your own wallets does not by itself require a “Yes.”
Records matter more once coins leave an exchange
Starting with transactions in 2025, crypto brokers report sales to the IRS on the new Form 1099-DA. Cost basis reporting begins for certain assets acquired on or after January 1, 2026. If you move coins to a cold wallet and later send them back to an exchange to sell, the exchange usually has no record of what you paid. You are responsible for proving your basis.
The IRS also now requires basis to be tracked wallet by wallet rather than across all your accounts combined, effective January 1, 2025, with a safe harbor described in Revenue Procedure 2024-28. Keep a spreadsheet or use tax software that logs purchase dates, prices and every transfer into and out of cold storage.
Losing access to a cold wallet generally does not give you a deductible loss under current rules for personal casualty and theft losses. If you face a large loss, a tax professional can tell you whether any exception applies.
Where to report crypto scams
Scammers often push victims to buy crypto with cash and send it to an address they control, frequently through a crypto ATM. The FBI’s Internet Crime Complaint Center reported about $9.3 billion in crypto-related fraud losses in its 2024 annual report.
If someone asks for your recovery phrase, sends you an unexpected hardware wallet, or impersonates wallet support, report it:
- FBI IC3 for crypto fraud and theft
- FTC ReportFraud for scams and impersonation
- CFPB complaint portal if a financial company involved mishandled your account
- Your state attorney general or financial regulator
Before sending crypto to any business that claims to hold it for you, check whether it is registered as a money services business through FinCEN’s MSB search, and check investment firms through the SEC’s and FINRA’s BrokerCheck.
Do you need a cold wallet?
A cold wallet for cryptocurrency makes the most sense if you hold an amount you could not afford to lose to a hack, plan to keep it for months or years, and are willing to manage a backup carefully.
It makes less sense if your balance is small relative to the device price, or if you trade often. A $79 device to protect $150 of crypto is an expensive lock for a small safe.
Lower-cost ways to start
For small balances, a free, reputable self-custodial software wallet with a handwritten recovery phrase gives you key control without hardware costs.
If you keep crypto on an exchange, turn on app-based two-factor authentication and an address allowlist for withdrawals.
Move to cold storage once the amount at risk clearly justifies the device and the effort.
Two habits matter more than which device you pick: never type, photograph or share your recovery phrase, and test your restore process before you need it.
FAQ
Can a cold wallet be hacked?
Remote hacking of the keys is very difficult because they never touch the internet. Losses still happen through phishing for the recovery phrase, fake devices, malicious transactions you approve, and physical attacks by someone with lab equipment. Most real-world losses come from the first three.
What happens if the company that made my wallet shuts down?
Your coins stay on the blockchain. Because most wallets use the BIP39 standard, you can enter your recovery phrase into another compatible wallet and regain access. Write down which wallet and coins you used, since some setups use nonstandard settings.
Can I buy crypto directly onto a cold wallet?
Some hardware wallet apps connect to third-party purchase services that deliver coins to your device address. Those services charge their own fees and spreads, which are often higher than an exchange. The cold wallet itself is only storage.
Is Trust Wallet a cold wallet?
No. Trust Wallet is a software wallet on your phone or browser, so it is a hot wallet even though you control the keys. It becomes part of a cold setup only if you connect it to a supported hardware device that holds the keys.
Do I owe taxes when I move crypto into a cold wallet?
No. Transferring crypto between wallets you own is not a sale. If you pay the network fee in crypto, that small amount can count as a disposal. Keep records so you can prove your cost basis when you later sell.
How many recovery words should I use, 12 or 24?
Both are considered very secure against guessing. A 24-word phrase encodes more randomness. What matters far more is that the words are written correctly, stored safely and never entered into a website or app other than your wallet during a genuine restore.
Is crypto in a cold wallet insured?
No. Neither FDIC nor SIPC coverage applies to crypto, and hardware wallet makers do not reimburse lost or stolen coins. If the keys are lost or the price falls, the loss is yours.
Laws and regulations referenced
- IRS Notice 2014-21 (virtual currency is property)
- IRS Form 1099-DA, Digital Asset Proceeds From Broker Transactions
- GENIUS Act (stablecoins), Public Law 119-27 (S. 1582)
- Digital Asset Market Clarity Act, H.R. 3633 (a bill, check its current status)
- FDIC deposit insurance
Links go to the official text on government sites.
Check, verify or complain
Sources
- hedgewithcrypto.com › how much bitcoin is lost hedgewithcrypto.com
- bitcoin.tax › blog › irs rev proc 2024 28 preparing 2025 crypto reporting requirements bitcoin.tax
- taxbit.com › blogs › celsius bankruptcy update making sense of the courts recent rul… taxbit.com
- ledger.com › message ledgers ceo data leak ledger.com
- coindesk.com › markets › 2025 › 04 › 24 › fbi says americans lost usd9 3b to crypto scams in… coindesk.com
Owen explains how crypto works for US readers: coins and tokens, buying and selling, wallets and self-custody, staking and DeFi. He sticks to how things work and what they cost, never price calls, and checks platform fees and licensing against the companies' own disclosures.
Ruth is US Financer's standards editor. Every article goes through her checks before and after it is published: each rate, fee, cap, deadline and rule is matched against its primary source, every law named is linked to its official text, and anything that cannot be…
Comments are closed