Cold wallet guide: what it protects, what it doesn't, and how to buy one safely

A cold wallet keeps your private keys on a device that is never online. Three things in the past week sent people looking for one. Binance lost about $6.3B from its hot wallets on 29 October. BTCPay Server told merchants on 1 November to switch off their servers after reports of drained hot wallets. And Ledger says some of its devices were opened and fitted with a spy chip before they reached buyers.

A cold wallet answers some of these and does nothing for others. This guide goes threat by threat. Checked on 2 November 2026.

What a cold wallet is

A cold wallet is a wallet whose private keys are created and stored offline. The usual form is a hardware wallet, a small device that signs transactions inside itself, so the keys never touch your computer or phone. A phone app or a browser extension is a hot wallet. An exchange account is a third thing: the exchange holds the keys and you hold a claim.

The real key is the recovery phrase, usually 12 or 24 words that the device shows once during setup. Whoever has those words controls the coins, with or without the device. Most of what follows is about protecting that phrase.

Threats and what works

Threat	Does a cold wallet help? What works
Exchange hack	Yes. Keep coins off the exchange.
Hot wallet on a server	Yes. Keys on a separate device, small float online.
Fake or tampered device	Not alone. Buy from the maker, create the phrase yourself.
Phishing	Only if you never type the phrase. It goes into the device only.
Lost phrase	No. Two copies on paper or steel, kept apart.
Malware on your computer	Yes. Read the address and amount on the device screen.

Exchange hack

CoinDesk calls the Binance drain the largest exploit in crypto history. Binance paused withdrawals and started reopening them in phases at 06:00 UTC on 1 November. It says users carry no loss and that it had replaced about 95% of the stolen assets by then.

That is a company promise. A cold wallet depends on neither a promise nor a withdrawal button. In the first 26 hours after reopening, our count found $6.96B leaving Binance in 735,608 transfers. The full story is in our hack timeline.

Hot wallet on a server

A BTCPay hot wallet keeps the seed on an internet-connected server so it can sign payments by itself. Anyone who gets in can send the coins out. BeInCrypto reports that attackers logged in as admin on servers running version 2.4.1 or older, and BTCPay has not said how they got in or how much was lost. Its founder's advice: "Don't put more than you are ready to lose in hot wallet."

A setup where the seed stays on a separate device leaves a server thief with nothing to sign with.

Fake or tampered device

On 13 October Ledger said its security lab found a hidden board inside a device sold by CryptoBilis, a reseller in Southeast Asia. The board reads the 24 words off the screen during setup and sends them over a mobile connection. Ledger says its chip, software and servers were not breached. It calls this an attack on the distribution channel. Every confirmed loss it knows of involves a CryptoBilis device, and it has not confirmed how many people were hit or how much was lost.

Two details matter for buyers. Ledger's Genuine Check is not built to spot extra hardware as long as the original chip is untouched, Quartz reported. And CryptoBilis was an authorised reseller, for Ledger and, until 9 October, for Trezor.

On 30 October Trezor said it received a report of a similar implant in a Safe 5 bought from CryptoBilis in August. That is an allegation: Trezor had not yet examined the device and says no buyer has reported a loss. It told CryptoBilis buyers since March 2026 to move funds to a new wallet with a new phrase.

Ledger's record is not spotless either. In 2020 a customer database with about 272,000 records was published on a forum. In December 2023 an attacker pushed a malicious version of Ledger Connect Kit, a library apps use, through a former employee's account. Neither pulled keys out of a device, but both show that a brand name is not a guarantee.

Phishing

In September, attackers broke into the newsletter provider that Trezor and BitBox share and sent a fake "Critical Security Alert" asking for recovery words. Trezor says about 347,000 addresses were exposed and roughly 2,500 people clicked before it took the link down. BitBox says its list held only email addresses and its devices were not affected.

Clicking is not the loss. Typing the phrase into anything but the device is. Ledger and Trezor both say they never ask for it.

Who needs one

We think anyone holding an amount they would hate to lose for months should have one. If you trade daily, keep a float on the exchange (our exchange comparison covers the choice) and the rest offline. The trade-off is real: nobody can reset a lost phrase for you. For a small balance, a software wallet with a good backup can be a fair middle step.

How to buy one safely

Buy from the maker. Type the address yourself, not an ad or a marketplace seller. For Ledger that is the official Ledger store (referral link). Trezor and BitBox sell direct as well. We have a referral link with Ledger only and no agreement with Trezor or BitBox.
Check the box. Broken seals, a resealed box or a card with words already printed mean stop. Ledger's own rule: the phrase is generated by the device, never supplied.
Run the maker's authenticity check, and treat a pass as one signal, not proof. Where you bought matters more.
Create the phrase yourself. Write it by hand on paper or steel. No photos, no cloud, no notes app.

There is no single best hardware wallet. Pick by where you can buy it directly, whether the firmware is open or audited, and whether it supports your coins.

Moving funds from an exchange

Set up the device and back up the phrase. Optionally reset it and restore from your written words, so you know the backup works.
In the wallet app, copy a receiving address. Compare it with the one on the device screen, because malware can swap what the computer shows.
On the exchange, pick the right coin and network. A wrong network can lose the coins.
Send a small test amount first and wait until it arrives.
Send the rest, in two or three parts if the sum is large.

If you bought a device from CryptoBilis, follow the maker's guidance: new device, new phrase, and never restore the old words.

FAQ

What is a cold wallet?

A wallet whose private keys are created and kept offline. A hardware wallet is the most common kind.

What is a hardware wallet?

A small device that stores your keys and signs transactions on the device, so the keys never reach your computer.

What is the best hardware wallet?

We do not rank them. Look for direct purchase from the maker, open or audited firmware, and support for your coins.

Can a cold wallet be hacked?

The device is hard to attack remotely, but you can still lose coins through a tampered device, a phished recovery phrase or a lost backup.

Should I move everything off an exchange?

Not necessarily. Keep what you trade on the exchange and the rest offline.

Sources

Referral disclosure: the Ledger link marked in this article is a referral link, and Pawnie may receive a reward if you sign up or use the platform. We have no agreement with Trezor or BitBox. This is not financial advice or a recommendation to buy a product. No wallet protects against every risk, and rules and facts change, so check the maker's current guidance. Information as of 2 November 2026.