Wallets
Hot wallet, cold wallet, and the line between them
The question is usually put as “do I need a hardware wallet”, which assumes there is a threshold. There is one, but it is not the amount of money people expect it to be. It is a question about which attack you are exposed to, and the answer changes the moment you start doing something different with your coins.
What the words describe
A hot wallet holds key material on a device that talks to a network: a phone, a laptop, a browser extension. A cold wallet holds keys on something that does not — a dedicated signing device, or paper, or metal.
The distinction is about the exposure of the key, not about the form factor or the price. A phone wallet and a browser extension are the same category of thing in this respect, even though one feels more serious than the other. A hardware device left permanently plugged into an infected computer is better than either, but for a reason that has nothing to do with being unplugged.
What a hardware wallet actually does
It does not hide the key more cleverly. It moves the signing operation onto a device with no general-purpose operating system, no browser, and no way to install anything.
When you approve a transaction, the unsigned transaction goes to the device, the device signs it internally, and the signature comes back. The private key is never present on the computer, so software running on that computer has nothing to steal — not because it is well hidden, but because it is not there.
That defeats an entire class of attack completely. Key-stealing malware, a malicious extension, a compromised clipboard, a hostile npm package in some tool you installed last year: none of them can extract a key that never arrives.
What it does not do
It does not decide what you sign. The most effective thefts against experienced holders do not steal keys at all. They get the owner to approve a transaction that does what the attacker wants — a token approval granting unlimited spending to a contract, a signature that transfers ownership, a “migration” that drains on confirmation. The hardware signs it perfectly, because you told it to.
This is why the small screen on the device is the actual security feature, and why reading it matters. The computer shows you what the website claims the transaction is. The device shows you what it is. When those disagree, the device is right, and the disagreement is the whole reason the screen exists.
It does not replace the backup. The device is a signing instrument; the root of everything remains the recovery phrase, and a hardware wallet with a phrase photographed onto a cloud drive is protected by nothing at all. If any part of that sentence is uncertain, what a recovery phrase controls and how it differs from a private key or a password are the prerequisites, not the follow-up.
Losing the device is not losing the funds. This is the most common misconception in the category and it runs in the expensive direction: people avoid hardware wallets because they fear a single point of failure that does not exist. The device holds a derived copy; the phrase is the original. Destroy the device and the phrase restores everything, on any compatible wallet. Lose the phrase and the device is the only copy left, which is a genuinely dangerous position to be in without noticing.
Browser extension wallets, specifically
They are convenient because they are embedded in the thing you are already using, and exposed for the same reason. An extension lives inside the most heavily attacked software on your machine, holds key material there, and exists specifically to approve transactions proposed by web pages.
That combination is fine for what they are good at — small balances, frequent interaction, things you would be annoyed but not damaged to lose. It is a poor place to keep a position you cannot replace, and the failure mode is not theoretical: a convincing page, a routine-looking approval, a signature given in five seconds.
Where the threshold actually is
Not a currency amount. Three conditions, any one of which is enough:
- You could not replace it. If losing the balance would change something about your life rather than annoy you, the storage question is no longer about convenience.
- You sign things you did not write. Every contract interaction is a request to approve something whose contents you are taking on trust. Volume of interaction raises exposure faster than size of balance does.
- You are holding rather than using. Coins meant to sit untouched for years have no reason to be reachable by a browser. The convenience of a hot wallet is worth paying for only if you are actually using it.
They are not competitors
The arrangement most people end up wanting is both: a hot wallet holding a small, replaceable working balance for the things that genuinely need to touch the web, and cold storage holding the rest, touched rarely and deliberately.
That split makes the daily wallet’s exposure survivable by design. It costs one device and the discipline to keep the balance in the hot wallet small enough that its compromise is an irritation rather than an event — which is easier to write than to maintain, and is the part that actually fails.
Where those coins sit before they reach a wallet at all is a separate decision with a separate set of trade-offs: exchange or self-custody covers what you are choosing between.