Key takeaways
- People reported $9,322,335,911 in cryptocurrency-related losses to the FBI's Internet Crime Complaint Center in 2024, across 149,686 complaints, according to its 2024 annual report.
- A cold wallet signs payments on an offline device, yet the written seed phrase is what restores the funds if that device is lost or breaks.
- Under IRS virtual currency guidance, moving crypto between wallets you own is not a taxable sale, though a network fee paid in crypto counts as a disposal.
- A 12-word BIP-39 seed phrase encodes 128 bits of entropy, so the practical threat is someone reading the phrase, since guessing it is out of reach.
- FTC consumer guidance dated 5 June 2025 says cryptocurrency payments typically cannot be reversed and come with no legal protections.
$9,322,335,911 in cryptocurrency-related losses were reported to the FBI in 2024, across 149,686 complaints, according to the IC3 2024 report. In the hot wallet vs cold wallet choice, that figure argues for keeping only spending money hot and moving savings cold once a theft would cost more than the device.
A cold wallet guards against remote theft, yet it hands you a different job. You become the only keeper of the seed phrase, a list of 12 to 24 words under the BIP-39 standard that can rebuild the wallet on any compatible device. If those words are lost, no support desk can reset them.
So the real decision is which failure you can live with: someone else reaching your keys, or you losing them.
Hot Wallet vs Cold Wallet: Four Ways to Hold Crypto
The four common setups differ in who holds the private keys and whether those keys ever touch the internet.
Exchange account
Who holds the keys: the exchange
Internet exposure: keys sit with the platform; you sign in with a username and password
Recovery if you lose access: a password reset through the platform
Main risk: the platform itself failing or being breached
Hot wallet (phone or browser app)
Who holds the keys: you, on a device that goes online
Internet exposure: high, since the key and your browsing share one device
Recovery if you lose access: the seed phrase only
Main risk: malware or a fake app on the same device
Cold wallet (hardware device)
Who holds the keys: you, on a device that signs offline
Internet exposure: low, because the key stays inside the device
Recovery if you lose access: the seed phrase only
Main risk: losing the seed phrase, or letting someone read it
Cold wallet with a split backup
Who holds the keys: you, with the backup divided into shares
Internet exposure: low
Recovery if you lose access: a preset minimum number of shares
Main risk: losing so many shares that the minimum can no longer be met
What Makes a Wallet Hot or Cold?
Where the private key lives when you approve a payment decides it. A private key is the secret number that authorizes spending from a crypto address, and a wallet is the software or device that stores that key and signs with it. The coins themselves stay on the blockchain. Ethereum.org's wallet guide puts it plainly: "Wallet providers don't have custody of your funds." What a wallet holds is the power to move them.
A hot wallet keeps the key on a phone or computer that is connected to the internet, so anything else running on that machine is a potential route to it. A cold wallet keeps the key on hardware that never hands it to the connected computer. Think of a hardware wallet as a notary who never leaves the office: the unsigned payment goes in, a signed one comes out, and the stamp stays inside. Ethereum.org describes hardware wallets as devices that "let you keep your crypto offline."
An exchange account is a third case. You hold a login, and the exchange holds the keys. Ethereum.org's guide warns that this means "trusting that exchange with custody over your funds."
At What Balance Does Cold Storage Pay Off?
It pays off once the cost of the device is a small share of what it protects. The FBI's figures set the scale of the downside. Dividing $9,322,335,911 by 149,686 complaints gives an average reported loss of about $62,280 per cryptocurrency complaint in 2024.
That average covers every kind of crypto crime, including investment fraud where victims send the coins themselves, which no wallet prevents. A cold wallet does stop malware on your laptop from quietly signing a payment for you.
Suppose a hardware wallet costs $100; check the maker's shop for the real price. Against $500 in crypto, that is 20% of the balance, a steep insurance premium. At $2,000 it is 5%. At $10,000 it drops to 1%, and at $50,000 to 0.2%. Somewhere in that range the device stops looking like an expense and starts looking like a lock on a safe you already own.
Friction is the other cost. Every payment from cold storage means fetching the device and confirming the payment on its screen. For coins you touch once a year, that costs nothing; for weekly trading it is a real drag. That is why the split follows how often you use the coins.
Why Is the Seed Phrase the Real Weak Point?
Because it is the one thing that can rebuild the wallet without the device, it is also the one thing a thief needs. The BIP-39 standard opens: "This BIP describes the implementation of a mnemonic code or mnemonic sentence." Its English wordlist holds 2,048 words, and a 12-word phrase carries 128 bits of entropy, rising to 256 bits at 24 words.
No one guesses a 128-bit secret. The realistic threats are careless ones: a photo synced to the cloud, an email draft, paper lost in a move, or words typed into a fake support site. Ethereum.org's advice is short: "Don't store it on a computer. Write it down and keep it safe." Losing the device is an inconvenience if the phrase survives. Losing the phrase leaves you one broken device away from losing everything.
Split backups exist for exactly this problem. The SLIP-0039 standard, published by SatoshiLabs, divides a wallet's master secret into shares, so that a set number, such as two of three, can restore it. The specification states: "Knowledge of fewer than the required number of parts does not leak information about the master secret." It also warns that SLIP-0039 and BIP-39 are, "for the most part," not compatible, so your wallet has to support the scheme before you rely on it.
Do You Owe Tax When Moving Coins to Cold Storage?
No, as long as the coins move between wallets you own. The IRS frequently asked questions on virtual currency treat a transfer between your own wallets as a non-taxable event. The fee is the exception. The IRS digital assets page lists paying a transfer fee with digital assets as a disposal, so a fee paid in the moved coin is a small taxable sale.
Holding crypto yourself also changes what protects you. The FTC guidance, dated 5 June 2025, says "Cryptocurrency payments typically are not reversible" and that they "do not come with legal protections." With self-custody, nobody stands between you and a mistaken or coerced transfer. As of 19 October 2026, these rules stand as described here. None of this is tax or financial advice.
What Changed for Crypto Custody in 2025?
Two federal shifts in 2025 touch this choice, one on record-keeping and one on banks. From 1 January 2025, IRS Revenue Procedure 2024-28 requires cost basis to be tracked wallet by wallet, and brokers began reporting sales on Form 1099-DA. The IRS instructions for that form say a provider that only supplies software or hardware for controlling your own keys is not acting as a broker. Coins in a cold wallet sit outside that reporting, and the basis records sit with you.
On 14 July 2025, the Federal Reserve, the FDIC and the Office of the Comptroller of the Currency issued a joint statement on banks holding crypto for customers. A bank that offers safekeeping "must do so in a safe and sound manner and in compliance with applicable laws and regulations," the agencies wrote. The statement sets expectations for banks and adds no protection to coins you hold in your own wallet.
What This Means Before You Move Your Coins
Decide your split first: what you spend or trade in a typical month stays hot, and the rest goes cold. Then set up the cold wallet and write the seed phrase on paper or metal, never on a phone. Before sending real money, restore the wallet from the written phrase on a second device or after a reset, and check that the same receiving address appears. Send a small amount first, confirm it arrives, then move the balance. Log each transfer, since basis has followed each wallet from 1 January 2025. Our wallet roundup compares specific products, and the cold storage entry covers the term itself.
Which Setup Suits Which Kind of Holder?
For many holders the hot wallet vs cold wallet question ends in using both. An exchange account suits someone holding small sums who trades often and accepts that the platform holds the keys. A hot wallet suits anyone using on-chain apps with a balance they could lose without real harm. A hardware wallet suits savings you plan to hold for years. A split backup suits larger holdings or a household where more than one person must be able to recover funds.
What this comparison cannot tell you is how reliable you are with a piece of paper over ten years. A cold wallet moves the risk from strangers on the internet to your own habits, and only you know which of the two is the safer bet.
Frequently asked questions
What happens if my hardware wallet breaks or is stolen?
The coins stay on the blockchain, and the seed phrase can rebuild the wallet on a new compatible device, because the BIP-39 standard generates every key from those words. The urgent step after a theft is moving funds to a new wallet with a fresh phrase, in case the old phrase was ever exposed.
Is a 24-word seed phrase safer than a 12-word one?
In theory yes, since the BIP-39 standard gives 24 words 256 bits of entropy against 128 bits for 12 words. In practice both are far beyond guessing, so the extra words add little protection. The real difference comes from how the phrase is stored. A 24-word phrase written on paper in a drawer is weaker than a 12-word phrase kept in a fireproof safe.
Can a crypto payment sent to a scammer be reversed?
Usually not. FTC guidance dated 5 June 2025 says cryptocurrency payments typically are not reversible and do not come with legal protections. A cold wallet cannot help here, because the payment is one you approved. Report the theft to the FBI's IC3 and to the exchange that received the funds.
Can I keep my seed phrase in a password manager or a photo?
Ethereum.org's wallet guide advises against storing it on a computer and recommends writing it down. A password manager or cloud photo puts the phrase back online, which undoes most of what a cold wallet offers. Paper or a stamped metal plate stored somewhere secure keeps the phrase offline, and a second copy in another location protects against fire or flood.
Do I need a separate cold wallet for each cryptocurrency?
Usually not. A single seed phrase can generate keys for many coins, because the BIP-39 standard defines how a phrase becomes a seed that wallets derive keys from. Whether a given device supports a specific coin depends on its software, so check the maker's list of supported assets before moving anything onto it.
