Cold wallets explained: an easy-to-follow breakdown of what cold wallets are actually doing, and why and how they provide increased security over hot wallets

You've probably heard that the point of a physical wallet is to have a place that knows your private keys that is never connected to the internet. This is (at least partially) correct, but it's a bit more complicated than that. Really, a hard wallet is an offline transaction signer. Let's go into a bit more detail.

​

With a software wallet that you have on your computer, since it knows your private key(s), it can be targeted by malware. There could even be a screen spy virus or a keylogger that records your wallet telling you the seed phrase that first time that you generate it. In general, since your computer has internet access, it is a target. Ideally, if you want to sleep like a baby at night, your keys/seed should never be known by any machine that is ever connected to the internet.

​

A hardware wallet is always offline. When you want to send crypto from your hardware wallet, you set the transaction up using a software on your PC (like Ledger Live), but you can't actually sign the transaction and send it on your PC, because that software doesn't know your key (that software might feel like a wallet, but it absolutely is not, because it is not in possession of you private key(s)). Instead, to actually send the transaction, you attach your hardware wallet to your PC with a USB, and you press a physical button on it to confirm you want it to sign the transaction. You might think that to do this, it must send your private key through the USB to the software on your PC, but it doesn't. It signs the transaction on the physical device itself, using the private key, then sends the signed transaction through the USB to the software, which then sends it off into the network. A signed transaction can been seen by all without danger; it's just the private key that does the signing that must stay private.

​

So, really a hardware wallet is just a transaction signer. It is an offline object that adds your private key signature to transactions when you tell it to, and then it sends those transactions through a USB. Your private keys and seed therefore never appear on your PC screen, are never typed by your PC keyboard, and are never known by any drive on your PC, or by any entity that has internet access.

​

If you decided to go the "paper wallet" route of literally just memorizing your keys, or writing them on paper, rather than having a hardware or software wallet, the problem is that to actually make an outbound transaction, you would have to use any one of a hundred different online tools or executable applications or whatever to actually type in your key or seed and the details of the transaction, because you can't interface directly between your brain and the blockchain. Now, you're back in the original situation of having an online machine see your private key (in reality, it's a bit more complex than this; there are workarounds that allow you to do this relatively safely, but I don't want to complicate this too much).

​

So, a hardware wallet is not only an offline place to store your keys/seed, it also does the signing for you, in a fully offline air-gapped way, which cuts out any middleman kind of application knowing your seed/keys, and therefore removes all vulnerabilities from the process.

​

I hope this helps some peoples' understand of hot and cold wallets!