// learn · season 02 · episode 06
Hot & cold wallets
In episode 5 you explored backup materials. Using a key also needs a signing workflow. The key can stay offline while transaction data moves between devices. Where signing happens changes the exposure. Everything below runs in your browser.
01 · the spectrum
One dial, two consequences
“Hot” and “cold” aren't two boxes — they're the ends of a slider between convenience and exposure. Drag it and watch who joins the list of people who could take your money.
convenience
phone · browser · hot
who can take it
- — malware on your device, including clipboard swaps that replace the address you pasted
- — malicious dApp approvals you sign in a hurry
- — phishing sites wearing a familiar logo
- — anyone who can unlock your phone
what it's for
Daily spending. Keep the amount at 'lost wallet on the bus' size — annoying, not ruinous.
Notice there's only one dial. Every step toward convenience hands a key to someone else — a company, a phone, a browser tab. And notice no tier reads “no risk”: you're not removing risk, you're choosing which risk you'd rather manage.
02 · how hot wallets actually die
An approval can expose assets without exposing the key.
An unsafe approval can expose assets even without anyone stealing the private key. Inspect this simulated request, then find out what the approval would permit.
your hot wallet · a website is requesting a signature
🎁 Mint your free NFT
cost: 0 ETHbored-apes-airdrop.xyz wants you to confirm this transaction. Network fee only.
03 · the air gap
Signing without ever going online
Here's the trick that makes cold storage usable: you don't bring the key to the internet — you bring the paperwork to the key. Drive all five steps yourself. The signature produced below is a real one, and the last step verifies it locally. Both panels share this connected browser: the air gap is simulated, not physical.
Educational simulation: both devices below run in this connected browser. The signature is real, but the air gap and payment are simulated. Do not use real wallet keys.
online machine
internet ✓knows: your address only
…
idle — nothing to send yet
offline signer
internet ✗holds: the private key
…
waiting — simulated offline signer
physical air-gap model — key seconds online
0
a hot wallet — private key seconds online
always
04 · in practice
Your mix
Different uses call for different access patterns. Separating everyday activity from long-term holdings changes the exposure.
pocket · hot
What you spend and experiment with. Sized so that losing all of it ruins a day, not a decade.
savings · cold
The bulk, behind the ceremony you just performed. Touched rarely, deliberately, and never in a hurry.
the catch
Storage only you can reach is a single point of failure wearing a safety costume. A fire, a hospital bed, a forgotten location — and it's gone for everyone who comes after you.
Cold storage reduces online exposure, but theft, unsafe approvals, damaged backups, and loss remain possible. A threshold policy can reduce dependence on any one key, provided recovery and approval procedures are designed carefully. That's episode 7.
next up
Episode 07 — Multisig: many keys, one vault play now →Bitcoin multisig and Gnosis Safe: build a 2-of-3 vault, lose a key on purpose, and watch the money stay exactly where it is.