What Is a Hot Wallet?

What counts as a hot wallet?

Any wallet where the keys touch the internet. Three common flavors, with meaningfully different risk profiles:

Each trades the same things in different proportions: convenience against control. With app wallets you control keys but defend your own device; with exchange wallets the exchange defends keys but you must defend your account and trust the company.

Where do hot wallets actually fail?

Almost never through cryptography — through people and devices. Malware that scans disks for saved seed phrases. Fake wallet apps in app stores. Clipboard-hijacking trojans that swap a copied address for the attacker’s in the half-second between copy and paste. Phishing sites that request a signature and drain whatever the wallet approved. None of these can touch a key that isn’t online, which is the whole argument for cold wallets: the hardware wallet exists precisely because the industry lost this fight on connected devices often enough to build a dedicated machine for it.

How should a beginner use one?

As a spending account, sized accordingly. A reasonable split for someone starting out: most of your holdings in exchange custody with strong 2FA while amounts are small — it’s the lowest-maintenance option and the only one with a support desk when something goes wrong — plus a self-custody hot wallet for learning how on-chain transactions and addresses really work with small, lose-able amounts.

Write your recovery phrase on paper the moment you create the wallet — hot wallets die with their devices, and app reinstalls without the phrase mean permanent loss. Then upgrade to a hardware wallet when the balance grows past what you could shrug off losing. Hot is where everyone starts; it just shouldn’t be where significant savings live.

Hot wallet hygiene: the six habits

Hot wallets can’t be made hack-proof, but they can be made target-resistant. The habits that separate users who keep their hot-wallet funds from users who donate them:

1. Dedicate the device where possible. A phone used for banking and crypto, without random app-store experiments, is a smaller attack surface than the family gaming phone.
2. Download wallets only from official sources — the project’s own site or the official store listing, verified. Fake wallet apps are still a working business model.
3. Zero screenshots of the phrase, ever. Including “temporary” ones. Phone screenshots sync somewhere by default.
4. Paste addresses from the send screen, then eyeball the first and last four characters. Clipboard hijackers replace addresses invisibly; humans catch the swap only by re-reading.
5. Test recoveries annually. Delete the app, restore from the phrase, confirm the balance. A backup you’ve never tested is a hypothesis.
6. Keep the balance boring. The hot wallet holds this week’s money. When it stops being boring, move the excess to cold storage — that transfer is the whole point of having both.