Cold storage, explained

Crypto can sit in three different places, and the difference between them comes down to one question: who holds the keys. Here is what each option is actually for, what you give up in each, and when a hardware wallet is worth buying.

The three places crypto lives

These are not competitors and there is no winner among them. They are different tools for different jobs.

On an exchange

The platform holds the keys. You hold an account balance, and the exchange moves coins on your instruction. This is what makes an exchange convenient: you can trade in seconds, recover a lost password through customer support, and never think about seed phrases. It suits active trading and the working balance you are actually trading with. The tradeoff is the custody mechanic described in the next section.

In a hot wallet

A hot wallet is self-custody software, the category that includes wallets like MetaMask and Exodus. You hold the keys, but they live on an internet-connected device: a phone, a laptop, a browser extension. That is what makes a hot wallet the right tool for actually using crypto, connecting to applications, swapping tokens, paying for things, moving day-to-day amounts. The tradeoff is that the keys sit on a machine that also opens email and runs software, which exposes them to malware, phishing, and anything that compromises the device.

In cold storage

Cold storage means the keys are held offline on a dedicated device that signs transactions without ever exposing the keys to your computer. It suits long-term holdings you are not moving often. The tradeoff is that it costs money, adds a little setup friction, and puts the recovery phrase entirely in your hands.

What it means when the exchange holds the keys

This is the part most people have never had explained, and it is mechanical rather than dramatic. When your crypto sits on an exchange, the exchange controls the keys to the coins. Your balance is a claim against that company, an entry in its records saying it owes you a certain amount, rather than coins you hold directly. In normal operation the distinction never comes up: you withdraw, the exchange sends, the system works exactly as advertised.

Where the distinction does matter is in what backs that claim. Dollars in an insured bank account are covered by federal deposit insurance, and securities at a failed brokerage are covered by SIPC. Crypto is covered by neither. The FDIC states plainly that deposit insurance does not apply to crypto assets and does not protect against the failure of a non-bank company, including exchanges and custodians. SIPC does not protect digital assets that are not securities. Many people assume a safety net is there because it is there for every other financial account they hold. For crypto on an exchange, it is not.

None of that makes exchanges unsafe or means you should not use one. It means the sensible rule is to match custody to use. Active trading on a reputable exchange is completely reasonable, and so is leaving there what you are actively trading with. Holdings you intend to keep for years are a different job, and that job belongs in cold storage. Most people end up doing both.

Moving coins from an exchange to a wallet you own is not a sale and does not create a tax event on its own, though the record of the move matters later. We cover that in crypto and tax, explained.

Self-custody has its own failure mode

Being honest about this cuts the other way too: lost seed phrases and forgotten passphrases have permanently destroyed more crypto than exchange failures have, and there is no support line that can recover them. If you take the keys, you take the responsibility for backing them up properly.

Buy from the manufacturer's store

If you do buy a hardware wallet, where you buy it matters more than most people expect. A hardware wallet is a security device, and a device that passed through unknown hands before reaching you cannot be assumed to be untouched. The specific risks are tampered hardware and, more commonly, a recovery card that arrives already filled in, which is not a backup but somebody else's keys. Ledger's own guidance is to buy from its store or a reseller it lists as authorized, and to treat marketplace listings on general retail sites as unverified. That means no Amazon, no eBay, no third-party marketplace seller, however convenient.

If a device has already arrived and you want to check it before trusting it with anything, the signs of a prepared device and the manufacturer's own verification steps are in counterfeit hardware wallets.

How to judge a hardware wallet

Every device in this category does the same core job, which is keeping keys off an internet-connected machine. What separates them is narrower than the marketing suggests, and it is worth knowing the criteria before any brand name enters the picture, because these are the questions that let you evaluate a device nobody recommended to you.

• How the keys are protected. Some devices hold keys in a certified secure element, the same class of tamper resistant chip used in passports and bank cards. Others use a general purpose chip and publish their hardware and firmware designs so the protection can be inspected rather than taken on trust. Both are defensible engineering positions, and which one reassures you is a real preference rather than a settled technical verdict.
• Whether the device can prove what it is running. A hardware wallet should be able to demonstrate that it is genuine, and it should tell you on its own screen when the firmware on it is not the manufacturer's. A device that cannot show you either thing is asking for trust it has not earned.
• What it holds. Some devices cover a broad range of chains and tokens, others concentrate on fewer. Check the specific assets you hold rather than the headline number, because coverage is uneven below the largest few chains.
• How you confirm a transaction. The screen is the security feature. You are checking an address and an amount on a display the malware on your computer cannot edit, so a bigger screen is not a luxury, it is more of the thing you bought the device for.
• Whether you can buy it direct. A manufacturer that sells to you from its own store removes the supply chain question entirely, which is the single largest risk in owning one of these.

Nothing on that list requires a brand name to apply. If a device you found yourself answers those five questions well, it is a reasonable device.

The device we point readers to

We name one rather than publish a lineup, because a lineup has to be maintained and a stale one misleads. Ledger is the device this desk currently points readers toward. It builds around a certified secure element, supports a broad range of chains and tokens, and pairs with a phone, and its premium model adds Bluetooth and a larger screen for checking transactions on the device itself. Its app carries a genuine check that challenges the device and verifies the answer against a key installed at the factory.

That is a recommendation, not a ranking, and it is worth being plain about what it is not. It is not a claim that nothing else is as good, and it is not the output of a comparison we ran this month. If a device you are considering answers the five questions above, buy that one instead. The criteria are the part of this page we would defend hardest.

Where to buy

We earn a commission if you buy through the links below. It costs you nothing extra and it does not change what we recommend. Separately, and for reasons that have nothing to do with us, the link goes to the manufacturer's own store, because that is where the supply chain is verifiable.

Sources

• FDIC, What the public needs to know about deposit insurance and crypto
• SIPC, What SIPC protects
• Ledger, Best practices to securely buy your Ledger device

This page is educational. It explains how custody works and is not advice about your particular holdings, nor a recommendation to buy or sell any asset.