Glossary / Wallets & custody
Hot wallet
- Definition
- A hot wallet keeps its private keys on a device that is connected to the internet, so it can sign a payment in seconds and can be robbed by software.
Speed is the feature and exposure is the price. Keys sit in the memory of a machine that also runs a browser, so anything able to execute code there can reach them. The Justice Department put the 2016 Bitfinex theft at 119,754 bitcoin, and the same arithmetic applies at household scale, where the attacker is a clipboard hijacker rather than a state.
How it works
A hot wallet stores key material encrypted on disk and decrypts it into memory whenever you unlock the app to sign. Mobile operating systems help: iOS and Android both provide hardware-backed keystores, app sandboxing, and full-disk encryption, and a well-built wallet uses all three. None of that survives a device where the attacker already runs code with your privileges.
The distinguishing property is not the app, it is the signing environment. A key that has been decrypted on a general-purpose computer is exposed to every process, browser extension and malicious update that machine will ever run, whether or not anything has gone wrong yet. Hot is a statement about the attack surface at the moment of signing.
Some designs have no choice. A Lightning node must respond to channel updates while you sleep, so its channel keys are online by definition, and the protocol compensates with penalty transactions and watchtowers rather than by taking the key offline. Custodial apps solve it the other way, by making the exposure someone else's problem.
Four routes account for most real losses, and none of them is exotic. Infostealer malware sweeps wallet files and browser data. Clipboard hijackers swap a pasted address for the attacker's at the moment you paste it. Fake support agents and lookalike sites talk people into typing a recovery phrase into a web form. And a joint FBI, CISA and Treasury advisory in April 2022 described North Korean operators shipping trojanized cryptocurrency applications that behave normally and quietly exfiltrate keys.
Why this matters when you buy bitcoin
Every exchange you can buy from runs hot wallets, and that is how a withdrawal completes in minutes instead of on a schedule. Platforms usually keep the bulk of customer coins in deep storage and a working float online, which is why a large withdrawal can pause for a manual review while a small one clears immediately. When you read about an exchange being drained, the float is normally what went.
Your own split follows the same logic at a smaller scale. Keep in a hot wallet only what you would be annoyed to lose, not what you would be ruined to lose, and move the rest once it accumulates. The threshold is personal, but it is a number, and choosing it in advance is what stops a phone wallet from quietly becoming a life savings account.
Fees decide how often you move. A one input, two output native SegWit transaction is about 141 virtual bytes, so at a fee rate of 10 satoshis per virtual byte it costs roughly 1,410 satoshis to sweep a hot wallet into cold storage. That is negligible against a monthly transfer and absurd against a daily one, which is the practical case for letting a float build rather than sweeping every purchase.
Buying habits matter here too. If you run a recurring buy that withdraws automatically, the destination should be your cold wallet's address list rather than a phone wallet acting as a staging post, because a staging post is a hot balance that grows on a schedule you set and forget.
What belongs in a hot wallet
Work from what the wallet is for. A phone wallet is for paying: a bar tab, a friend, a Lightning invoice, the small everyday amounts where waiting on a hardware device is absurd. Sizing it like a physical wallet, roughly a month of the spending you actually do in bitcoin, is a rule that survives contact with reality.
Three habits carry most of the benefit. Give the hot wallet its own recovery phrase, never the one that protects your savings, so a compromised phone loses a float rather than everything. Install and update only from the vendor's own domain, since a search advertisement for a wallet name is a known distribution channel for clones. And verify the first and last characters of any address on the receiving device itself, because clipboard swaps only work when nobody looks twice.
If a hot balance ever grows past the threshold you set, treat that as the signal to move it, not as evidence the threshold was too conservative.
Hot wallet vs cold storage
Hot and cold describe where the key is at the moment it signs, not the brand of software. The same wallet application can be either: running on your daily laptop it is hot, and running on a machine that has never touched a network, passing unsigned transactions in and signed ones out by file, it is cold. The pairing is not a competition. Almost everyone should hold both, with the hot side sized for convenience and the cold side sized for consequences.