Hot storage is any wallet whose private keys live on a network-connected device — phone, laptop, browser extension, self-custodial exchange app. Cold storage is any wallet whose keys live only on a device that has never touched the network in a way that can exfiltrate them, typically a dedicated hardware wallet kept disconnected when not signing. The attack surfaces differ structurally: hot wallets are continuously exposed to remote attackers; cold wallets are exposed only at narrow moments (setup, signing, recovery). The pattern validated across practitioners is the tiered-wallet approach — a hot wallet for transactions and small balances, a cold wallet for near-term reserves, and often a deep-cold setup (multisig with geographic distribution) for long-term savings. The failure modes at the extremes are putting all funds in a hot wallet (continuous remote-attack exposure) or in a maximum-security setup so cumbersome the funds become operationally dead. The hot/cold distinction and the tiered-wallet pattern organize most operational decisions downstream.
Why this note matters
This is the first storage-and-keys foundational note for the Practical self-custody and sovereignty section. The hot/cold distinction is the dimension along which the Self-custody configuration ladder organizes its rungs and the operational notes structure their guidance.
The note matters because:
- It corrects the “one wallet for everything” pattern that is the most common newcomer setup. Holders who default to a single wallet for all amounts and use cases inevitably either over-secure transactional funds (making routine spending painful) or under-secure savings (exposing long-term wealth to short-term operational risk).
- It establishes the portfolio framing. Most experienced holders do not run one configuration — they run a portfolio of configurations matched to use. The tiered-wallet pattern from Jameson Lopp’s framework is the most-cited version.
- It anchors the air-gap discussion that recurs across hardware-wallet, multisig, and operational-security notes. Cold storage is on a spectrum of air-gap rigor; understanding the spectrum is prerequisite to evaluating specific products and configurations.
What this is
Hot storage
A wallet whose private keys exist on a device with network connectivity that can be used to exfiltrate the keys. Examples:
- A mobile wallet app (BlueWallet, Muun, Phoenix, Wallet of Satoshi-with-self-custody)
- A desktop wallet (Sparrow, Electrum on a regular laptop)
- A browser-extension wallet (less common for Bitcoin than for other chains)
- An exchange account with self-managed keys (some structured products are technically self-custodial but the host environment is online)
The keys may be encrypted at rest, protected by biometric authentication, or stored in a secure enclave — but the device they live on is connected to the internet, runs a general-purpose operating system, and is exposed to whatever attack surface that implies.
Cold storage
A wallet whose private keys exist on a device that does not have, or has had only narrowly-controlled, network connectivity. The strongest form is air-gapped — the device has never connected to the network at all, signs transactions via QR codes or microSD card transfer, and is physically separated from anything that could relay information out.
Hardware wallets occupy a spectrum within cold storage:
- Strictly air-gapped — Foundation Passport, Coldcard in air-gap mode, others: no USB, no Bluetooth, no NFC for signing. Transactions transferred via QR codes or microSD. The device never speaks to a network-connected machine in a bidirectional way.
- USB-connected but functionally cold — BitBox02, Trezor, Ledger: the device is plugged into a computer to sign but the private keys never leave the device. The boundary is the firmware’s cryptographic discipline rather than physical separation.
- NFC or Bluetooth signing — Bitkey, some Trezor and Ledger configurations: the device communicates with the holder’s phone via short-range wireless. The boundary is again the firmware’s discipline.
The strictly-air-gapped form is the strongest form of cold storage. The USB-connected form is the common form. Both are meaningfully different from hot storage; both rely on the device’s firmware doing its job.
The “warm” middle
Some setups blur the line. A “watch-only” wallet on a phone — one that holds extended public keys but no private keys — is functionally hot (it knows your addresses and history) but the private keys remain cold. A hardware wallet that has been seeded by an internet-connected machine (some vendors’ setup flows require this) is technically cold during signing but had an exposure window during setup.
The right framing is that hot/cold is a spectrum of attack surface, not a binary. The question is: at what moments can an attacker compromise this wallet, and what does compromise look like?
When to use which
Hot wallets
- Transactional spending — small daily amounts, Lightning channels, routine payments
- Small “test” balances on new setups before funding the cold storage
- Receiving payments where the destination doesn’t yet need to be cold
- Lightning Network operation generally (a Lightning node requires hot keys to route)
Cold wallets (single-sig hardware)
- Near-term reserves — funds not actively spent but not deep-savings either
- The bridge between hot wallets and deep-cold storage
- Holders at Tier 1 (50K) for the majority of their stack
- Most holders’ primary configuration
Deep cold storage (multisig with geographic distribution)
- Long-term savings — funds not expected to be touched for years
- Tier 2 and Tier 3 holders’ core stack
- Funds where the holder accepts higher operational friction in exchange for higher security
The synthesis is direct: most holders should run multiple wallets at different temperature levels rather than choosing one configuration for everything.
How the tiered-wallet pattern works
Jameson Lopp’s widely-cited three-wallet framework, adopted across Casa, Theya, and multiple other services:
Hot wallet
A mobile wallet with a small amount sufficient for routine transactions. The holder treats funds in this wallet as fundamentally at risk — any compromise (lost phone, malicious app, phishing signature) loses the balance. Because the balance is bounded, the loss is survivable.
Common products: BlueWallet, Muun, Phoenix, Wallet of Satoshi (custodial-but-Lightning) for users accepting the trade. Even custodial Lightning wallets can be reasonable for very small balances where the convenience-vs-risk trade is genuinely tilted toward convenience.
Cold wallet (single-sig hardware)
A single hardware wallet — Coldcard, BitBox02, Trezor, Foundation Passport — holding a moderate balance. The holder treats the seed backup as the load-bearing artifact. Compromise of the device is uncomfortable but recoverable (sweep funds to a new wallet); compromise of the seed is catastrophic.
The wallet may be used for routine non-Lightning spending; it may also serve as the receive endpoint for income that will be periodically swept to deep cold storage.
Deep cold storage (multisig, ideally with geographic distribution)
The savings wallet. Touched rarely — perhaps annually for rebalancing or as needed for large outflows. The configuration is chosen for maximum security against both loss and exposure failure modes, accepting higher operational friction in exchange.
For Tier 2 holders, this is typically a 2-of-3 multisig (DIY or collaborative). For Tier 3 holders, this may be a 3-of-5 multisig with explicit jurisdictional distribution.
The flow
Income → hot wallet (immediate) → cold wallet (weekly/monthly sweep) → deep cold (periodic large sweeps when the cold balance exceeds the holder’s near-term needs).
Outflows reverse the flow: large outflow needs trigger a deep-cold spend; routine outflows draw from the cold wallet; small daily spending draws from the hot wallet.
This pattern matches security to purpose. The holder is not “afraid to touch” the deep-cold setup, because they have not co-mingled it with operational funds. The holder is not over-exposing operational funds, because the hot wallet holds only what is needed.
Tradeoffs and considerations
The tiered-wallet pattern is not free
Running three wallets requires three setups, three backup disciplines, three documentation entries. The holder who cannot sustain this should run one or two — but should think carefully about which one or two. A single hot wallet for everything is dangerous past trivial balances; a single deep-cold setup for everything makes the wallet operationally dead.
Air-gap rigor is overrated for most holders
The synthesis’s read on air-gap rigor: strictly-air-gapped signing (QR-only, no USB) is meaningfully more secure than USB-connected signing only against specific attack vectors — primarily, sophisticated firmware-exploitation attacks that can compromise a USB-connected device through a malicious host. For most holders, the firmware of major hardware wallets (Coldcard, BitBox02, Trezor, Foundation Passport, Blockstream Jade) does its job well enough that the strictly-air-gapped form is paranoia rather than necessity.
The strictly-air-gapped pattern is most justified at Tier 3 (very substantial holdings), at high-profile threat surfaces, and for holders who genuinely value the explicit physical isolation as a discipline. For Tier 1 and most Tier 2 holders, a well-managed USB-connected hardware wallet is structurally sufficient.
The “hot wallet on the phone” problem
The most common newcomer mistake is treating the mobile hot wallet as cold because “I never lose my phone.” Phones are continuously exposed to remote attackers, app-store malware, OS-level compromises, supply-chain attacks on installed software, and physical theft. The hot wallet on the phone is meaningfully more secure than an exchange account (the holder has the keys) but is fundamentally hot.
The right pattern: never hold meaningful amounts in a phone wallet. Use it as a spending wallet only.
Lightning’s structural hot-storage requirement
Lightning Network operation requires hot keys — the node must be able to sign transactions to route payments and to close channels under timing constraints. This is a structural constraint, not a configuration choice. Holders who want Lightning sovereignty (running their own node) accept some hot-storage risk for those funds.
The pattern: fund Lightning channels with amounts proportional to the security profile of the hot setup. A Tier 2 holder running a personal Lightning node should fund channels with amounts they accept as hot-wallet-exposed, not with the deep-cold stack.
The “warm” wallet trade
Some configurations sit between hot and cold. A hardware wallet that is plugged in and unlocked but with a screen-displayed transaction-confirmation step is functionally hot during that window. A multisig setup that requires only an unlocked device for one signature is partially hot.
The framing: identify the moments when the setup is exposed, evaluate what attacker capability is needed to exploit those moments, and decide whether the exposure window matches your threat model.
Comparison with alternatives
| Storage type | Attack surface | Typical use | Recovery effort | Tier fit |
|---|---|---|---|---|
| Custodial (exchange) | Custodian-level risk; account takeover | Active trading, fiat on/off-ramp | Account recovery via custodian | Tier 0 only |
| Hot wallet (phone) | Continuous remote attack | Daily spending, Lightning | Seed restore to new device | Tier 0–1 |
| Hot wallet (desktop) | Continuous remote attack, OS attack surface | Active Bitcoin user, multi-account management | Seed restore | Tier 0–1 |
| Single-sig hardware wallet (USB-connected) | Narrow exposure at signing time; supply chain | Near-term reserves; most holders’ core | Seed restore to new device | Tier 1–2 |
| Single-sig hardware wallet (air-gapped) | Narrowest exposure | Same as above, paranoid-disciplined holder | Same | Tier 1–3 |
| Single-sig + passphrase | Exposure only with both seed and passphrase | Deeper near-term reserves; threat-conscious | Seed restore + correct passphrase | Tier 1–2 |
| SLIP-39 split | Reconstruction-time exposure only | Long-term cold; geographic distribution preferred | Combine threshold of shares | Tier 2–3 |
| DIY 2-of-3 multisig | Two-key exposure | Long-term savings, sovereignty | Coordinated multi-key restore | Tier 2–3 |
| Collaborative 2-of-3 multisig | Two-key exposure; partner-knowledge exposure | Long-term savings, complexity-reduced | Coordinated with partner | Tier 2–3 |
| 3-of-5 multisig | Three-key exposure | Family-office, institutional, very large stacks | Coordinated three-key restore | Tier 3 |
| Lightning node | Continuous hot for funded channels | Sovereignty layer beyond keys; routing income | Channel close, state recovery | Tier 1–3 (orthogonal) |
The table is descriptive, not prescriptive. A given holder typically runs two or three of these in combination matched to use.
Tiered recommendations
Tier 0 (under $1K, casual use): Phone hot wallet is fine. The custodial-vs-self-custodial trade tilts toward whatever the holder will actually use — a custodial wallet they understand may be safer than a self-custodial wallet they do not.
Tier 1 (50K): Two-wallet setup. Phone hot wallet for daily spending (small amount); single-sig hardware wallet for everything else. The hardware wallet is the “cold” tier; deep-cold storage is not yet needed.
Tier 2 (1M+): Three-wallet setup. Phone hot wallet (transactional); single-sig hardware wallet (near-term reserves, weekly-to-monthly use); multisig deep-cold (savings, touched rarely). The multisig may be DIY 2-of-3 or collaborative 2-of-3 depending on the holder’s operational discipline and inheritance situation.
**Tier 3 (>X and a separate 3-of-5 multisig for $Y, with jurisdictional distribution. The hot wallet is funded with deliberately small amounts; the cold wallet handles operational needs; the deep-cold setups are the savings stack.
In all tiers, the principle is: the highest-friction setup holds the most value; the lowest-friction setup holds the least; and the holder is comfortable touching all of them when needed.
Common pitfalls
Treating the hot wallet as cold because “I never lose my phone.” Phones are continuously exposed. The hot wallet is hot regardless of how careful the holder is with the device.
Putting all funds in deep-cold storage and then being afraid to touch it. A wallet too high-friction to spend from has effectively become operationally dead. The holder either accepts the friction (and accepts that small needs cannot be served from this wallet) or restructures into a tiered setup.
Buying a hardware wallet and continuing to keep the seed in a digital file “for backup.” A digital backup of a cold-wallet seed makes the wallet hot through the backup. The cloud-synced photo of the seed is the most-cited single failure mode in the synthesis for this pattern.
Skipping the cold wallet and going directly hot → deep-cold. Without an intermediate tier, every routine spend touches the deep-cold setup, eroding its operational separation. The holder either over-spends from deep-cold (defeating the friction-as-security pattern) or under-spends Bitcoin generally.
Setting up cold storage from an already-compromised computer. The seed shown on the hardware wallet screen during initial setup is private; but if the holder transcribes it to a compromised computer, that compromises the seed. The setup-time exposure window is real even for nominally air-gapped devices.
Conflating air-gap rigor with security. Strictly-air-gapped QR-only signing is more secure than USB-connected signing against specific firmware-exploitation attacks. It is not categorically more secure. A poorly-managed air-gapped setup is less secure than a well-managed USB setup. The discipline matters more than the air gap.
Mixing temperature levels in one wallet. Funding a single hardware wallet with both spending money and savings money — and then treating the whole thing as “cold storage” — collapses the tiered pattern. The wallet is exposed at every spend; the savings portion inherits the spending portion’s exposure profile.
Tooling and resources
The synthesis document (canonical for the section):
- Bitcoin Self-Custody & Security: A Synthesis of Contemporary Best Practices, LegacyCipher discussion, April 2026 — the tiered-wallet pattern as the synthesis’s recommended portfolio.
Hot wallet options (as of 2026-05-14):
- BlueWallet — open-source, multi-platform, supports Lightning
- Muun — Bitcoin + Lightning, submarine-swap UX, non-custodial
- Phoenix — Lightning-first, automated channel management, ACINQ
- Sparrow Wallet (desktop) — full-featured, multisig-capable, watch-only modes
Cold wallet options (detailed in dedicated product notes):
- See Hardware wallets overview for the 2026 device table
- See Coldcard, BitBox, Trezor, Foundation Passport, Blockstream Jade, Bitkey, Ledger considerations and tradeoffs
Primary practitioner sources:
- Jameson Lopp — the three-wallet framework; ongoing essays. See Jameson Lopp.
- Casa — multi-key plan documentation; tiered-wallet design rationale.
- Unchained — operational-security guides; collaborative-custody-specific guidance.
As of 2026-05-14: the device landscape is fast-changing. Specific product recommendations should be verified against current firmware and feature listings before acting.
Open questions for further development
- How does the tiered-wallet pattern evolve as Bitcoin enters its medium-of-exchange phase? Active spending dramatically increases the operational-friction question; the hot/cold/deep-cold ratio that is right for a savings-dominant holder may need adjustment.
- Where does Lightning self-custody fit in the temperature spectrum? The structural-hot requirement is real, but emerging configurations (Liquid sidechain, Statechains, Ark) may shift the picture.
- What is the right framing for “warm” wallets — setups that are intentionally hot for short operational windows and otherwise cold? The synthesis collapses these into the hot category; a finer-grained framing may be worth developing.
- How does the tiered pattern integrate with Bitcoin-collateralized lending? Funds posted as collateral are functionally custodial during the loan term, which interacts with the framework in complex ways.
- Should the framework explicitly address watch-only wallets as a fourth tier? They are not custody (no signing capability) but they are operationally important (balance monitoring without exposing keys).
Related notes
The framing lenses:
- Loss vs exposure failure modes — the hot wallet trades loss for exposure; the deep-cold setup trades exposure for loss
- Threat modeling for self-custody — which temperature level is appropriate depends on the threat surface
- Self-custody configuration ladder — the rungs above this note operationalize the cold-storage end
Other storage and key concept notes:
- Seed phrases and BIP-39
- Passphrases and the 25th word
- BIP-85 child seeds
- SLIP-39 and Shamir Secret Sharing
- PSBT and wallet descriptors
Hardware wallets:
- Hardware wallets overview
- Coldcard, Trezor, BitBox, Ledger considerations and tradeoffs, Foundation Passport, Blockstream Jade, Bitkey
Configurations:
- Multisig setups — the deep-cold tier for most substantial holders
- Collaborative custody services — alternative deep-cold configuration
Operational practice:
- Backup strategies for seeds
- Recovery rehearsal practice
- Operational security practices
- Common attack vectors
The moral framing:
The principal practitioner:
The sub-MOC home: