One crypto wallet drained every 3 minutes 20 seconds: that is the pace of 2025 once you divide the 525,600 minutes in a year by the 158,000 personal wallet hacks recorded by Chainalysis, for an average haul of $4,513 ($713 million Ă· 158,000) (Âč). A chilling figure. Picture it: you open your app one morning, and the balance reads zero. No bank to call. One distinction weighs heavily in this picture: hot wallet or cold wallet. Behind these two terms lies a single question. Where does your private key sleep? Permanently plugged into the Internet, or kept away from the network? Here is what separates these two families, where they really fail, and the smart way to combine them.
Key takeaways
đ Index
- A hot wallet keeps your private key on a connected device.
- A cold wallet signs offline without ever exposing the key.
- Lose your recovery phrase, and your funds are gone for good.
- Cold storage protects the key, not the decision to sign.
- Keep daily spending hot, long-term savings cold.
Hot wallet and cold wallet, two safes for the same key
Let’s clear up a stubborn misconception first. Your crypto does not live inside your wallet. It stays recorded on the blockchain, readable by anyone. What the wallet guards is the private key: a gigantic secret number that signs your transactions. The mechanism relies on public-key cryptography: a public key acts as your address, a private key proves ownership. Whoever holds the key holds the funds. Full stop.
In practice, most wallets derive this key from a recovery phrase of 12 to 24 words, drawn at random and arranged in a precise order. That phrase restores the wallet on any compatible device. So it is worth exactly as much as your holdings.
“Not your keys, not your coins.” A maxim popularised by Andreas Antonopoulos, author of Mastering Bitcoin.
The hot wallet, a wallet wired to the network
A “hot” wallet stores its key on a device connected to the Internet. Mobile apps, browser extensions such as MetaMask, desktop software: they all fall into this category. So does your exchange account, with one major nuance. There, you no longer hold the key at all. The platform does, hence the name custodial wallet.
Its strength? Speed. You pay, swap or interact with a decentralised app in seconds. Its Achilles’ heel stems from the very same trait: any malware installed on the device sits within arm’s reach of the key. Keeping your crypto in a hot wallet is a bit like leaving the keys in the ignition. Handy when you need to drive off. Tempting for anyone walking by.
The cold wallet, a key kept offline
A “cold” wallet generates and stores the private key on a medium never exposed to the network. The most common form? The hardware wallet, a USB-stick-sized device such as a Ledger or a Trezor. The Trezor Model One, launched in 2014, is widely seen as the pioneer of the category. The paper wallet, a simple printout of the phrase or the key, belongs to this family too.
So how do you spend without going online? Through an elegant trick. Your computer prepares the transaction, then passes it to the device. The device signs it internally and sends back only the signature. The key itself never leaves the chip. Yes, you plug the device in. Your secret, though, stays inside its fortress.
What are the differences between a hot wallet and a cold wallet?
The two tools do not compete on every front. They serve different purposes, like a pocket wallet and a bank vault. The table below lines up their concrete differences.
| Criterion | Hot wallet | Cold wallet |
|---|---|---|
| Internet connection | Permanent or frequent | Key never exposed to the network |
| Where the key is stored | Phone, computer, browser or an exchange’s servers | Chip of a dedicated device, paper or offline medium |
| Examples | MetaMask, mobile apps, exchange accounts | Ledger, Trezor, paper wallet |
| Cost | Usually free | Purchase of a device |
| Speed of use | Instant | Slower: device to plug in, physical confirmation |
| Main threats | Malware, fake websites, exchange hacks | Lost recovery phrase, rigged signature, physical coercion |
| Best for | Everyday spending, trading, decentralised apps | Long-term savings, large amounts |
One criterion deserves a closer look: the attack surface. A hot wallet inherits the weaknesses of everything around it, from the operating system to the browser, not forgetting every installed extension. A cold wallet shrinks that perimeter down to a single object. Fewer doors, fewer break-ins.
So cold wins by knockout? Not so fast. The numbers tell a more nuanced story.
158,000 hacks in 2025: what the numbers give away
Chainalysis, the benchmark in blockchain analytics, has been tracking thefts from personal wallets for years. The trend jumps out: attacks are multiplying, but each victim loses less.
| Indicator | 2022 | 2024 | 2025 |
|---|---|---|---|
| Personal wallet incidents | 54,000 | Not disclosed | 158,000 |
| Unique victims | 40,000 | Not disclosed | At least 80,000 |
| Share of total value stolen | 7.3% | 44% | 20% |
| Amount stolen from individuals | Not disclosed | $1.5 billion | $713 million |
Now look closely at the ratio between incidents and victims. It climbs from 1.35 in 2022 to 1.98 in 2025 (ÂČ). In plain terms: attackers hit the same targets more often, or drain a single wallet several times over. Each 2025 victim lost $8,913 on average. Their weapons? Social engineering, deepfake videos, one-click malware. Not to mention phishing, the undisputed king of the genre: fake tech support, fake updates, fake recovery websites.
These techniques thrive on very specific ground. A connected device, a key within reach of software, a user in a hurry. The textbook profile of a hot wallet⊠with one exception.
Bybit, the record heist that targeted a cold safe
21 February 2025. The Bybit exchange starts a routine transfer from its multi-signature Ethereum cold wallet to its hot wallet. The signers approve. Except the Safe{Wallet} interface on their screens had been rigged, through the compromised computer of a Safe developer. The result: more than 401,000 ETH gone, or $1.5 billion according to Chainalysis, which attributes the operation to North Korean hackers. That single theft weighs 2.1 times the total stolen from all individuals in 2025, and 44% of the $3.4 billion stolen that year (Âł).
The real weak spot of both wallets
Compare the Bybit heist with thefts from individuals: in neither case was a key cracked by computation. Each time, attackers deceived a human or infected their machine. Cold storage locks the key, not the judgement of whoever signs. Another finding: the more value a safe concentrates, the more it justifies a tailor-made attack. A single cold wallet yielded more than 158,000 hacks of individuals combined.
Cold storage beats the hacker, not your own slip-ups
A cold wallet shifts the risk more than it erases it. The digital danger recedes. Two others step forward: loss and physical coercion.
Lose the phrase, lose everything
Without a recovery phrase, a broken or stolen device becomes a permanent dead end. No customer service can reset a private key. In 2020, Chainalysis classified 3.7 million bitcoins as lost, untouched for at least five years, which amounts to 17.6% of the 21 million that will ever exist (3.7 Ă· 21) (âŽ). More than one bitcoin in six, frozen forever. A harsh reminder: sometimes the toughest enemy is forgetfulness.
The backup that cancels everything
The classic mistake is photographing your recovery phrase, or typing it into a note synced to the cloud. The cause? A habit inherited from passwords, which we back up everywhere because they can always be reset. Except here, that digital copy brings the key back onto a connected device. You bought a cold wallet⊠and unknowingly rebuilt a hot wallet, without even the protection of the device.
When the burglar goes after the owner
Industry jargon calls them “wrench attacks”. The principle is chilling: physically forcing the holder to transfer their funds. According to security firm CertiK, 72 verified cases took place in 2025, up 75% year on year. France alone accounts for 19, far ahead of the United States with 8 cases. More than one attack in four worldwide therefore happened on French soil (â”). In January 2025, the kidnapping of David Balland, co-founder of Ledger, made headlines.
Does an offline device protect you from a weapon? Obviously not. The logic is relentless: the stronger the digital lock, the more the criminal targets the person. Chainalysis stresses discretion, which matters as much as technology. Never show off your holdings in public.
Splitting your crypto between hot and cold, a practical guide
The right strategy does not pick a side. It makes both work together. Exchanges have applied this principle for years: back in 2018, Coinbase stated it kept 98% or more of customer assets in cold storage (â¶). Bybit likewise topped up its hot wallet from its cold safe. Why not copy that model at home? Nothing simpler.
- Estimate how much you actually trade or spend in a month.
- Keep that amount in a hot wallet, and move the rest to cold storage.
- Buy your hardware wallet from the manufacturer or an official reseller, never second-hand.
- Write the recovery phrase by hand, on paper or metal, and store it away from the device.
- Before each signature, check the address shown on the device screen, not on the computer.
That last step looks trivial. Yet it could have changed the outcome of many thefts. A device screen does not lie as easily as a web page.
The test that prevents nasty surprises
Before moving the bulk of your funds, send a small test amount to your cold wallet first. Then reset the device and restore it with your recovery phrase. If the same address and balance reappear, your backup works. If it fails, you only lose the test amount, and you discover the problem before it gets expensive.
Your questions about hot and cold wallets
Can a cold wallet be hacked?
Extracting the key from a serious device remains extremely difficult. The danger lies elsewhere: in signing a rigged transaction, as at Bybit, or in a leaked recovery phrase. Cold storage sharply reduces the risk. It does not eliminate it.
My exchange account, hot or cold?
From your standpoint, it is a custodial wallet: the platform holds the keys, and splits the funds between hot and cold storage itself. You therefore depend on its robustness. Before opening an account, check that the provider is authorised by your national regulator; in France, the AMF publishes white lists of approved crypto-asset service providers.
What if you lose your device?
No need to panic, on one condition. Your recovery phrase restores the entire wallet on a new compatible device. Without it, however, the funds stay out of reach. For good.
Do you need a cold wallet for small amounts?
There is no official threshold. A simple benchmark: once the amount you hold exceeds what you would accept losing with a stolen phone, moving to cold storage makes sense. The price of the device then becomes a reasonable insurance policy.
Sources and statistics
(1) Chainalysis, crypto theft report published in December 2025: 158,000 incidents targeting personal wallets in 2025, with $713 million stolen. Calculation: 525,600 minutes per year Ă· 158,000 incidents â 3.33 minutes, i.e. 3 minutes 20 seconds; 713,000,000 Ă· 158,000 â $4,513 per incident.
(2) Same Chainalysis report: 54,000 incidents for 40,000 victims in 2022, 158,000 incidents for at least 80,000 victims in 2025. Calculation: 54,000 Ă· 40,000 = 1.35 incidents per victim, then 158,000 Ă· 80,000 â 1.98. Average loss per victim in 2025: 713,000,000 Ă· 80,000 â $8,913.
(3) Chainalysis puts the Bybit theft at $1.5 billion out of a total of $3.4 billion stolen in 2025; technical analyses published after the attack, including NCC Group’s, detail the 401,347 ETH drained from the cold wallet. Calculation: 1.5 Ă· 0.713 â 2.1 times the losses of all individuals; 1.5 Ă· 3.4 â 44% of the annual total.
(4) Chainalysis study, June 2020: 3.7 million BTC unmoved for at least five years, classified as lost. Calculation: 3.7 Ă· 21 million (the Bitcoin protocol cap) â 17.6%, i.e. more than one bitcoin in six.
(5) CertiK report on 2025 physical attacks, reported by Decrypt: 72 verified cases worldwide, including 19 in France and 8 in the United States. Calculation: 19 Ă· 72 â 26.4%, i.e. more than one attack in four.
(6) Coinbase statement on its blog in December 2018, reported by the specialist press: 98% or more of customer assets held in cold storage. Application: for a $10,000 portfolio, this ratio would leave about $200 in a hot wallet.
