Block data
- Crypto wallets do not store crypto assets themselves; they store the private keys, according to the SEC.
- A hot wallet is connected to the internet; a cold wallet is typically a physical device that is not.
- With self-custody, you have sole responsibility for the security of your private keys, the SEC says.
The word wallet suggests a place where money sits. In crypto it is closer to a keyring. The SEC’s investor bulletin on custody explains that crypto wallets do not store crypto assets themselves; they store the private keys, or passcodes, that let you control assets recorded on a blockchain. Choosing a wallet is really choosing where those keys live and who can use them.
Keys first
| Key | What it does | Comparison the SEC uses |
|---|---|---|
| Private key | Authorizes transactions; cannot be changed or replaced once created | Like a password |
| Public key | Lets others send you crypto and verifies transactions; cannot authorize spending | Like an e-mail address |
The SEC is direct about the stakes: if you lose your private key, you permanently lose access to the crypto in that wallet. Many wallets also create a seed phrase that can restore access; that is covered in Seed Phrases and Wallet Security: Protecting the Keys to Your Crypto.
Hot wallets
A hot wallet is a crypto wallet connected to the internet: a desktop, mobile or web application. The SEC says hot wallets give you a convenient way to access crypto for transactions, but they also expose your crypto to cyberthreats. Hot wallets may initially be free, though transactions typically involve fees.
Cold wallets
A cold wallet is typically a physical device that is not connected to the internet, such as a USB drive, an external hard drive or even a piece of paper, according to the SEC. Cold wallets are generally less convenient for transactions, but because they are offline they are generally more secure from cyberthreats. The trade-off is physical: devices can be lost, damaged or stolen. Hardware for cold storage usually costs money to buy.
Side by side
| Hot wallet | Cold wallet | |
|---|---|---|
| Connected to the internet | Yes | No |
| Convenience for frequent trades | Higher | Lower |
| Exposure to online attacks | Higher | Lower |
| Physical loss or damage risk | Lower | Higher |
| Typical upfront cost | Often free | Device purchase |
Self-custody or third-party custody
The second choice is who manages the keys. The SEC describes two models, and says hot and cold options exist under both.
Self-custody
You control your crypto and are solely responsible for the private keys. If your wallets are lost, stolen, damaged or hacked, the SEC warns, you may permanently lose access. Its questions before choosing self-custody: are you comfortable setting up and maintaining a wallet, which may take some technical skill; do you want sole responsibility; which wallet type suits your needs; and what will it cost.
Third-party custody
A professional custodian, including crypto exchanges and dedicated custody providers, holds and controls access to the keys. You avoid the burden of managing keys, but take on the custodian’s risks. The SEC suggests asking how the custodian stores and safeguards assets, whether it lends or commingles them, whether it carries insurance against loss or theft, and what happens if it fails. Those questions are in Choosing a Crypto Exchange: Questions to Ask Before You Deposit.
The SEC lists a few more questions for third-party custody. Which crypto assets does the custodian allow you to hold, since the choice varies between providers? What privacy protections does it offer for your name, address, Social Security number and holdings, and does it sell customer data? And what does it charge: annual asset-based fees, transaction fees, fees to transfer assets out, and fees to open and close an account. A custodian that cannot answer these clearly is telling you something.
Tip: One approach is to split holdings: a small amount in a hot wallet or on a platform for trading, the rest in cold storage they control. Whatever the split, write down which assets are where.
What no wallet protects against
- Sending to the wrong address. The FTC notes crypto payments typically are not reversible.
- Scams. A secure wallet does not help if you send crypto to a scammer; see Crypto Scams to Avoid: The Patterns Regulators See Most.
- Platform failure, if you choose third-party custody. The FTC says the government has no obligation to step in if a wallet provider goes out of business or is hacked.
Moving between wallets and taxes
Moving crypto from one wallet or account you own to another you own is not a digital asset transaction for tax purposes, according to the IRS, unless you pay the transaction fee with digital assets. Keep records of transfers anyway, since you will need to show that the receiving wallet is yours and track basis across accounts. See Crypto Taxes in the US: What Is Taxable and How Much.
Whichever wallet you choose, the SEC’s closing advice applies: keep your crypto holdings private, use strong passwords and turn on multi-factor authentication for every online crypto account. It also tells investors to watch out for crypto asset phishing scams, which try to trick you into handing over exactly the keys and passwords a wallet is meant to protect.