Hot, warm and cold: structuring your wallets

Why one wallet stops scaling

Funds are rarely lost while they sit still. They are lost at the moment a key signs something it should not have: a drainer’s permit, a malicious approval, a transaction whose data was not what the screen said. So the useful question is not how safe your wallet is, but how much one bad signature could cost you.

With a single wallet the answer is everything. The key that holds your savings is the same key that connects to every new site you try, claims every airdrop and signs every message a website asks for. Each of those carries a small chance of a very large loss, and the chances add up with every site you visit.

A tiered setup gives each key a job and a limit. The keys that sign often hold little. The key that holds a lot almost never signs. A mistake in one tier costs that tier, not the whole portfolio.

The three tiers

Most experienced users settle on some version of the same three layers. The names vary; the logic does not.

The vault is defined by what it refuses to do. It does not connect to sites you are trying for the first time, it does not sign messages, and it holds no token approvals. Its whole signing history should be a short list of transfers to addresses you recognize.

The warm wallet is where your ongoing activity lives: a loan, a liquidity position, a stake. It talks to a handful of contracts you chose deliberately, and its approvals are reviewed on a schedule. The hot wallet is disposable by design. If a new site turns out to be a drainer, you lose a few hundred dollars and a wallet you were going to replace anyway.

An exchange account often sits beside these. Treat it as a doorway, not a tier: money passes through it on the way in and out, and does not live there. The beginner guides to self custody and hot and cold wallets cover the basic split; this is the version for when the numbers get bigger.

Separation that actually separates

Tiers only work if a compromise in one cannot reach the others. That comes down to three things.

Browser profiles are the cheapest upgrade on this list. A malicious extension, or a site asking your wallet to connect, can only reach the wallets installed in that profile. If the vault’s extension is never installed in the profile you browse with, there is nothing there to connect to.

A hardware wallet can also hold two tiers if you add a passphrase, which opens a separate set of accounts from the same recovery words. It separates the keys, but the device and the words are shared, so treat it as a convenience rather than full isolation, and read the passphrase guide before relying on one.

Proving ownership without signing from the vault

Airdrop checks, token gated sites and governance votes often want to see that you hold something, which tempts people to connect the vault. Delegation registries solve this on EVM chains. With delegate.xyz, for example, the vault records onchain that a hot wallet may act on its behalf for claims and access, and the delegate cannot touch anything held in the vault. Where a project supports it, one carefully checked transaction from the vault replaces a long series of risky connections.

A worked example layout

Numbers make the idea concrete. The figures below illustrate structure. They are not a recommendation about how much to hold or where.

Look at what grows and what does not. The hot wallet barely changes, because its job, trying new things, needs about the same few hundred dollars whatever your net worth. The warm wallet grows with how much you actively deploy, not with how much you own. Everything else belongs in the vault, so its share rises as the portfolio does.

That is the rule worth taking away: size the hot and warm tiers by the job, in dollars, and let the vault take the remainder. A fixed percentage does the opposite. Three percent of $500,000 is $15,000 sitting in the wallet most likely to sign something bad.

When a hardware wallet is enough, and when multisig is worth it

A single hardware wallet removes the most common way to lose a vault: a key sitting on an internet connected computer. What it leaves is one point of failure in the backup. One recovery phrase, found by the wrong person or lost in a flood, decides the outcome.

A multisig splits that authority. A two of three setup needs any two of three keys to move funds, so one stolen key does nothing and one lost key costs nothing. On EVM chains the common tool is Safe, a smart contract wallet. On Solana, Squads fills the same role, and Bitcoin supports multisig natively. The multisig guide covers thresholds and the extra backup most people forget.

Multisig does not replace reading what you sign. In February 2025, attackers took about $1.46 billion from Bybit’s multisig cold wallet by tampering with the web interface its signers used, so every signer approved the same altered transaction. Several keys protect you from one stolen key, not from every signer trusting the same compromised screen. The Bybit case study walks through it, and reading what you sign covers the habit that would have caught it.

Moving funds between tiers without mistakes

Most self inflicted losses happen in transit: a wrong address, a wrong network, a poisoned address copied from history. Moving between your own wallets deserves the same routine every time.

1. Take the receiving address from the source of truth

   For the vault, that is the hardware wallet itself. Ask it to display the receive address and compare it on the device screen, not only in the app. Save it once, labeled, in your wallet’s address book.

2. Never copy an address from your transaction history

   Address poisoning sends tiny transfers from lookalike addresses, so a fake that matches the first and last few characters of your real address appears in your history. Use the saved, labeled entry instead. See address poisoning.

3. Check the network on both ends

   The same address format does not mean the same chain. Confirm the receiving wallet supports that network, and for a contract wallet such as a Safe, that it has actually been deployed there. The guide to smart accounts explains why this matters.

4. Send a small test first

   Send a small amount, confirm it arrived on a block explorer, then send the rest. On a layer 2 or Solana the test costs cents. On Ethereum mainnet it costs a second fee, which is cheap insurance on a large move.

5. Verify on the device before you sign

   When the vault sends, read the destination and amount on the hardware wallet screen. If the device shows a hash or unreadable data for what should be a simple transfer, stop.

Labels, maps and the backup plan

Three wallets across three chains is already nine places money can be, and nobody remembers which is which a year later. Keep a written map: each wallet’s tier, its public address on each chain, which device and which backup it belongs to, and what it is for. Public addresses only. Never write keys or recovery phrases into that map.

Label addresses everywhere you can: in each wallet’s address book, and as private notes on the block explorer you use. A label turns a string of hex into "Vault, device A", which is what stops you sending to the wrong tier late at night.

The same map is the core of a plan for your family. The backup sheet helps you record where each backup lives, and recovery planning covers how someone else would find and use it.

Keeping each tier clean

• Vault: no messages, no approvals, no delegations. If a site wants the vault to sign in, approve a token or "upgrade" the account, move funds to the warm wallet first and do it there.
• Warm: review approvals on a schedule. Every few months, list and revoke what you no longer use. The token approvals guide shows how.
• Hot: sweep and rotate. Move anything worth keeping out of it promptly, and replace it with a fresh wallet now and then. A hot wallet with a long history of connections is a growing liability.
• Mind the links. Every transfer between tiers publicly ties those addresses together. That does not affect security, but it matters for privacy, which the guide to what your address says about you covers.
• If a tier is compromised, abandon it. Revoking approvals does not help once a key has leaked. Move whatever is left to a new wallet with a new seed phrase, and follow what to do after a drain.

Common questions

Where to go next