How cold wallets work: Offline crypto storage and its limits

In an explainer published Sept. 2, Engadget said cryptocurrency wallets do not actually store funds. Instead, they hold the cryptographic keys needed to prove ownership of balances recorded on blockchains such as Bitcoin or Ethereum. A hot wallet runs on internet-connected equipment, while a cold wallet remains offline to keep keys away from malware. That separation addresses a common concern among crypto users: exchanges have lost customer assets in security breaches, prompting many to adopt the principle “not your keys, not your coins.”

The report described paper wallets as the most basic cold wallet, a physical record of private keys often written as 12 or 24 words. Paper wallets still require an app or program to authorize transactions through signing. Modern hardware wallets use a different approach. They connect through USB, Bluetooth, or NFC to a companion app on a phone or computer, but signing happens only on the dedicated hardware device. The companion app can send transaction details such as the amount and destination, which appear on the wallet’s display for manual confirmation. If approved, the signed transaction is transmitted back to the app and broadcast to the blockchain.

According to Engadget, hardware wallets are engineered to make private keys difficult to extract. They use tamper-resistant chips, require a PIN to unlock, and can wipe their storage after several incorrect attempts. Because keys never leave the device, even a compromised phone or computer app cannot sign a transaction by itself. The report noted that smartphones have a similar secure element, such as Apple’s Secure Element, for sensitive data like biometrics and Apple Pay, but cold wallets keep keys entirely off the phone.

Yet cold wallets are not immune to attacks. Engadget pointed to a Coldcard exploit discovered in July 2026 that let attackers drain thousands of Bitcoin from unsuspecting users. The exploit traced to a software bug dating back to 2021 that caused some Coldcard devices to generate weak or predictable private keys instead of incorporating true randomness. The article said creating a unique set of keys is the first step in setting up any wallet, and randomness is what makes those keys hard to predict.