Hot Wallet vs. Cold Wallet vs. Leaving It on an Exchange

There's no single safest place to keep crypto. Each option trades one risk for another. Leaving it on an exchange means trusting the company but never losing a seed phrase. A hot wallet (an app on your phone or computer) gives you the keys, but the keys live on an internet-connected device. A cold wallet keeps the keys offline, which shuts out most remote attacks but makes you fully responsible for backups. Many people end up splitting their holdings: a trading balance on an exchange, spending money in a hot wallet, and long-term holdings in cold storage.

The three options at a glance

Leaving it on an exchange

When you buy on an exchange, it holds the private keys and your account shows a balance it owes you. That's custodial storage.

What you get

• No seed phrase to lose. Forget your password and you go through account recovery, not a lost fortune.
• Instant selling and trading. No transfer delays or network fees to get back to an exchange.
• Cleaner tax records. Starting with crypto bought after 2025, US brokers must report your cost basis on Form 1099-DA, but only if the coins stay in that account until you sell. Moving them out breaks that chain.
• Account-level security tools. Kraken, for example, offers passkey 2FA, a Master Key and a Global Settings Lock that freezes withdrawal addresses for a waiting period you choose.

What you risk

• Counterparty risk. If the company fails, mismanages funds or is hacked, getting your crypto back depends on how that plays out. A crypto balance at an exchange isn't a bank deposit.
• Freezes and restrictions. Exchanges can pause withdrawals, close accounts or limit service by state.
• Account takeover. A phished password plus weak 2FA can empty an account.

Proof-of-reserves reports help you judge an exchange. Kraken publishes periodic reviews by an independent accountant; its June 30, 2026 snapshot showed BTC reserves at 102.9% of client balances. Kraken also notes the method can't prove the absence of hidden encumbrances or borrowed funds. It's useful evidence, not a guarantee. Our safest exchanges guide and exchange protection explainer go further.

Hot wallets

A hot wallet is software that holds your keys on a phone, computer or browser. You control the keys, so no company can freeze your coins. But the device is online, which is where the risk comes from.

Kraken Wallet is one example: a free self-custody app for iOS and Android that supports Bitcoin, Ethereum, Solana and several other networks. Kraken's page tells users to write down the recovery phrase and store it somewhere secure. It also offers an "embedded" wallet option that uses an email or social login with no seed phrase. Its page doesn't explain who holds those keys, so read the setup screens carefully if that matters to you.

Where hot wallets go wrong

• Malicious approvals. Connecting to a fake site and signing a transaction you don't understand is how most hot-wallet thefts happen. Kraken's security guide warns against connecting a wallet or approving a transaction on a site you reached through someone else's link.
• Fake wallet apps and extensions. Download wallets only from the provider's official site or app store listing, and check browser extension permissions.
• Malware. Clipboard hijackers swap addresses you paste. Infostealers grab recovery phrases saved in notes or screenshots.
• Recovery phrase in the cloud. A phrase stored in email, cloud notes or a photo is only as safe as that account.

Cold wallets

A cold wallet keeps your private keys off internet-connected devices. Usually that's a dedicated hardware wallet that signs transactions internally, so the keys never touch your computer. You approve each transaction on the device's own screen.

What you get

• Protection from remote attacks. Malware on your laptop can't sign a transaction without the physical device and your confirmation.
• No company in the middle. Exchange failures and freezes don't touch coins in your own cold storage.

What you take on

• The recovery phrase is everything. Lose it and the device, and the coins are gone. Expose it and anyone can take them. No help desk can reverse either.
• Buying safely. Buy hardware directly from the manufacturer or an authorized seller, and never use a device that arrives with a recovery phrase already filled in.
• Friction. Selling means connecting the device, signing a transfer to an exchange, and waiting for it to arrive.
• Inheritance. If nobody else knows the setup exists or how to reach it, your heirs may not be able to recover it.

Moving between them: costs and records

Transfers aren't free. Exchanges charge a flat withdrawal fee per asset. Kraken shows its fee and minimum at confirmation and lists them by currency in its support center. Deposits back to Kraken are mostly free, but a deposit that comes in below the minimum after network fees fails and the funds are lost. Our withdrawal fees comparison lists typical costs across exchanges.

On the tax side, the IRS says moving crypto between wallets or accounts you control generally isn't taxable, except for any crypto you spend on transaction fees, which counts as a disposition. Basis is also tracked per wallet or account, and coins you move back to an exchange become noncovered there, so the exchange won't report what you paid. Keep a log of every transfer.

A sensible way to split it

There's no correct ratio, but a lot of people use something like this:

Recovery phrase storage, done properly

If you go self-custody, your recovery phrase deserves more thought than the wallet itself.

• Write it down offline. Paper or a metal backup plate, never a screenshot, cloud note, email or password manager synced to the cloud.
• Never type it into a website. No legitimate wallet support team, exchange or airdrop needs it. Anyone asking is trying to steal from you.
• Store it where fire, water and curious visitors won't reach it. Some people keep two copies in separate secure places.
• Do a restore test. Before you fund the wallet heavily, confirm the phrase actually restores it.
• Leave instructions for someone you trust about where to find it, without writing the phrase itself into a will or email.

How to decide

• Small amount, just starting: keeping it on a well-secured exchange is reasonable while you learn.
• You trade weekly: keep the trading balance on the exchange and move the rest out.
• You use DeFi or apps: a hot wallet with only what you need, never your savings.
• Holding long term and comfortable with backups: a cold wallet, with the recovery phrase stored offline in a place you'd find in an emergency.
• Not sure you'd keep a recovery phrase safe for ten years: be honest about it. For some people, a strong exchange setup is the lower-risk choice.

Whatever you choose, the biggest wins are the same: phishing-resistant 2FA, never typing a recovery phrase into a website, and testing every new setup with a small amount first.

Get started on Kraken