Bitcoin cold wallet: what it is and how to set one up

A bitcoin cold wallet keeps your private keys offline — on a hardware device, an air-gapped computer or, historically, on paper. Transactions are signed inside the device, so the key never touches your internet-connected phone or laptop, which makes remote theft far harder. Cold storage is for savings you don't spend every day; for small, frequent payments a hot wallet on your phone is more practical.

What is a cold wallet, and how is it different from a hot wallet?

Your bitcoin isn't stored "inside" a wallet. Coins live on the blockchain, assigned to addresses, and a wallet holds the keys that can spend them. Whoever controls the key controls the coins, so storage is really about where the key lives and who else can reach it.

• Hot wallet: an app on a phone or computer that's online. Convenient, but the key sits on a device that also runs a browser, email and dozens of other apps.
• Cold wallet: the key stays offline. Bitcoin.org's wallet security guide calls offline "cold storage" the highest level of security for savings and recommends keeping only small amounts on your computer or phone for everyday use.
• Exchange account: not your wallet at all. The exchange holds the keys and you hold an IOU in its database — we cover the risks in How to choose a crypto exchange.

Types of cold storage compared

Bitcoin.org describes multisig as protection against a single compromised device or location, since spending requires several independent approvals. For most individual holders, a sensible starting point is one hardware wallet with a solid backup of its recovery phrase.

The seed phrase is what you're really protecting

Almost every modern wallet derives keys using BIP-39. The device takes 128 to 256 bits of randomness and encodes it as 12 to 24 words from a 2,048-word list — each word carries 11 bits, and the last one includes a checksum. That phrase produces a master key, and every address in the wallet is derived from it.

Which leads to the rule that matters most: your money lives in the words, not in the device. If the device breaks or gets lost, you buy a new one (from any compatible vendor), enter the same words and regain the same coins. And if someone sees your 24 words, they don't need your device at all.

BIP-39 also allows an optional passphrase (often called the "25th word"). Each passphrase opens a separate wallet, and a typo simply opens a different, empty one. Trezor warns that passphrases cannot be changed, removed or recovered. It's strong protection against someone who finds your written words — and an extra way to lock yourself out.

How to set up a bitcoin cold wallet, step by step

1. Buy the device only from the manufacturer or an authorized reseller listed on its website — not secondhand and not from a random marketplace seller.
2. Inspect the box. There should be no pre-printed or pre-filled recovery words inside. If there are, it's a scam; don't use the device.
3. Download the companion app only from the official site, typing the address yourself. Fake "getting started" pages using well-known wallet brands do show up in search results.
4. Create a new wallet on the device itself. The phrase should appear on the wallet's screen, never on your computer. Set a PIN.
5. Write the words down by hand on paper or a metal plate. No photos, notes apps, cloud drives or password managers.
6. Test recovery. Many devices offer a quick word check; a stronger test is to wipe the device and restore it from your written words while it's still empty.
7. Send a small test amount first, confirm it arrives, then move the rest. Always verify the receiving address on the wallet's screen — clipboard malware can swap addresses.
8. Store the backup away from the device, and consider a second copy elsewhere; bitcoin.org recommends keeping backups in multiple physical locations.

Real example: what moving BTC to cold storage costs on October 22, 2026

The network itself charges very little on quiet days. As of 4:00 AM ET on October 22, 2026, CoinLab data showed bitcoin near $82,225, with a recommended fee of 2 sat/vB for the next block and 1 sat/vB for confirmation within an hour.

A typical SegWit transaction with one input and two outputs is about 141 vB. At 2 sat/vB that's roughly 282 sats in network fees — about $0.23 at that day's price, or around $0.12 at 1 sat/vB. For how these units work and why fees occasionally spike tenfold or more, see Bitcoin mempool fees explained.

Keep in mind that exchanges usually charge their own flat withdrawal fee, which doesn't track network conditions and can be much higher than the on-chain cost. Withdrawing less often in larger amounts is usually cheaper than moving every small purchase. Live price and market indicators are on the CoinLab dashboard and the bitcoin page.

What cold storage protects against — and what it doesn't

Cold storage shuts down the main theft route: remote access to your key. The scale of that problem is clear. Chainalysis (December 2025) counted 158,000 personal wallet compromises in 2025 affecting at least 80,000 unique victims, with $713 million stolen from individuals. The FBI's 2025 Internet Crime Report logged 181,565 crypto-related complaints and $11.366 billion in U.S. losses — much of it fraud in which victims sent funds to scammers themselves.

That last part is what a cold wallet won't fix: if you approve a transfer to a scammer or type your words into a fake site, no device can save you. Nor does it help if the device itself is counterfeit. In 2023, Kaspersky documented a fake Trezor Model T bought on a classifieds site: the microcontroller and firmware had been swapped, and instead of a random phrase it used one of 20 pre-generated ones, letting attackers drain it. In October 2026 the pattern returned at scale — Ledger confirmed an unauthorized hardware implant in a device sold through Southeast Asian reseller CryptoBilis, with third-party researchers estimating $86 million to $93 million stolen from more than 300 wallets. Details in our CryptoBilis report.

Common mistakes

• Photographing the seed phrase or saving it to the cloud. That turns your cold wallet back into a hot one.
• Buying secondhand or from unknown sellers. A tampered device looks normal from the outside, holographic seals included.
• Typing the phrase anywhere other than the device. No manufacturer, support agent or "wallet validation" service will ever ask for it. Our Qubic hack breakdown shows how a leaked phrase leads to theft.
• A single backup in a single place. One fire, flood or move and access is gone for good.
• A passphrase with no backup. A forgotten passphrase can't be recovered.
• No inheritance plan. If nobody else knows the wallet exists, your family can't access it.

FAQ

Do I need a cold wallet for a small amount of bitcoin? If losing it would hurt but not be critical, a phone wallet with a PIN and a written-down phrase may be enough. The larger the share of your savings, the more a dedicated device makes sense.

What happens if my wallet's manufacturer goes out of business? Nothing dramatic: keys are derived from your phrase under the open BIP-39 standard, so you can restore it in any other wallet that supports it.

Can I store my seed phrase in a password manager? Technically yes, but then the phrase lives on internet-connected devices and your wallet is no longer cold.

How much does it cost to send bitcoin to a cold wallet? On October 22, 2026, the network fee for a typical transaction was roughly $0.12⁠–⁠$0.23, but your exchange may add its own withdrawal fee — check it before you withdraw.

This is not investment advice.