Cold storage explained: how exchanges keep crypto offline

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

In crypto, cold storage means that the private keys used to move coins sit on a device or medium with no connection to the internet. Without network access, nobody can steal anything remotely. That is why large exchanges keep most customer holdings cold, and why practically every security guide tells private investors to move larger sums off the exchange and onto a hardware wallet.

The term sounds technical, but the idea is old: cash goes in the vault, not in the till at the counter. Crypto works the same way, except that what is stored is not the coins themselves but the key that controls them. This guide explains how exchanges and investors organise cold storage, what the EU's MiCA regulation has required since 2024 and where the approach still breaks down. We compared which gives you more protection in everyday use in hot wallet vs cold wallet; this piece is about custody as a whole.

What is cold storage in crypto?

A private key is a very large random number used to sign a transaction. Whoever knows it owns the coins, no matter whose name an account is in. The coins themselves never sit in a wallet; they exist as entries on the blockchain. A wallet only manages the keys.

That gives a simple definition: cold storage is any form of custody in which the private key is generated and stored without ever touching a device connected to the internet. The counterpart is the hot wallet, whose key sits on a networked server, computer or smartphone, where it can sign transactions at any time. Only the hot version is convenient. Only the cold one is safe from remote attacks.

The difference between signing and sending matters. A cold wallet signs a transaction offline, and the finished signature then travels to the network through a connected device. The key never leaves the cold device. That is exactly what defines a Bitcoin hardware wallet: the computer it is plugged into only ever sees the signed message.

Hot wallet, warm wallet and cold storage: the three custody tiers

Exchanges and custodians almost always work with three tiers that differ in accessibility and risk.

Hot wallet for daily operations

An exchange processes withdrawals automatically from its hot wallet, often within minutes. It holds only as much as a day of regular withdrawals requires. If it is breached, that amount is lost, but not the rest.

Warm wallet as a buffer

The warm wallet sits in between: reachable online, but every movement needs extra approvals, for instance from several employees or through rules such as maximum amounts and waiting periods. The exchange uses it to top up the hot wallet.

Cold storage for the reserves

The large remainder is kept cold. Moving coins out of it requires people to act physically: fetch devices from a secure room, sign together, log every step. This takes hours to days, and that is deliberate. An exchange that can move its cold reserves in minutes does not really have any.

How exchanges organise cold storage: multisig and key ceremonies

A single key in a single safe would be a concentration risk for an exchange. If the safe fails or an employee defects, everything is gone. Professional custodians therefore spread control.

The most common method is the multi-signature scheme, or multisig: an address requires, say, three of five signatures, coming from separate keys at separate locations. An attacker would have to compromise several sites at once. An alternative is MPC, multi-party computation: the key never exists in full, only as fragments on several devices that compute together and produce an ordinary signature.

How the keys come into being is governed by a key ceremony. Several people generate the keys in a shielded room on devices that have never been online, and every step is documented and often filmed. The backups go to different locations. Behind this lies a principle from banking: no single person should be able to dispose of customer money alone.

Cold storage at Coinbase and Kraken: what the exchanges disclose

As a customer you cannot verify how much an exchange keeps cold; you depend on what it tells you. In its 2021 IPO filings, Coinbase said around 99 percent of customer holdings were in cold storage and about 1 percent in the hot wallet for daily withdrawals. Earlier company statements gave figures of 87 to 98 percent, so the number has moved over the years.

Kraken says on its security page that it uses “advanced cold storage and hot wallet solutions” and describes guarded rooms under video surveillance. The page gives no share. The frequently quoted 95 percent comes from third-party reports. Kraken also points to its proof of reserves, which lets customers check whether their balance was covered at the time of the audit.

Both statements say something about the split, but nothing about how good the processes around the cold reserves are. That is exactly where the biggest attacks of recent years struck. If you want to choose an exchange mainly on custody, look first for an EU licence under MiCA, because it comes with the obligations described below.

Bybit 2025: how attackers drained a cold wallet through the signing interface

On February 21, 2025, the exchange Bybit lost crypto assets worth around $1.5 billion. Five days later the FBI attributed the theft to North Korea, naming the group behind it TraderTraitor. Of all things, cold reserves were hit: according to Bybit CEO Ben Zhou, the attack affected a multisig cold wallet for Ethereum, while the hot wallets and the other cold wallets were untouched.

The key itself was not stolen. In the web interface of their multisig provider, the signers saw a correct destination address and signed, while a different transaction was queued for signature in the background, one that handed over control of the wallet. Later investigations traced this to manipulated code in the provider's interface. Cold keys, then, protect only as well as the person signing understands what they are signing.

The attack on Binance at the end of October 2026 shows a second pattern: according to our report of October 29, funds there flowed out of hot wallets, and the exchange said the entry point was a compromised computer. Both cases confirm the logic of the tiers. What is online can be attacked, and what is offline can be attacked at the moment it is signed.

The lesson for your own wallet

Before every approval, check the destination address on the hardware wallet's own display, not just on your computer screen. That small display is the only link in the chain that a manipulated website cannot alter.

MiCA custody rules: Article 75 separates customer coins from exchange assets

The EU's Markets in Crypto-Assets Regulation, MiCA for short, has applied since the end of 2024. Its Article 75 governs the custody of crypto-assets on behalf of clients. It does not prescribe a specific cold storage ratio. It does, however, require a custody policy that minimises the risk of loss through fraud, cyber threats or negligence, and clients are entitled to a summary of that policy in electronic form.

For investors, paragraph 7 matters most. Client holdings must be kept separate from the provider's own holdings, including on the blockchain, and they are legally segregated from the exchange's estate, so that creditors cannot reach them in an insolvency. Paragraph 8 covers liability: the provider is liable for losses attributable to it, capped at the market value of the crypto-assets at the time of the loss. At least every three months it must send you a statement of your positions.

In Germany, BaFin supervises providers, and the accompanying law is called the Crypto Markets Supervision Act (KMAG). Which companies already hold a licence and which obligations have applied since then is covered in our overview of the MiCA licence and its obligations. There is still no deposit guarantee for crypto-assets of the kind that covers a savings account. Segregation protects you against the exchange going bust, not against a hack.

Cold storage for private investors: hardware wallet, air gap and paper

As a private investor you have three common ways to store crypto cold. Each is a form of cold wallet, but they differ in effort and in how well they guard against attacks.

Hardware wallet

A hardware wallet is a small device with a secure chip that generates the key and never releases it. It connects to a computer or phone by cable, Bluetooth or QR code, but signs internally. For most investors it is the best compromise between security and everyday usability. The models we recommend are in our hardware wallet comparison.

Air-gapped devices

An air gap means a device has no data connection at all, not even USB. Transactions travel back and forth as QR codes or on a memory card. That rules out attacks over the cable and is worth it above all for holdings you will not touch for years.

Paper and metal

A paper wallet, meaning a printed key, is now considered outdated: whoever creates one usually uses a networked computer, and whoever uses one has to type the key into software at some point. Storing the recovery phrase on metal, as we describe in our guide on how to store a seed phrase safely, is the current approach. The metal plate is the backup for your hardware wallet, not a separate place to keep coins.

Is a cold wallet safe? Pros and cons of offline storage

A cold wallet is safe against the most common attack route: malware on an online device that grabs private keys or triggers transactions in the background. With offline storage that access simply does not exist. Exchanges, by contrast, speak of hot storage when they hold crypto assets on networked servers.

The advantages of a cold storage wallet are clear: protection against remote hacking, full control over your private keys and no dependence on an exchange that could go bust or freeze withdrawals. The drawbacks lie in handling. Every transaction takes longer, the device costs money, and nobody but you is liable for loss or mistakes. Safekeeping your assets becomes your own job.

An ordinary USB stick holding a saved key file, incidentally, is not a real cold storage solution. As soon as you plug it into an infected computer, the key is exposed. Paper wallets have the same problem when you redeem them. A hardware wallet, on the other hand, signs internally and never passes the key to the online device.

Is moving coins to an offline wallet taxable?

For crypto investors in Germany, transferring coins from an exchange to your own crypto wallet is not a sale, because the coins do not change owner. The holding period keeps running. Still, keep the records of purchase date and transfer, because the tax office can ask for proof of when the coins were acquired.

Multisig for private investors: when several keys pay off

What exchanges do on a large scale also works at home. A two-of-three multisig wallet spreads the risk across three devices in two or three places. If one device is lost or stolen, the coins are not gone, and a thief holding a single device cannot move anything.

The price is effort. You need several devices, wallet software that handles multisig properly and documentation your heirs can follow. For amounts in the low four figures that is usually overkill; once your holdings reach a level whose loss would change your life, it becomes a serious option. Our guide on how to set up a multisig wallet shows how to build such a setup step by step.

Limits of cold storage: lost seeds, inheritance and signing errors

Cold storage removes the risk of remote access. In exchange it creates others that you should know about.

Losing the recovery phrase: without a backup and with a broken device, the coins are permanently out of reach. No exchange and no manufacturer can recover them.
Theft of the backup: whoever finds your phrase does not need your device. A backup therefore belongs in a place only you know, and never in the cloud or in a photo on your phone.
Inheritance: if nobody knows the wallet exists or how to open it, the assets are lost to the family. Written instructions in a will or lodged with a notary close that gap.
Signing errors: as the Bybit case shows, the best cold reserves do not help if you approve a manipulated transaction. Phishing sites asking you to connect your wallet target exactly this moment.

Then there is daily life. Coins in cold storage cannot be sold on the spur of the moment when the market moves fast. Active traders deliberately leave part of their holdings on a regulated exchange and keep the long-term part cold. On a small scale, this split mirrors what the exchanges themselves do.

Cold storage: the hot wallet holds only what you will need soon

The professionals' rule of thumb works for you too: keep online only the amount you plan to move in the foreseeable future, and keep everything else offline. Here is how to put it into practice:

Define your cold holdings: decide which part of your coins will stay put for the long term and pick a device for it from the hardware wallet comparison. Buy it only directly from the manufacturer.
Check exchanges on custody: for the trading portion, use a provider with a MiCA licence that will summarise its custody policy for you on request. You will find a selection among the regulated crypto exchanges.
Keep small amounts cleanly separate: for payments and quick transfers, a software wallet on your phone is enough, as long as it holds only a small amount. Our overview of software wallets compares suitable apps.

(As of November 6, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions about cold storage

Cold storage is a way of holding cryptocurrencies in which the private keys sit on a device or medium with no internet connection. As a result, attackers cannot move the coins remotely.

Yes, a hardware wallet counts as cold storage because it generates the private key on the device and signs transactions there. The connected computer or phone only sees the finished signature, never the key.

Exchanges state their own ratios, and you cannot verify them. In 2021 Coinbase said around 99 percent of customer holdings were in cold storage, while Kraken gives no share on its security page.

MiCA Article 75 does not prescribe a fixed cold storage ratio, but it does require a custody policy against fraud, cyber attacks and negligence. Client holdings must be kept separate from the exchange's assets, which protects them from its creditors in an insolvency.

The key of a cold wallet cannot be stolen remotely, but the approval of a transaction can be manipulated. In the Bybit hack of February 2025, the people responsible signed a falsified transaction and around $1.5 billion was lost.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

How to Store a Seed Phrase Safely: What Steel, a Passphrase and Multisig Do for Your Wallet Backup

The Coldcard case pushed the manufacturer question to the front, while barely touching on where the backup is kept. This guide places paper, steel, the passphrase and splitting methods against the BIP-39 and SLIP-0039 standards.

November 1, 2026 6:39 PM

Google builds crypto custody for banks: what it means for your coins

On October 28, 2026 Google presented a custody service for crypto assets that splits the private key into fragments and never lets it arise complete in one place. The service is aimed at banks, and commercial release is announced for early 2027.

September 23, 2026 4:12 AM

How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps

Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.

November 2, 2026 9:43 PM

How to store crypto safely: protect yourself from hacks like the one at Binance

After the $6.3 billion hack at Binance: how to store your cryptocurrencies safely. Hardware wallets compared, wallet scanners such as MetaMask Security Alerts, the key settings on your exchange account and a seven-step checklist.

October 29, 2026 12:28 AM

Bitget Wallet opens EUR accounts: incoming euros become USDT or USDC

Since October 27, 2026 Bitget Wallet gives its users their own account number in euros and US dollars, and the app converts incoming money automatically into USDT or USDC. What that means for SEPA transfers, the MiCA status of the two stablecoins and the holding period is set out here.

October 14, 2026 1:30 PM

What is a hardware wallet? How the device protects your keys

A hardware wallet stores no coins, only the private key, and it never releases it. How signing works inside the device, what the 12 or 24 words mean, and which attacks the design cannot stop.

October 31, 2026 12:37 PM

Floin Cyberattack: MiCA Crypto Platform From Liechtenstein Goes Offline

Liechtenstein-based crypto platform Floin reports a cyberattack, remains offline and has now confirmed a data breach. What is known about the MiCA-licensed company, which customer data may be affected and what investors should do now.

October 11, 2026 1:24 AM

Three Mistakes When Setting Up Trust Wallet: The Twelve Words Never Belong on the Phone

Trust Wallet is set up in five minutes, yet three mistakes in those minutes regularly cost the entire balance. This guide covers the six steps, the real cost of a swap, and what applies in Germany on the holding period and supervision.

October 19, 2026 1:32 AM

Crypto audits after $1.18 billion in losses: “The problem is always scope”

Hacken counts losses of $1.18 billion across 107 incidents for the third quarter of 2026. 77 percent of that fell on components that were not examined at all in the last audit.

October 5, 2026 1:29 AM

Chainalysis attributes $387 million from the Bitget hack to North Korea: what matters now for investors in Germany

The analytics firm Chainalysis attributes the theft of around $387 million at Bitget to actors with ties to the DPRK and puts the annual total above one billion dollars. What that means for custody, choice of exchange and record-keeping in Germany.

September 24, 2026 1:34 PM

Cardano Slides Below $0.24: What ADA Holders Should Check on Leverage, Liquidation and Holding Period

Cardano has given back its move above $0.25 and trades around seven percent below the high of the past 24 hours. What that means for leveraged positions, the holding period of your tranches and the buying route under MiCA.

August 13, 2026 4:59 PM

Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed

A breach at Trezor shipping partner ShipMonk exposed names, phone numbers and home addresses of 13,689 customers in August; in September Trezor reported roughly 67,000 more in the US. Devices are safe, phishing risk is not.

September 25, 2026 4:11 AM

Bitget Pauses Withdrawals: Where Existing Customers in Europe Stand

Bitget reports unauthorised outflows of around $351.6 million (later revised to $387.5 million) and has suspended withdrawals. For existing customers in Europe, that closes the one route MiCA had left them.

November 2, 2021 11:14 AM

Comparison Between Ledger And Trezor Wallet

A crypto wallet works just like your physical wallet, but is also virtual. In this article, we will be looking at the Ledger and Trezor Crypto Wallets.

December 28, 2018 3:02 PM

How To Use a Trezor Wallet?

Trezor is a hardware wallet which gives exceptional security for managing Bitcoin and other cryptocurrencies private keys.It incorporates and deposits personal keys securely and enables users to carry trade without an Internet link. Trezor grants its users with numerous benefits, […]

October 6, 2026 10:32 AM

FinCEN drops the reporting duty for withdrawals to private wallets: what matters now for European investors

The US anti-money-laundering agency FinCEN withdrew two proposals on October 5, 2026 covering the reporting duty for self-custodied wallets and for mixers. In the EU the development runs in exactly the opposite direction: proof of ownership from 1,000 euros today, a ban on anonymous accounts from July 2027.

September 24, 2026 10:11 PM

Bitcoin Price Prediction: What to Check on Levels, Holding Period and Leverage Before the October 28 Rate Decision

Bitcoin is trading at around $83,800, a third below its October 2025 high, while the sentiment index reads greed. Which dates, levels and deadlines over the coming weeks really decide your net gain, and which of them you steer yourself.

September 4, 2026 10:15 PM

Trezor Data Breach: Am I Affected and What Should I Do Now?

Trezor widened the ShipMonk data breach on September 4, 2026: around 67,000 further people affected, just over 80,000 in total, from orders placed between November 2019 and August 2021. How to check in two minutes whether you are among them, and what an exposed home address means for self-custody.

August 5, 2026 10:33 PM

$130 Million Gone Because the Randomness Was Predictable: Which Hardware Wallet You Can Still Buy

The Coldcard flaw proved the most respected wallet is not the safest. Which vendor has which track record – and why now is the wrong moment to pause your savings plan.

August 21, 2026 4:27 PM

Wallet App Without BaFin Authorisation: When Holding Crypto-Assets Requires a Licence

On 19 August 2026 BaFin published two consumer notices on wallet offerings. Who controls the means of access decides whether an authorisation is needed.

October 20, 2023 9:53 PM

How to Keep Crypto Safe

After the $6.3 billion Binance hack: how to keep crypto safe. Hardware wallets compared, wallet scanners such as MetaMask security alerts, the exchange settings that matter and a seven-step checklist.

October 12, 2026 1:42 AM

Bitget Wallet is not the exchange: one of two required key shares sits on Bitget's server

The attack on the Bitget exchange of September 24, 2026 hit the venue's hot and warm wallets, not the keys in users' wallets. What matters all the same is which variant you run: in the keyless wallet every signature needs a key share from the provider's server.

September 16, 2026 1:28 PM

Crypto Withdrawal to Your Own Wallet: Ten Providers Checked, Three Will Not Let Your Coins Out

Seven of ten providers available in Germany offer a payout to a wallet address you control yourself; three do not. Our survey of September 16, 2026, shows how to spot the difference before you buy, and why the question matters right now.

August 24, 2026 1:22 PM

Phantom Wallet Ends Sui and Monad Support: What to Do Before the Deadlines

Phantom Wallet removes Monad from its app on August 26 and Sui on September 24. The balances are not lost, but only one of the two ways out leaves your tax position untouched.

August 20, 2026 4:24 PM

Bitcoin Across Multiple Wallets: How Austria Works Out the Acquisition Cost

Bitcoin spread across several wallets? How Austria works out the acquisition cost and the rolling average price for tax purposes.

September 26, 2026 7:34 AM

Setting Up a Multisig Wallet: When Two of Three Keys Are Worth It for You

A multisig wallet demands several keys for a transfer and so makes a single theft worthless. We show which threshold fits you, what you have to back up besides the keys, and why most setups fail at the configuration.