Hot Wallet: What's the Real Cost of Convenience?

Cryptocurrency custody is constantly evolving, and it's vital to understand wallet types for those with digital assets. Throughout my years of research and investing in crypto, I've seen many struggle with the balance between accessibility and security. This Coinminutes guide explores hot wallets, their costs and benefits, without pushing you toward one type.

1Understanding Hot Wallets

Before jumping into hot wallet mechanics, let's discuss what makes a hot wallet "hot" and differentiates hot wallets from other storage methods.

A Simple Hot Wallet Definition

A hot wallet is a cryptocurrency wallet that is constantly or frequently connected to the internet. According to the SEC's Office of Investor Education and Assistance, a hot wallet can be a desktop application, mobile application, or web-based application. The key distinguishing feature is that the wallet operates in an internet-connected environment.

A hot wallet is an internet-connected crypto wallet.

Hot wallets store your private keys (cryptographic credentials that allow you to send transactions) in an internet-accessible location, which is different from other storage methods. The Investor.gov bulletin on crypto asset custody highlights that "hot wallets provide you with a convenient way to access your crypto assets for transactions, but they also expose your crypto assets to cyberthreats."

The name "hot wallet" comes from the wallet's connection to the internet, rather than the wallet's popularity. When I learned about this differentiation years ago, the difference between hot and other wallets seemed arbitrary. My experience tells me that this feature creates drastically different risk profiles and use cases.

Your Address, Private Key, and Recovery Phrase Explained

Cryptocurrency wallets generate and manage three things:

Crypto wallets rely on a public address, a private key, and a recovery phrase.

• Your public address is what you share so others can send transactions to you. Your address is always public, as transactions sent to it are visible on the blockchain network. Anyone can send crypto to this address, which means it's effectively your identifier on the blockchain. 

• Your private key is a cryptographic secret that allows your wallet to sign and authorize transactions sent from your wallet address. Once created, a private key is permanent and cannot be changed. Losing your private key means losing the crypto in that wallet, as private keys are what approve spending of your assets.

• Your recovery phrase (also called seed phrase or mnemonic phrase) is a series of 12-24 random words that allow you to recover your wallet if you lose device access, or hardware/software malfunctions. It can restore the wallet and regenerate its associated private keys. The custody basics bulletin explains that your recovery phrase generates your private keys mathematically. As such, having someone's can give an attacker access to the wallet's associated private keys and funds.

Bitcoin.org's crypto basics FAQ is clear that wallets don't actually store cryptocurrency. The actual Bitcoin or Ether exists as records on the blockchain. Your wallet simply stores keys that control those records, or allow you to spend those cryptocurrencies.

What Happens When You Send Crypto?

Understanding the mechanics of a transaction shows why your private key's security is vital. When making a crypto transaction, there are several steps:

First, you need to enter the recipient's address, the amount of cryptocurrency you wish to send, and the amount of the network fee you're willing to pay. Once you've made these selections, your wallet will construct a transaction message with this information. Second, your wallet will sign this transaction message with your private key. This step cryptographically proves that you (the owner of this private key) are authorizing this transaction. Finally, your wallet will broadcast the signed transaction to the network, where it will be added to the blockchain. 

Ethereum.org highlights that "a transaction sent on Ethereum is irreversible." Once a transaction has been confirmed, it is permanently added to the blockchain and cannot be canceled or altered. That means that if you send funds to an incorrect address, recovery is only possible if the recipient agrees to return the crypto.

This permanence drives many of the security practices I make when sending crypto. I always double-check the recipient's address, and send small test transactions to check addresses before sending larger sums. I recommend saving addresses in your wallet's contact list as well, which is something we advise at Coinminutes.

2Types of Hot Wallets: The App and the Custody Model

Hot wallets come in different flavors, and understanding their differences will help you determine which hot wallet suits you best.

Mobile, Desktop, and Browser-Based Wallets

Hot wallets can take different forms, with mobile, desktop, and browser-based being the main options:

Hot wallets include mobile apps, desktop applications, and browser extensions.

Mobile wallets run as apps on your mobile device and give you crypto access wherever you have your phone. Popular mobile wallets are MetaMask Mobile, Trust Wallet, and Coinbase Wallet. MetaMask Mobile and Trust Wallet include QR code scanners for easier address entry. 

Desktop wallets operate as applications on your computer's operating system. These applications normally offer more advanced features than mobile counterparts, such as hardware wallet support and advanced transaction features. Desktop wallets include Exodus, Electrum, and the desktop version of MetaMask. 

Browser-based wallets operate as extensions in web browsers, such as Google Chrome or Mozilla Firefox. MetaMask is one of the most widely recognized browser wallets for Ethereum and EVM-compatible networks. Browser-based wallets interact with dApps (decentralized applications) directly.

Custodial vs. Non-Custodial: Who Controls the Keys?

The custody model determines who has control of your crypto. This may seem like a minor difference, but the implications are massive.

Custodial wallets give a third party control of your private keys. When using a custodial wallet, such as a wallet offered by a centralized exchange, the private keys are managed by the entity providing the wallet service. According to the Investor.gov bulletin on crypto custody, with third-party custody, the custodian manages and controls access to your crypto assets' private keys.

Non-custodial wallets give you full control of your private keys. They can reduce third-party custody risk, but they do not eliminate user-side security risks.

Is MetaMask a Hot Wallet?

Yes, MetaMask is a hot wallet, which is evident from the fact that it operates primarily as a browser extension and mobile application. It typically requires internet access to read blockchain data and broadcast transactions. MetaMask stores encrypted versions of your private keys on your device, but requires an internet connection to read on-chain data and send transactions.

MetaMask is a hot wallet because it runs on internet-connected browsers or mobile devices.

MetaMask utilizes a non-custodial custody model, which means that ConsenSys (the company behind MetaMask) cannot access or control your private keys. As highlighted in the MetaMask documentation, MetaMask generates your Secret Recovery Phrase locally on your device and encrypts it. Only you have access to your SRP.

However, MetaMask does have the ability to connect hardware wallets (cold wallets) to the application, which store your private keys on the hardware device itself.

3Hot Wallet vs. Cold Wallet: Which Fits Your Needs?

One of the most important decisions you make when dealing with crypto is whether to utilize a hot or cold wallet. Your decision should be informed by how frequently you send transactions and how much risk you're willing to undertake.

The Main Differences at a Glance

The primary difference between a hot and cold wallet is the internet connection and the resulting security-convenience trade-off:

• Connectivity: Hot wallets are connected to the internet frequently or constantly, while cold wallets keep private keys offline on physical devices or paper.

• Convenience: Hot wallets allow for easier and faster transactions, while cold wallets require physical device interaction for each transaction.

• Security: According to the Investor.gov guidance on crypto custody, "cold wallets are generally more secure from cyberthreats than hot wallets." Cold wallets are physically disconnected from the internet, eliminating many cyberattack vectors. However, cold wallets entail physical security risks, such as device theft or loss.

• Cost: Hot wallets are typically free software, while cold (hardware) wallets typically entail a purchase price of $50 to $200.

When a Hot Wallet Is Useful

Hot wallets are beneficial in certain use cases, as the increased convenience has real-world advantages:

Hot wallets are best suited for frequent crypto activity.

• Regular transactions: If you regularly send crypto to merchants or pay bills in stablecoins, the convenience of hot wallets is invaluable.

• DeFi participation: DeFi protocols commonly require frequent on-chain transactions. Users must sign transactions in order to make swaps, provide liquidity, or open positions. This entails constant interaction with the blockchain.

• NFT trading: Trading NFTs involves numerous transactions, frequently with time constraints. Hot wallets are useful for taking advantage of opportunities as they appear.

• Small operational amounts: If you hold crypto as spending money, rather than long-term savings, then the hot wallet convenience is appropriate. Bitcoin.org highlights that "If you wouldn't keep a thousand dollars in your pocket, you might want to have the same consideration for your Bitcoin wallet."

How Much Crypto Should You Keep in a Hot Wallet?

Determining how much crypto to keep in a hot wallet is impossible to say with any degree of accuracy, as it depends on your risk tolerance and transaction frequency. There are several frameworks that can help you determine your personal hot wallet limit:

• The spending wallet approach: Think about your hot crypto wallet as your physical wallet. You likely don't keep large amounts in your physical wallet, just enough to cover small everyday expenses. Apply this same logic to your hot crypto wallet. Set aside enough for expected expenses, plus some extra, but not your life savings.

• The percentage method: Many people keep a certain percentage of their holdings in a hot wallet, frequently determined by their investment horizon. Active traders may keep 5-10%, while long-term HODLers may keep under 1% in hot wallets.

• The absolute value ceiling: Set an absolute value ceiling based on your risk tolerance. For some people, this may mean no more than $500 would be manageable but painful. For others, the threshold might be $5,000 or $50.

Bitcoin.org highlights that "It is a good practice to keep only small amounts of Bitcoins on your computer or mobile device for everyday use and to keep the remaining part of your funds in a safer environment." This is the approach we take at Coinminutes when developing our educational content, as it helps people keep their risk exposure in check.

4How to Choose and Use a Hot Wallet

Selecting and using a hot wallet properly establishes the foundation for safe crypto management. The choices you make when selecting and setting up a wallet will shape your experience with crypto for years to come.

What Should Beginners Check Before Choosing a Wallet?

Choosing your first cryptocurrency wallet presents confusing options. Here are some factors to consider before choosing a cryptocurrency wallet:

What you need to consider when choosing your first wallet.

• Supported assets and networks: Determine which cryptocurrencies and blockchains you wish to store and interact with. Some wallets are limited to a single blockchain, such as Bitcoin, while others offer multi-chain support.

• Custody model: Determine whether you want full control of your private keys (non-custodial) or are comfortable entrusting a third party (custodial).

• Development team and audit history: Choose wallets that have undergone independent security audits and have a strong development team.

• Recovery options: Consider how the wallet assists with recovery, such as recovery phrase management. Most wallets use a 12 or 24-word BIP-39 standard that can be used across other wallets.

• Platform compatibility: Ensure that the wallet is compatible with your devices (iOS, Android, Windows, etc.)

A Beginner-Friendly Setup Checklist

Setting up a non-custodial hot wallet requires a few steps:

How to set up your hot wallet safely.

1. Download from official sources: Always download the wallet from the wallet provider's website directly, rather than links you may find through search results or other websites.

2. Install and Create New Wallet: Install the downloaded file and open the application. Choose the "Create new wallet" option.

3. Write down your recovery phrase: Your wallet will show you a series of 12 or 24 words in a particular order. These words comprise your recovery phrase. This phrase is what recovers access to your wallet, so save this somewhere secure. Avoid saving the phrase as a digital image, or in the cloud, as the custody bulletin highlights. Never share the phrase with others, and always keep it somewhere physical (paper or metal).

4. Verify the phrase: Most wallets will ask you to verify the phrase by typing in several of the words.

5. Set additional security: Set up biometric security (fingerprint or facial recognition) and a strong device passcode.

6. Store your backup securely: Save your written recovery phrase in a secure location.

7. Test with small amounts: Before sending large amounts of crypto to the wallet, send some small amounts to verify everything is working properly.

Before You Send: Check the Asset, Network, Address, and Fee

Operational errors are the most common cause of people losing their crypto. Several checks can be made before a transaction to avoid losing crypto due to accidental wrong address entries:

To avoid costly transaction mistakes, users should make several checks beforehand.

• Confirm the asset: It's easy to select the wrong token, especially when tickers or token names are similar. Double-check that you're sending the correct asset before confirming a transaction.

• Verify the network match: Make sure the sending network matches the recipient's supported network. For example, USDC sent on Ethereum may not be recoverable if the recipient expects USDC on Polygon or another network.

• Check the complete address: According to Ethereum.org, "Always make sure the address you are sending to exactly matches the desired recipient's address before sending a transaction."

• Understand the fee: Transaction fees vary by blockchain, network congestion, and usually depend on how much data the transaction contains. Some wallets let you customize the fee, with higher fees usually resulting in faster confirmations.

• Consider a test transaction: When in doubt, consider making a small test transaction before sending larger amounts. Test transactions verify that the address is correct, the network matches, and the fee is appropriate for the transaction.

Are Hot Wallets Free to Use?

The software for the wallets themselves is typically free of charge. There are several costs that come with using a hot wallet:

• Network fees (also known as gas fees): These fees are paid to validators or miners for processing transactions. These fees are dynamic and depend on the network congestion. Gas fees apply to both hot and cold wallet transactions.

• Swap fees: Exchanging one token for another within wallet applications usually entails a swap fee.

• Custodial service fees: If you use a custodial wallet, such as a wallet provided by a centralized exchange, there may be additional fees for deposits, withdrawals, trading, and inactivity.

5Are Hot Wallets Safe? Security, Recovery, and Common Mistakes

Hot wallet security entails understanding your risks and the practices that mitigate them. It's important to highlight that no wallet type is completely secure, but there are several measures that can be taken to reduce the risk of losing crypto.

The Main Risks

Hot wallets encounter several security risks that cold wallets are typically not exposed to:

Hot wallets are exposed to online threats.

• Malware and keyloggers: Malware can log keystrokes, steal passwords, capture screenshots while your recovery phrase is displayed, read clipboard contents, or access wallet data.

• Phishing attacks: Phishing URLs mimic legitimate crypto services in an attempt to steal your credentials. Ethereum.org highlights phishing emails that "ask users to click on links that will re-direct them to imitation websites, asking them to enter their seed phrase."

• Compromised devices: Hot wallets on a compromised device can be exposed to malware.

• Malicious dApps: Connecting your wallet to malicious decentralized applications can expose your wallet to attacks.

• Social engineering: Scammers can impersonate trustworthy figures in an attempt to convince you to share your credentials.

Connecting, Signing, and Approving Are Different Actions

Understanding the differences between connecting, signing, and approving is vital to avoiding common hot wallet mistakes.

• Connecting your wallet to a dApp establishes a connection, but does not give the dApp permission to spend your crypto. 

• Signing a message or transaction utilizes your private key to cryptographically prove that you authorize a specific on-chain action.

• Approving token spending allows a smart contract to transfer a specified amount of specific tokens from your wallet. Approvals remain in place until you revoke them. MetaMask's documentation highlights that when interacting with smart contracts, do not allow unlimited spend limits.

Best practices include connecting only to trusted dApps, reading transaction details carefully before signing, setting specific token approvals (rather than unlimited), and revoking token approvals when you no longer need them. These are some of the topics we go over in our Coinminutes educational content.

Can You Recover a Wallet If You Lose Your Phone?

Whether you can recover a wallet on a new phone depends on if you've secured your recovery phrase properly:

Recovery depends on your wallet type and backup.

• If you have your recovery phrase: Most wallets can be recovered on a new phone by importing your recovery phrase. Simply download the wallet app on your new phone, choose "Import existing wallet," and type in your recovery phrase in the correct word order.

• If you lost your recovery phrase: According to Ethereum.org, "Without your seed phrase or private keys, your funds cannot be recovered. No one can reset your password or restore access to a self-custody wallet."

• If your account is on a custodial exchange: Contact the exchange's support team directly and ask them how you can recover your account.

What If You Suspect Your Wallet Has Been Compromised?

When you suspect your wallet has been compromised, it's important to act quickly.

1. Create a new wallet with a new recovery phrase on a clean, trusted device.

2. Transfer remaining funds to the new secure wallet.

3. Revoke all token approvals using Revoke.cash or similar services.

4. Identify the compromise vector to ensure it does not happen again. Common compromise vectors include exposure of your recovery phrase, malicious token approval, device malware, phishing, or interaction with a malicious dApp.

5. Scan your devices for malware and change passwords where necessary.

Unfortunately, most crypto thefts are irrecoverable. Taking precautions is much more effective than trying to recover stolen funds after a security incident.

6A Final Word on Hot Wallet

Hot wallets are excellent utility tools, but they come at the cost of heightened security risk. Only keep operational amounts in hot wallets, and secure larger amounts in cold storage. Your recovery phrase is one of the biggest security risks with hot wallets, so treat it like you would a large amount of cash. Match your security practices to your holdings, understand how your hot wallet operates, and double-check every transaction before you send it. With informed choices and proper precautions, you can manage your cryptocurrency at risk levels appropriate for you.