Hot vs Cold Wallets: How Crypto Storage Works

Disclosure: DeFi.com.au has no affiliate links, referral codes or paid placements. As at 30 October 2026, Dominet BV receives no payments from any exchange, wallet maker, stablecoin issuer or tax software company, and earns nothing if you open an account anywhere. General information: DeFi.com.au is a general information site operated by Dominet BV. This page is general information only and is not financial, tax or legal advice. It does not consider your objectives, financial situation or needs. Dominet BV does not hold an Australian financial services licence (AFSL), is not a crypto exchange or broker, and does not recommend any crypto asset, platform or product. Crypto assets are high risk and you could lose all the money you put in. For independent information see Moneysmart, and for tax see the ATO. Facts were checked on 30 October 2026. Read our general information notice.

A hot wallet is software on a phone, computer or exchange that is connected to the internet. A cold wallet keeps your private keys on a hardware device that isn't. Cold storage can make it harder for hackers to reach your keys, but neither type protects you if you lose your keys or get tricked into sending crypto away.

The short answer

Moneysmart describes crypto storage as digital or software wallets, called hot wallets, and hardware wallets, called cold wallets. Its crypto assets page, updated on 15 October 2026, explains that a private key is a secret code that lets you access your tokens.

With a hot wallet, the software can be held by you or by a trading platform on your behalf. With a cold wallet, a secure hardware device holds the private keys without being connected to the internet. Moneysmart says this can make it harder for hackers.

If you lose your private key, you usually lose the crypto. That's true whichever type you use. The bigger question is often who holds the keys: you, or a platform.

What a wallet actually holds

A wallet doesn't really hold coins. The coins are recorded on the blockchain, and the wallet holds the private key that lets you move them. According to Moneysmart's crypto assets information, that secret code is what lets you access your tokens.

Most wallets also give you a recovery phrase, a list of words that can restore the wallet on a new device. Wallet makers describe this backup as giving the same access as the device itself, so anyone who has the words can take your crypto.

Storage does not change the investment risk. Moneysmart says most crypto are high risk investments with very volatile values, and you need to be prepared to lose everything you put in.

Hot wallets

A hot wallet is a software wallet used on a phone or computer. It's connected to the internet, which makes it quick to use and also means it's exposed to online attacks such as malware and phishing. Moneysmart says a software wallet can be held by you or by a trading platform on your behalf.

Those are two very different set-ups. With a wallet app on your phone, you hold the keys. When you leave crypto in an exchange account, the exchange holds the keys and you have a claim on it.

A platform account also brings the provider into the picture. Moneysmart warns that many crypto asset providers are not licensed at this time and you may not be protected if a platform fails or is hacked. Our guide on how to check a crypto exchange covers what to look for.

Moneysmart also warns about fake wallets and apps, including apps you are told to download from a website. Download wallet apps only from the official app store listing or the maker's own site.

Cold wallets

Moneysmart describes a cold wallet as a hardware wallet that stores private keys on a secure device not connected to the internet. Keeping those keys offline can make it harder for hackers to reach them.

Note the wording: harder, not impossible. A hardware wallet still needs its recovery phrase kept safe, and it can't stop you approving a scam transaction yourself. It also does nothing about the price of the crypto it gives you access to. Our hardware wallets guide explains how the devices work, PINs and recovery phrases.

Side by side

Based on Moneysmart's descriptions:

Keeping your own keys vs leaving crypto on a platform

Hot or cold describes how keys are stored. Custody is about who holds them.

When a platform holds crypto for you, its failure or a hack can affect your access. Moneysmart says you may not be protected in those circumstances because many providers are not licensed at this time. It also says there is little hope of getting stolen crypto back after a hacker takes it.

That is changing. Under the Corporations Amendment (Digital Assets Framework) Act 2026, new platform laws commence on 8 April 2027. They cover digital asset platforms where an operator holds digital tokens for clients, as well as tokenised custody platforms.

The Act makes those platforms financial products. Providing financial services for them will require an Australian financial services licence or an exemption. There is a 6-month transition period, so not every platform will be licensed on day one. Read about the digital asset platform law from 8 April 2027 for more detail.

Habits that protect you

• Keep access details private: Never share your passwords, private keys or recovery phrase. Moneysmart says an exchange or platform will never ask you to share your password, and hardware wallet makers such as Trezor and Ledger say they will never ask for your recovery words.
• Double check addresses: Moneysmart identifies sending crypto to the wrong address as a risk. Check the destination before sending.
• Check transaction fees: Moneysmart warns about overpaying transaction fees, also called gas fees. It also warns that underpaying can mean losing the fee and the transaction.
• Treat unexpected tokens cautiously: Moneysmart describes mystery tokens appearing in a wallet that trigger a smart contract if you sell them. A token you did not buy can be part of a scam.

Moneysmart's crypto scams information also flags unexpected contact and pressure to act quickly. Fake platforms can show gains before locking you out. Our guide to crypto scams explains these warning signs.

If you have lost money to a scam, Moneysmart says to stop sending money, contact your bank or crypto platform immediately, report it to Scamwatch and tell friends and family.

Records for tax

The ATO's record list includes digital wallet records and keys. Its keeping crypto records page, updated on 22 June 2026, also lists receipts for buying, transferring or disposing of crypto, transaction dates, purposes and the other party. A wallet address is enough to identify that party.

The ATO also lists exchange records and the Australian dollar value at the time of each transaction. It suggests exporting transaction history regularly, with a reminder at least every three months, and exporting the complete history before closing an account.

According to the ATO, records must be in English or translatable into English and in writing, which can be electronic. Keep them for five years from the latest of when you prepare or obtain them, when transactions are complete, or the year the capital gains tax event happens.

These records also matter if you ever lose access. The ATO's page on loss or theft of crypto assets says you can claim a capital loss for lost or stolen crypto if you can show you owned it, and wallet details such as the public key and wallet address are part of that evidence. For questions about your circumstances, speak to a registered tax agent. Read our crypto tax guide for more.

Frequently asked questions

What is the difference between a hot wallet and a cold wallet?

A hot wallet uses connected software. A cold wallet stores private keys on a hardware device not connected to the internet. Moneysmart says offline key storage can make it harder for hackers.

Does a wallet hold the coins themselves?

A wallet holds the private key that lets you access your tokens. Moneysmart describes that key as a secret code and warns that losing it usually means losing the crypto.

Can a trading platform hold a hot wallet for me?

Yes. Moneysmart says a software wallet can be held by you or by a trading platform on your behalf. It also warns you may not be protected if a platform fails or is hacked.

Does a cold wallet remove crypto investment risk?

No. Keeping keys offline does not change Moneysmart's warning that most crypto are high risk investments with very volatile values. You can still lose everything you put in.

What if tokens I did not buy appear in my wallet?

Moneysmart warns about mystery tokens that trigger a smart contract if you sell them. Treat them as a likely scam, not free crypto.

Do I need to keep wallet records for tax?

The ATO includes digital wallet records and keys on its crypto record list. It also lists transaction receipts, dates and Australian dollar values, and suggests regularly exporting your transaction history.