Hot wallet or cold wallet? Where your crypto keys live

The difference between keeping crypto on an exchange, in a wallet app, and on a hardware wallet, with the Binance and Bybit thefts as examples.

Key points

Whoever holds the private keys controls the coins. A hot wallet keeps them on a device that is online, a cold wallet keeps them offline.
On an exchange, the exchange holds the keys for you. When Binance’s hot wallets were drained in 2026, its customers depended on Binance to cover the loss.
A hardware wallet is a cold wallet you hold yourself. It is the safer place for savings, but you alone are responsible for its recovery phrase.

Three places to keep crypto

	Who holds the keys	Online?
Exchange	the exchange	its hot wallets are online; it keeps part of the coins in cold wallets
Wallet app on your phone or computer (hot wallet)	you	yes, on a device that is online and can catch malware
Hardware wallet (cold wallet)	you	no, the keys stay on the device; it only signs transfers

What the big thefts show

This archive lists the biggest attacks. Two of them were crypto thefts from exchanges:

Binance, 2026: Binance says the intruders got in partly through a compromised staff laptop and drained its hot wallets within about four hours, on 11 blockchains according to the analytics firm Elliptic. Binance put the loss at USD 6.3 billion and is covering it from company funds.
Bybit, 2025: during a routine transfer from Bybit’s ether cold wallet, the people approving it saw a manipulated interface and approved a transaction that handed the wallet to the attackers. The FBI put the loss at USD 1.5 billion.

In both cases, customers who had left coins on the exchange depended on the exchange to make good the loss. Coins in wallets whose keys the customers held themselves were not touched.

Which one for what

Exchange: for the coins you trade. Keep only what you need there.
Wallet app: for small amounts you spend often.
Hardware wallet: for savings you do not touch for months.

A cold wallet is only as safe as its recovery phrase. The guide What is a recovery phrase? explains why.

What you can do

Move savings off the exchange into a wallet whose keys you hold.
Turn on a withdrawal allow-list at your exchange, so that coins can only go to addresses you approved before.
Sign in to your exchange with a security key or an authenticator app, not with codes by text message.
Keep only spending money in a wallet app on your phone.

Next step

The page Hardware wallets compared shows Ledger and BitBox with their companies, open source status, and CVE entries.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.