What Is a Hot Wallet? How It Works, Types and Examples
A hot wallet is a crypto wallet whose private keys are stored on a device that connects to the internet, such as a phone app, a desktop program or a browser extension. Because the keys are already online, it can create, sign and broadcast a transaction in seconds; for the same reason, anything that takes over the device can reach them. This page explains how a hot wallet works, which wallets count as hot and how to run one safely. For a side-by-side comparison with cold storage and help deciding which funds belong where, see hot vs cold wallets compared.
Hot Wallet at a Glance
| Question | Hot wallet |
|---|---|
| What it is | Software that keeps private keys on an internet-connected device and signs there |
| Main types | Mobile apps, desktop programs and browser extensions; exchange accounts are often counted too |
| Examples | BlueWallet, Electrum, Sparrow, MetaMask, Trust Wallet, Phantom, Exodus |
| Good for | Spending money, frequent transfers, Lightning payments, dApps |
| Main risks | Malware, fake wallet apps, phishing for the recovery phrase, a stolen unlocked phone |
| Backup | The recovery phrase; in an exchange account, the exchange holds the keys |
What Makes a Wallet “Hot”?
The SEC’s investor bulletin on crypto custody defines a hot wallet as one connected to the internet, whether a desktop, mobile or web application, and notes that the convenience comes with exposure to cyberthreats. The Bitcoin developer guide describes the same design as a full-service wallet: one program generates the keys, watches the blockchain, and creates and signs transactions. Its main disadvantage, the guide says, is that it stores the private keys on a device connected to the internet.
“Hot” describes the keys, not the brand of the app. Sparrow or Electrum connected to a hardware wallet holds only public keys and is not a hot wallet, since the signing happens on the device. The reverse also holds: type a hardware wallet’s recovery phrase into a phone app and those funds now sit in a hot wallet.
How Does a Hot Wallet Work?
A wallet does not store coins. It manages the private keys that control unspent transaction outputs (UTXOs) recorded on the blockchain, and its job is to build valid transactions and produce the signatures that authorize spending (what a crypto wallet actually stores covers this in depth).
During setup, the software generates or imports a recovery phrase. The phrase is turned into a seed, the seed into a master private key, and BIP32 derivation produces the child keys behind each Bitcoin address, along a derivation path that depends on the address type. The keys are then saved on the device, usually encrypted under your PIN or password.
When you send a payment, the wallet:
- Selects one or more UTXOs that cover the payment and the fee.
- Builds inputs that reference those outputs, and new outputs for the recipient and for your change.
- Calculates the signature hash required by the script type being spent (legacy, SegWit or Taproot).
- Decrypts the private keys and signs each input.
- Serializes the transaction and broadcasts it to the network.
The transaction does not move stored coins. It spends existing outputs and creates new ones; after confirmation, the old UTXOs count as spent and the new ones can be spent later. Because the wallet stays connected, it can estimate fees from current demand, watch the transaction wait in the mempool and track confirmations as they arrive.
Encryption protects the keys while the wallet is locked. The developer guide points out its limit: it cannot stop an attack that captures the password or reads the decrypted keys from memory while you sign.
Types and Examples: Mobile, Desktop, Extension and Exchange
| Type | Examples | Who holds the keys |
|---|---|---|
| Mobile app | BlueWallet, Trust Wallet, Phantom, Exodus | You |
| Desktop program | Electrum, Sparrow, Exodus, Bitcoin Core | You |
| Browser extension | MetaMask, Phantom, Trust Wallet | You |
| Lightning wallet | Electrum’s Lightning feature and dedicated Lightning apps | You, or the provider in custodial Lightning apps |
| Exchange or web account | Coinbase, Kraken, Binance | The exchange (a custodial wallet) |
A few notes on the table:
- Lightning wallets are hot by design. A Lightning wallet signs a channel update every time you pay or get paid, so its keys have to be online.
- An exchange account is custodial. It is often listed as a hot wallet because you reach it online, but the exchange holds the keys and decides how much of its customers’ money sits in hot wallets and how much in cold storage; the SEC bulletin notes that custodians may use either or both. Custodial vs non-custodial wallets explains what that changes for you.
- Desktop wallets can switch roles. Electrum, Sparrow and Bitcoin Core can also work as watch-only wallets for a hardware wallet or an offline signer, which takes the keys off the online computer.
Can a Hot Wallet Be Hacked?
Bitcoin’s cryptography is not the weak point; the device around the keys is. Electrum’s documentation on malware lists attacks that apply to any hot wallet:
- Fake wallet apps. Attackers clone a wallet’s website on a lookalike domain and buy search ads for it. The fake app opens your wallet, then sends all the coins out or uploads the recovery phrase.
- Clipboard hijackers. Malware watches the clipboard and replaces a copied address with the attacker’s.
- Fake support. “Support” accounts reply to forum posts and ask for the phrase or push a “new version”.
- A compromised computer. Other malware on the same machine can read the wallet file or memory.
Add phishing pages and malicious approvals, scams that collect recovery phrases and a stolen phone that was left unlocked. A confirmed transaction cannot be reversed, so one unauthorized signature usually means a permanent loss.
How to Keep the Keys Safe
- Install the wallet from the developer’s official website or the store listing linked from it, never from an ad or a link in a message.
- Keep only spending money in it. Bitcoin.org’s security advice is to keep small amounts on a computer or phone for everyday use and the rest somewhere safer.
- Lock it with a strong PIN or password, and keep the phone or computer and the wallet app updated.
- Write the recovery phrase on paper and keep it offline and away from the device (how to store a seed phrase). Never give it to anyone who asks for it, whatever they claim to be.
- Check the whole address before you confirm, and read every approval request in full.
- Give savings their own wallet with a separate phrase. How to store crypto safely lays out a spending wallet, cold storage and backups as one plan.
Two-factor authentication protects accounts with a provider, such as an exchange login. A self-custody hot wallet has no account behind it: whoever holds the phrase can restore the wallet anywhere, so the phrase is what you protect.
When Is an Online Wallet the Right Choice?
A hot wallet is the right tool for money you move often: everyday payments, Lightning, DeFi and NFT apps, or the next amount you plan to trade. It is the wrong place for savings you will not touch for months. Those belong in cold storage, such as a hardware wallet, where the keys never touch an online device. For the trade-offs side by side, see the hot vs cold wallet comparison; hardware, software and multisig setups are collected in the wallet guides hub.