How to Store Crypto Safely: A Hot, Cold and Backup Plan

Storing cryptocurrency safely comes down to two decisions: where the keys that control it live, and how you would get them back if something broke. The coins themselves never leave the blockchain (what a crypto wallet actually stores explains why). This guide turns those decisions into a simple plan: a small hot wallet for spending, cold storage for savings, and backups that survive the loss of either.

The plan assumes you hold your own keys. Funds left on an exchange depend on the exchange’s security; custodial vs non-custodial wallets compares the two models, and hot vs cold wallets explains the difference between online and offline keys.

The Plan at a Glance

The split follows bitcoin.org’s security advice: keep small amounts on a computer or phone for everyday use and the rest in a safer environment. How much counts as small is your call. A useful test is how much you could lose to a stolen phone without real harm.

Step 1: Set Up the Spending Wallet

• Install the wallet only from the developer’s official site or app store listing. Fake wallet apps are a common way phrases get stolen.
• Let the app generate a new recovery phrase, write it down on paper, and lock the app with a strong PIN or password.
• Fund it with the spending amount only. Top it up from savings when it runs low instead of keeping a large balance just in case.

Step 2: Set Up Cold Storage for Savings

• Buy a hardware wallet from the manufacturer or an authorized reseller and set it up yourself. Never use a device that comes with a recovery phrase already printed or written in the box.
• Let the device generate a new phrase. Don’t reuse the spending wallet’s phrase, and never type the cold storage phrase into a phone or computer: once it is entered there, those funds are effectively in a hot wallet.
• Before moving savings, confirm the written phrase with the device’s backup check, or with a test restore while the wallet is still empty. Then send a small test amount and confirm that it arrives.
• Check every receiving address on the device’s own screen. Malware can change what your computer displays, but not what the hardware wallet shows.
• For large holdings, consider a multisig setup, such as 2 of 3 keys, so that a single stolen or lost key can neither drain nor lock the funds.

Not sure whether the wallet you picked gives you control of the keys? Which wallets let you hold your own seed phrase lists what to check.

Step 3: Back Up Both Wallets

• Write each recovery phrase on paper or stamp it into metal. Never keep a photo, screenshot, cloud note or email copy.
• Keep each backup away from the device it restores, and keep copies in more than one place so that a single fire, flood or burglary cannot take everything.
• Next to each phrase, note which wallet created it, the address type (bc1q or bc1p, for example) and the derivation path if it isn’t the default. A BIP39 phrase does not record these, and another wallet may need them to find your funds.
• If you add a BIP39 passphrase, store it separately from the phrase. Without it, the phrase opens a different, empty wallet.
• Decide who can reach the funds if you cannot, and how. How to store your seed phrase safely compares paper, metal and memorization and covers a recovery plan for your family.

Step 4: Move Funds Between Layers

• Exchange to savings: once you have finished trading, withdraw to the cold wallet, checking the receiving address on the device’s screen.
• Savings to spending: move a set amount when the hot wallet runs low, rather than spending straight from cold storage day to day.
• Before every transfer: compare the whole address, not just the first and last few characters; clipboard malware and look-alike addresses exploit exactly that habit. For large amounts, a small test transaction first is cheap insurance.

Habits That Keep the Plan Working

• Never share a recovery phrase. No wallet maker, exchange or support agent will ask for it, and anyone who does is trying to steal it. See how to protect your wallet from phishing.
• Use strong, unique passwords and 2FA on exchange accounts and the email behind them. 2FA protects accounts with a provider. It does not protect a recovery phrase, which restores a self-custody wallet on its own.
• Update wallet apps and device firmware from official sources only, and recheck your backup before a firmware update or a device reset.
• Keep your holdings private. Posting balances or wallet screenshots online makes you a target.
• Review the setup once a year: confirm that the backups are still readable and where you expect them, and that the people in your recovery plan still know what to do.

Common Mistakes

• Using one phrase for everything, so a compromised phone exposes the savings too.
• Leaving savings on an exchange long after the trade is done.
• Never checking a backup, or storing it in the same drawer as the device.
• Saving a phrase in a photo, a cloud note or any app that syncs online.