GUIDE
Cold storage without the theatre: a practical setup
Cold storage means keys that have never touched an internet-connected machine. What that actually requires, and what is security theatre.
Quick answer
Cold storage means the private key is generated and stored on a device that never connects to the internet. A hardware wallet achieves this for most people; air-gapped setups add complexity that helps only specific threat models.
Cold storage attracts elaborate rituals. Most of the elaboration adds ways to lose funds without addressing anything a hardware wallet does not already handle.
What cold actually means
The private key is generated and remains on a device that has never been connected to the internet. Transactions are signed there and only the signed transaction crosses to a networked machine. That is the whole definition.
What is enough for most people
A reputable hardware wallet, a seed phrase written on durable material, two copies in two separate physical locations, and a tested restore. That covers malware, device failure, fire and theft — which is the realistic threat set for almost everyone.
What is usually theatre
Multi-location split schemes with no rehearsal. Elaborate passphrase systems only one person understands. Anything whose failure mode is “the person who set this up is unavailable”. Complexity adds failure modes at least as fast as it adds security, and the failures are silent until the day you need it to work.
Where extra complexity does earn its place
Multisig for genuinely large holdings or shared control, where no single compromised key loses funds. It is real security with real operational cost, and it is worth it above a threshold that most people are nowhere near.
The step that is not optional
Testing the restore. A cold setup you have never restored from is a hypothesis. Fund it, wipe the device, restore from the written backup alone, verify — the procedure is in our seed phrase guide, and it is the difference between cold storage and an expensive assumption.
Related reading
- How to back up a seed phrase properly (and test that it works) — Most lost crypto is lost to bad backups, not to hackers. A practical method for storing a seed
- How to spot a crypto scam: the patterns that never change — The technology changes; the manipulation does not. Six patterns that cover the overwhelming majority of crypto scams.
- Hardware wallet vs software wallet: choosing by threat model, not by price — The right wallet depends on what you are defending against and how much you hold. A threat-model approach
Key takeaways
- Cold means the key never touches a networked machine.
- Complexity adds failure modes as fast as it adds security.
- Test the restore or you do not have cold storage, you have a hope.
Frequently asked questions
Is a paper wallet cold storage?
Technically, if generated on a clean offline machine. In practice paper wallets have caused many losses through generation mistakes and degradation. A hardware wallet is the better route.
Do I need multisig?
Only for large holdings or shared control. Below that it adds operational risk out of proportion to the benefit.
